The use of physical measures (such as locks and tamper-proofing) or policies (such as Clean Desk) in order to protect sensitive information from unauthorized access.

learn more… | top users | synonyms (1)

2
votes
0answers
13 views

What is the current state of RFID / NFC security?

I'm attempting to do some RFID and NFC cloning and replaying research, as I'm hoping to be able to demo physical security as an attack vector to a few of out clients and prospects. The downside ...
4
votes
1answer
63 views

Wiping magnetic stripe on card with magnet?

I asked a question a while back on using magnets (for example powerful Neodymium ones) to wipe a HDD, and got shown a good article proving it is not possible to wipe data. Pretend I am about to ...
5
votes
2answers
141 views

Mitigating forensic memory acquisition when an attacker has physical access to a workstation

My question regards whether or not the mitigations I use are appropriate for my threat model. Please don't jump to conclusions and say "you need to use locks" or "you can't leave your computer ...
1
vote
0answers
18 views

Can a JTAG device be attached to a running system?

JTAG, or Joint Test Action Group, is a standard for debugging. Many modern motherboards, both on mobile devices and on desktops and workstations have JTAG ports. They allow a CPU to be controlled like ...
1
vote
1answer
1k views

What is a AUTH-KEY in the security of the computers?

I'm studying security in computers and in particular the URL Spoofing. I understand that a form of URL spoofing is phishing. Then I read that a countermeasure against phishing is the authentication ...
0
votes
2answers
87 views

attacks via physical access to USB (dma…?)

I wonder if USB can be exploited by someone with physical access to a reasonably secured computer. For example a kiosk, or laptop attached to a desk. Obviously, boot sequence should be secure (disk ...
6
votes
2answers
167 views

Can motion sensors be disabled by lasers without triggering the alarm?

I remember when I was a kid and was waiting for someone in a long hall, there was a motion sensor and security panel by the door. To kill time, I would go away from the door, then try to move so ...
0
votes
1answer
21 views

Why don't terminal IDs prevent unauthorized entery?

I'm studying for CISSP and had gotten this question wrong. I also found it and the correct answer online, but still don't understand the reasoning. Source Which of the following controls is ...
2
votes
2answers
89 views

Are passport stamps a reliable security feature? [closed]

Most countries in the world still place passport stamps on arrival/departure into the country. Theoretically it is then possibly to calculate the length of a person's stay in a specific country. Is ...
3
votes
4answers
1k views

Are malicious scripts in batch files detected by antiviruses?

We have many scripts in shared folders in our IT Department. Are malicious scripts in batch files detected by antiviruses?
13
votes
4answers
1k views

Is it possible to prevent a physical attack on full disk encryption?

I've been researching into some methods to ensure that disk encryption keys can't be stolen, and one that I've come across is called TRESOR. With this kernel patch, you can create a partition that is ...
11
votes
6answers
9k views

Is it safe to use virtual machines when examining malware?

We want to study for the CEH program and have downloaded 12 DVDs that 6 DVDs are software key-loggers, Trojans, etc. that are all detected by antivirus. This prevents us from examining them and ...
17
votes
3answers
50k views

Can law enforcement track a criminal through dynamic IP address?

I ask because a week ago my home was broken into and, among other things, my iMac computer was stolen. I am desperate to get it back because it has all the pictures of my daughters from the last ...
-4
votes
3answers
101 views

Is there a way to secure a Linux machine in a way that no one else (but me) can access its contents? [closed]

And I mean, even if someone tries rooting with a Live CD, even if one takes the HDD away and plug it in somewhere else, etc... I want to be able to give a client a machine with a service running, but ...
1
vote
1answer
44 views

Location/proximity based decryption using separate machine

I read a long thread where the whole issue was revolving around deriving decryption keys from GPS location. This has huge issues, as being present at a location is not needed to know the location. ...
4
votes
1answer
105 views

Motion sensor door locks

I have seen several offices with electric locks for entry that have a sensor for exit. I assume it's some kind of motion or object detection sensor. This is odd because in many cases, there's a ...
2
votes
3answers
811 views

Is there such thing as a password enforced write protected flash drive?

We would like to provide a flash drive to a client, that they can boot to, which includes a read-only operating system of our own customization, probably Linux. Every boot, it starts from clean slate. ...
34
votes
13answers
7k views

Laptop Anti-Theft Measures

A law firm I've been in contact with has recently been broken into 3 times in the past 4 months. In spite of a number of laptops and other equipment containing sensitive information being stolen, the ...
-10
votes
1answer
127 views

How to protect my laptop screen from being hacked? [closed]

My laptop screen has been hacked, and I think that it is by Van Eck phreaking method. The attackers can see my screen, they are seeing my screen right now. I never even talk to them and these ...
3
votes
1answer
53 views

Information Security on a lost android phone

Recently, my android mobile phone was lost/stolen. I had logged into several applications such as Facebook, Paytm, etc. Thus, there are chances that my personal/ transaction details might be leaked. ...
6
votes
2answers
70 views

What is collusion and how does seperation of duties prevent it, or fail to prevent it?

I'm studying for CISSP and came across the term "collusion". I understand it means when people work together to steal something, but don't quite get it. For example, if two gunmen rob a bank would ...
3
votes
5answers
215 views

How should I store a physical written copy of my password? [duplicate]

I can employ all the fancy encryption and the randomest of passwords to my hard drive, but it won't do me any good if I don't remember how to log in. It seems sensible to write down my password, ...
0
votes
1answer
62 views

Securing a public computer meant for banking

I sometimes visit my bank personally to handle certain formalities. Inside there is a booth containing a computer and all equipment necessary to log in to the online banking service. The computer is ...
104
votes
8answers
19k views

My school wants to keep the details of our door authentication system a secret. Is that a good idea?

So, I am designing a door authentication system (can't really go into more detail) for our school, so that only authenticated persons can go through a certain internal door. They hold that its inner ...
7
votes
4answers
221 views

Must a system be insecure against physical access? If so, why?

Inspired by: Why don't OSes protect against untrusted USB keyboards? Related: What can a hacker do when he has physical access to a system? (I address the points of its main answers below.) There ...
80
votes
14answers
11k views

How can I protect myself from false accusations when our company practices password escrow?

During an internship for a small company, my boss created an account for me, so I generated a password and I used it. The next day, my boss told me to write down the password of my account on a piece ...
11
votes
1answer
727 views

How to apply IT Security knowledge to Home Security?

Today my car got stolen from my house, and it is possible the person who did it has access to my home. I try to take secure measures online to maintain security, yet it seems I never paid attention to ...
2
votes
2answers
193 views

Securing physical access to your internet connection? (Apartment Utility Box)

I recently moved to a new apartment complex, had my DIY Time Warner box ready to go and hooked up my all my hardware. Everything booted fine but no connection to TW. I tested all the jacks in the ...
3
votes
1answer
56 views

Loss of physical locks/password to safes

Safes can keep important information like part of a dual control password, smartcards and pendrives, and so on. What would be the best practices to prevent loss or damage to a physical locks to a ...
1
vote
0answers
41 views

What else can I do to protect my accounts? [closed]

I am trying to make sure all my accounts are secure from unauthorised access and have turned on all security measures that I can find to make sure my stuff is protected. Here is what I have in place: ...
-3
votes
2answers
88 views

Defense in depth

How is defense in depth strategy different from network security policy? What is the need to name it a "Defense In Depth", although you may simply name it "Network security policy"? Secondly if DID ...
3
votes
2answers
75 views

Shutdown if case opened

Assume the user has a full disk encrypted HDD in which their OS and files reside. They also have made attaching USB or any other device without first allowing it cause an automatic shutdown which ...
2
votes
2answers
445 views

What are my options for securely printing an OTP Scratchcard?

I want to print and distribute several One Time Passwords (OTPs) that can't be easily disclosed to a 3rd party in transit. (think the physical version of a TLS session for private secrets) To me ...
13
votes
2answers
379 views

What does banking etc. server room protection look like? What happens if it fails?

Given that information security is derived from physical security, as evidenced by this theft, I'm curious as to what protection surrounds my bank account? There are two main avenues I'm interested ...
54
votes
8answers
6k views

Why would security cover things like natural disasters?

I'm taking a course which is designed with the CISSP certification in mind. Though the class is categorized as software engineering, we talked a lot about physical security and, in particular, floods, ...
2
votes
0answers
27 views

Reasonable means of security in commercial dealings [closed]

I am writing a paper from a legal standpoint and I'm suggesting legislation for a new duty of care for private companies in the safeguarding of customer's personal information. This will not apply to ...
48
votes
8answers
28k views

Are powerline ethernet adapters inherently secure?

I have 2 Zyxel PLA407 powerline adapters. Router is downstairs connected to one adapter, other adapter is upstairs about 30 feet away connected to a desktop. I have a house, not an apartment or ...
2
votes
2answers
665 views

What is the security of random code for authenticating products?

I have seen a startup (Verify Kero) that is building a product for verifying consumer goods. It places a 16 digit secret code under scratch-able coating. Consumer finds the code behind coating and ...
41
votes
8answers
5k views

Is physical security less important with disks on a server being encrypted?

If you could get physical access to a server, you could change the root/admin password even if you did not know the current password. However with encrypted disks, I don't think this is possible ...
19
votes
2answers
3k views

Why did the Papal conclave use a Faraday cage in 2013 when selecting the new pope?

The Wikipedia article about Faraday cages has this anecdote: A Faraday cage was used in 2013 by the Vatican to shield the Sistine Chapel from electronic eavesdropping during the secret papal ...
36
votes
3answers
2k views

Evaluating the security of home security cameras

My parents have a vacation home out in the country and are looking to setup a home surveillance system for remote viewing. I've heard that there can be serious vulnerabilities in these products. What ...
2
votes
2answers
104 views

Physical protection of your servers?

Here is a scenario. You are a small startup company that makes a video game. In your video game, you can exchange money for items. You are not dealing with the credit card/debit card directly but ...
1
vote
1answer
116 views

SSH Key vs Complex Password with Fail2Ban & Two Factor Authentication

Normally you hear that using an SSH Key is far more secure than using a regular password. However I've been wondering if this statement is really true. Let's say we have the following variables for ...
5
votes
0answers
275 views

Ethical Hacking Certification (CEH v9) From A Web Developer's Perspective [closed]

I just finished a week of training for the CEH v9 certification. I have two questions: What are some strategies I can take for studying for the CEH v9 certification coming at the test as a web ...
7
votes
3answers
106 views

Is it possible to determine if the BIOS has been modified between two points in time?

Is it possible to determine if the BIOS of a computer has been modified between two points in time from that computer while it's running ? Effectively I'd like to be able to gather the equivalent of ...
4
votes
4answers
203 views

How can I prevent someone from carrying out a file from a machine

Assume the following scenario: You have to set up a machine in a way that a user is unable to bring out a certain set of files (or a single file only) from that machine while he has to be able to ...
37
votes
5answers
4k views

Risk of tampering when hardware shipment is delayed

I am currently receiving an order of computer parts in the mail including an SSD. Tracking showed that the package arrived in my town on day X, and was originally scheduled for delivery on day X as ...
0
votes
1answer
31 views

Sophos Safeguard detecting content of zip files being uploaded

Is it possible to use Sophos safeguard to detect when computers in the network upload certain files online when they are compressed in a zip file? (or 7z or similar). I've seen it is possible with ...
136
votes
8answers
15k views

How should I set up emergency access to business-critical secrets in case I am “hit by a bus”?

I work as the primary developer and IT administrator for a small business. I want to ensure that business can continue even if I suddenly become unavailable for some reason. Much of what I do requires ...
4
votes
2answers
123 views

Can single-purpose PCs be useful as a security measure in this situation?

In the context of a small scale operation, we are considering use of single special purpose PCs allocated to single security-sensitive tasks - for example, certain financial operations. The intended ...