Securing an area both physically and technically

Question

I work for a commercial printing company, and we're beginning to get a couple jobs labeled "High Security". Essentially this means that if any pictures/information/files/etc. of the product were released publicly it would mean tens of thousands of dollars lost for our customer.

While it's fairly simple to secure an area around a printing press (no one is allowed around it aside from machine operators, and all printed materials are covered at all times), I'm running into a couple of walls while the artwork is passing through our prepress department (prepping the artwork for the press. Lots of photoshop work and stuff like that). All files are prepped on Macs (running Snow Leopard)

What we have already implemented:

• Biometric locks on doors that access the server room
• Keycard locks on doors that access the prepress area
• PTZ cameras targeted at key positions
• SFTP file transfer (files coming from client to us. Files are immediately deleted off the FTP server after they are retrieved)
• No local file storage - files always stay on a flash drive which never leaves a manager's sight.

Things I'm still worried about:

• Pictures being taken with mobile devices

  • We've considered purchasing cell phone detectors, but they seem a bit flaky. They're only guaranteed to check at about ~20 minute intervals. Also, the ones I've found are either pretty junky looking (chinese resellers) or are $3000+

• Local storage of files until we are no longer in "high security mode"

  • We block off internet connections while under high security, but it is reopened once the job has closed. How can I stop people from saving the file locally and then posting it somewhere once the net connection is established?

• Is mingling an SFTP server and an FTP server really secure?

  • Right now our FTP server and SFTP server are actually located on the same box. Does this make our SFTP less secure, or are we fine?

---

What can I do to fix the above issues? Are there any other things I should be thinking about before I officially say prepress is secure?

This question was IT Security Question of the Week.
Read the Dec 16, 2011 blog entry for more details or submit your own Question of the Week.

Answer 1

Quick background: I'll refer to everything that's related to your "secret image" as Red, everything else as Green.

Cell phones

I set my iPhone to airplane mode, grab my picture, and upload it at home. Forget detecting the signal; detect the phone. No comms or photo devices allowed in secure areas, even if it's a 10 year old Nokia brick. Use a metal detector. Get rid of iPod shuffles too.

Internet

For "red" machines, no and never. Well, it's not quite a disconnected world and the tradeoff of firewalling everything but Apple and Adobe update sites is probably a reasonable compromise on time versus sneaker-netting updates or downloading files to a bastion host.

Flash drive

I'd go the other way and only keep files stored locally. Besides the fact that flash drives are notorious for getting lost, the file can be copied to the local system anyway, and then onto a new flash drive. We've moved to a world where keyboards and storage media plug into the same physical port which sucks from a security standpoint. Epoxy in the ports is usually a good idea, but you would still need to keep that keyboard plugged in, and that's not easy. I suggest setting up auditd to detect any USB activity that isn't a keyboard or mouse and to push that log over the network to a monitoring device that emails and pages half the damn company at once. If you put a mass storage device in, somebody will come for you within a minute. Also, be careful about CD burners. If you can disconnect the drive, all the better.

Actually, also make sure you disable the drivers for mass storage over external drives: http://www.techrepublic.com/blog/networking/disable-usb-storage-under-os-x-or-windows/297... and still implement the audit logging. Try taking steps to detect if a machine has been unplugged from the network too.

SFTP server

Ensure that only one account can read files, and that's the account that moves things from your green network to your red network. An extra bonus if you enforce read-only to everything and use server scripts to push data to the red network. That may require some fancy permissions work and installing a mandatory access control framework if you use the standard SFTP subsystem of SSH.

I'd also consider running ProFTPD as the backend for SFTP as it does allow for more fine-grain permissions control enforced by the application config.

Machine Configuration

"Deep freeze" your machines so that they boot the same configuration every single time and keep no new files. Procedure should be to shutdown machines when done with them, or at least reboot between users. Store all your client files on one central share and audit log all access to that share.

Answer 2

Depending on your circumstances, some controls exist for these.

Mobile phones Are you in a position to ban mobile phones in the secure part of your site? If so, make it a disciplinary/sackable offence to breach this rule, and possibly add financial penalties to make it less worthwhile for a member of staff to do this. You check for compliance by searches on entry and exit as well as random on site spot checks.

Local storage Provide read-only filesystems unless the user needs to be able to write. Watermark every file and implement a data loss prevention solution which monitors all files on the network to disallow the movement of files unless they are classified as suitable to transmit.

FTP Why do you use FTP at all - risks include:

• using similar passwords on both, an attacker that sniffs ftp traffic will have a much better chance of guessing the SFTP password.
• breaching the controls around the FTP daemon might be easier than around the SFTP one, and in any case the attack landscape is wider as there are two applications.

Staff vetting could help you reduce your risk as well.

Answer 3

One thing I don't see here - where's your personnel policy? Where's the training to the teams working on this?

In the end, it will boil down to whether or no people are doing their jobs and whether or not they perceive security as part of their jobs. I'm assuming here that your "high security" is in the nature of commercial industry/intellectual property protection - not in the government clearance sense of "high security" where there are very precise definitions of what the physical security requirements are.

A couple thoughts:

• Security training - to all staff who are allowed into the "high security" area.
• Urgonomics - have a place where workers can stash cell phones, have well-published information about land lines, have places outside of the zone where people can make cell phone calls or get internet access - in general, make it easy to follow the policy so people aren't working hard to circumvent it just for convenience.
• Zero tolerance - if this is high stakes and your company's reputation rests on managing this appropriately, communicate that to the people working on it. Have a very clear, very consistently enforce process for warning, documenting issues and terminating people who do not follow the rules. Make it clear that failing to follow the rules is jeopardizing your company's ability to make money. Get help from HR and legal.
• Process for entering and exiting "security mode" - be sure of the low level ramifications for entering and exiting the mode - both physically - what signage is posted? and digitally - how is memory wiped? are hard disks reimaged? zeroized? destroyed completely? Similarly - how are backups stored? Not loosing the data is as important as not compromising it.
• Authentication/access control - both to the network/machines and to the building
• silly question but .... windows? doors? stairs? What's visible of the work area?
• diagnostics - what information do you have about who accessed the space & when? Both physically and on the network. How tamperproof are these logs?
• disposal - used media (CDs/DVDs), removable media (USB drives, etc), printers, computers - what are your destruction procedures?

I think my main point is that the place where things most often go awry is where the people and the work area meet. It's not that people are malicious (unless they are...) - more that they fail to realize what can cause a problem.

It may be that these things are beyond your purview, but I think it's well worth extending a bit to see what you can do to train people and get them thinking smarter. Also, I can't emphasize enough how important it is to work with the team doing the print job to see what tools are a must-have and what the processes must be to be efficient. So very often the needs of the job will collide with the needs of the security in unexpected ways that lead to security being short circuited as people work around the security to get things done.

Answer 4

One risk not addressed previously is electronic eavesdropping from outside the room. If the room has a window, then someone in the parking lot could easily listen into what is being discussed. Further computers radiate RF energy that is susceptible to interception from outside the room.

To be truly secure the room should be both acoustically shielded as well as RF shielded with a Farady cage. For a discussion of how information can be gathered from unintentional signals being radiated from computers see TEMPEST.

TEMPEST is a codename referring to investigations and studies of compromising emission (CE) (see Van Eck phreaking). Compromising emanations are defined as unintentional intelligence-bearing signals which, if intercepted and analyzed, may disclose the information transmitted, received, handled, or otherwise processed by any information-processing equipment. TEMPEST is a codename only and is not an acronym.

Compromising emanations consist of electrical, mechanical, or acoustical energy intentionally or by mishap unintentionally emitted by any number of sources within equipment/systems which process national security information. This energy may relate to the original encrypted message, or information being processed, in such a way that it can lead to recovery of the plaintext. Laboratory and field tests have established that such CE can be propagated through space and along nearby conductors. The interception/propagation ranges and analysis of such emanations are affected by a variety of factors, e.g., the functional design of the information processing equipment; system/equipment installation; and, environmental conditions related to physical security and ambient noise. The term "compromising emanations" rather than "radiation" is used because the compromising signals can, and do, exist in several forms such as magnetic- and/or electric field radiation, line conduction, or acoustic emissions.1

The term TEMPEST is often used broadly for the entire field of Emission Security or Emanations Security (EMSEC). The term TEMPEST was coined in the late '60s and early '70s as a codename for the NSA operation to secure electronic communications equipment from potential eavesdroppers2 and vice versa the ability to intercept and interpret those signals from other sources.