Questions tagged [physical]
The use of physical measures (such as locks and tamper-proofing) or policies (such as Clean Desk) in order to protect sensitive information from unauthorized access.
399
questions
36
votes
7
answers
9k
views
Is it possible to improve brute-force guessing of a password with a picture of the keyboard used to enter it?
Is it a bad idea to post a photo of your keyboard to social media?
Can I look at a photo of a keyboard and determine the password of an account?
Assuming a certain (set of) password(s) is the most ...
- 515
3
votes
4
answers
338
views
Are there any quick-erase devices with a small memory available for storing key information?
I would like to set up my computer's full disk encryption to unlock with a key file (preferably one that uses the SD card interface, but I'm not particularly picky) because it's annoying to enter in ...
- 198
6
votes
3
answers
5k
views
Do you have to ban cellphones and paper to be PCI compliant?
Today I heard of a call centre that you are not allowed to bring cellphones into or take paper out of. This is allegedly to be PCI complaint. Is this true? What is the reasoning? This seems like ...
- 10.1k
24
votes
6
answers
27k
views
Does multiple numbers per button have an effect on security?
I recently came across an electronic deadbolt like this:
The keys have multiple numbers per button, 1|2, 3|4, 5|6, 7|8, 9|0
Is there any way that this increases the security of the electronic lock? ...
- 1,795
23
votes
4
answers
4k
views
What are the alternatives to door passcodes?
Passwords have been a problem since the dawn of computing. They tend
to be either so complex that no one can remember them, or so obvious
that anyone could guess them.
...
Some users ...
- 1,742
6
votes
1
answer
587
views
What is the current state of RFID / NFC security?
I'm attempting to do some RFID and NFC cloning and replaying research, as I'm hoping to be able to demo physical security as an attack vector to a few of out clients and prospects.
The downside (...
- 759
4
votes
2
answers
7k
views
Wiping magnetic stripe on card with magnet?
I asked a question a while back on using magnets (for example powerful Neodymium ones) to wipe a HDD, and got shown a good article proving it is not possible to wipe data.
Pretend I am about to ...
- 1,272
12
votes
2
answers
22k
views
Can motion sensors be disabled by lasers without triggering the alarm?
I remember when I was a kid and was waiting for someone in a long hall, there was a motion sensor and security panel by the door. To kill time, I would go away from the door, then try to move so ...
- 1,246
0
votes
1
answer
101
views
Why don't terminal IDs prevent unauthorized entery?
I'm studying for CISSP and had gotten this question wrong. I also found it and the correct answer online, but still don't understand the reasoning.
Source
Which of the following controls is not ...
- 10.1k
18
votes
6
answers
4k
views
Mitigating forensic memory acquisition when an attacker has physical access to a workstation
My question regards whether or not the mitigations I use are appropriate for my threat model. Please don't jump to conclusions and say "you need to use locks" or "you can't leave your computer ...
- 66.5k
14
votes
2
answers
13k
views
Attacks via physical access to USB (DMA...?)
I wonder if USB can be exploited by someone with physical access to a reasonably secured computer. For example a kiosk, or a laptop attached to a desk.
Obviously, the boot sequence should be secure (...
- 311
-3
votes
3
answers
352
views
Is there a way to secure a Linux machine in a way that no one else (but me) can access its contents? [closed]
And I mean, even if someone tries rooting with a Live CD, even if one takes the HDD away and plug it in somewhere else, etc...
I want to be able to give a client a machine with a service running, but ...
- 178
1
vote
1
answer
173
views
Location/proximity based decryption using separate machine
I read a long thread where the whole issue was revolving around deriving decryption keys from GPS location. This has huge issues, as being present at a location is not needed to know the location. ...
- 332
-12
votes
1
answer
1k
views
How to protect my laptop screen from being hacked? [closed]
My laptop screen has been hacked, and I think that it is by Van Eck phreaking method. The attackers can see my screen, they are seeing my screen right now. I never even talk to them and these ...
- 1
2
votes
1
answer
184
views
Information Security on a lost android phone
Recently, my android mobile phone was lost/stolen. I had logged into several applications such as Facebook, Paytm, etc. Thus, there are chances that my personal/ transaction details might be leaked.
...
- 121
8
votes
1
answer
4k
views
What is collusion and how does seperation of duties prevent it, or fail to prevent it?
I'm studying for CISSP and came across the term "collusion". I understand it means when people work together to steal something, but don't quite get it. For example, if two gunmen rob a bank would ...
- 10.1k
5
votes
5
answers
6k
views
How should I store a physical written copy of my password? [duplicate]
I can employ all the fancy encryption and the randomest of passwords to my hard drive, but it won't do me any good if I don't remember how to log in. It seems sensible to write down my password, then....
- 523
0
votes
1
answer
215
views
Securing a public computer meant for banking
I sometimes visit my bank personally to handle certain formalities. Inside there is a booth containing a computer and all equipment necessary to log in to the online banking service. The computer is ...
- 103
8
votes
4
answers
1k
views
Must a system be insecure against physical access? If so, why?
Inspired by: Why don't OSes protect against untrusted USB keyboards?
Related: What can a hacker do when he has physical access to a system? (I address the points of its main answers below.)
There ...
- 2,937
109
votes
8
answers
20k
views
My school wants to keep the details of our door authentication system a secret. Is that a good idea?
So, I am designing a door authentication system (can't really go into more detail) for our school, so that only authenticated persons can go through a certain internal door. They hold that its inner ...
- 2,937
84
votes
14
answers
12k
views
How can I protect myself from false accusations when our company practices password escrow?
During an internship for a small company, my boss created an account for me, so I generated a password and I used it. The next day, my boss told me to write down the password of my account on a piece ...
- 854
5
votes
2
answers
6k
views
Motion sensor door locks
I have seen several offices with electric locks for entry that have a sensor for exit. I assume it's some kind of motion or object detection sensor.
This is odd because in many cases, there's a seam ...
- 2,605
2
votes
1
answer
137
views
Loss of physical locks/password to safes
Safes can keep important information like part of a dual control password, smartcards and pendrives, and so on.
What would be the best practices to prevent loss or damage to a physical locks to a ...
- 51
2
votes
2
answers
345
views
Are passport stamps a reliable security feature? [closed]
Most countries in the world still place passport stamps on arrival/departure into the country. Theoretically it is then possibly to calculate the length of a person's stay in a specific country.
Is ...
- 1,034
1
vote
0
answers
248
views
What else can I do to protect my accounts? [closed]
I am trying to make sure all my accounts are secure from unauthorised access and have turned on all security measures that I can find to make sure my stuff is protected.
Here is what I have in place:
...
- 1,187
-3
votes
2
answers
469
views
Defense in depth
How is defense in depth strategy different from network security policy? What is the need to name it a "Defense In Depth", although you may simply name it "Network security policy"?
Secondly if DID ...
7
votes
2
answers
2k
views
Shutdown if case opened
Assume the user has a full disk encrypted HDD in which their OS and files reside. They also have made attaching USB or any other device without first allowing it cause an automatic shutdown which ...
- 101
2
votes
0
answers
77
views
Reasonable means of security in commercial dealings [closed]
I am writing a paper from a legal standpoint and I'm suggesting legislation for a new duty of care for private companies in the safeguarding of customer's personal information. This will not apply to ...
- 21
55
votes
9
answers
7k
views
Why would security cover things like natural disasters?
I'm taking a course which is designed with the CISSP certification in mind. Though the class is categorized as software engineering, we talked a lot about physical security and, in particular, floods, ...
- 10.1k
2
votes
2
answers
735
views
What is the security of random code for authenticating products?
I have seen a startup (Verify Kero) that is building a product for verifying consumer goods. It places a 16 digit secret code under scratch-able coating. Consumer finds the code behind coating and ...
- 526
24
votes
2
answers
5k
views
Why did the Papal conclave use a Faraday cage in 2013 when selecting the new pope?
The Wikipedia article about Faraday cages has this anecdote:
A Faraday cage was used in 2013 by the Vatican to shield the Sistine
Chapel from electronic eavesdropping during the secret papal ...
- 383
42
votes
9
answers
8k
views
Is physical security less important with disks on a server being encrypted?
If you could get physical access to a server, you could change the root/admin password even if you did not know the current password.
However with encrypted disks, I don't think this is possible (...
- 2,022
42
votes
4
answers
4k
views
Evaluating the security of home security cameras
My parents have a vacation home out in the country and are looking to setup a home surveillance system for remote viewing. I've heard that there can be serious vulnerabilities in these products. What ...
- 918
1
vote
1
answer
1k
views
SSH Key vs Complex Password with Fail2Ban & Two Factor Authentication
Normally you hear that using an SSH Key is far more secure than using a regular password. However I've been wondering if this statement is really true.
Let's say we have the following variables for ...
user94758
7
votes
0
answers
667
views
Ethical Hacking Certification (CEH v9) From A Web Developer's Perspective [closed]
I just finished a week of training for the CEH v9 certification. I have two questions:
What are some strategies I can take for studying for the CEH v9 certification coming at the test as a web ...
- 171
9
votes
3
answers
3k
views
Is it possible to determine if the BIOS has been modified between two points in time?
Is it possible to determine if the BIOS of a computer has been modified between two points in time from that computer while it's running ?
Effectively I'd like to be able to gather the equivalent of ...
- 14.2k
0
votes
2
answers
110
views
Sophos Safeguard detecting content of zip files being uploaded
Is it possible to use Sophos safeguard to detect when computers in the network upload certain files online when they are compressed in a zip file? (or 7z or similar).
I've seen it is possible with ...
- 103
38
votes
5
answers
5k
views
Risk of tampering when hardware shipment is delayed
I am currently receiving an order of computer parts in the mail including an SSD. Tracking showed that the package arrived in my town on day X, and was originally scheduled for delivery on day X as ...
- 705
4
votes
2
answers
245
views
Can single-purpose PCs be useful as a security measure in this situation?
In the context of a small scale operation, we are considering use of single special purpose PCs allocated to single security-sensitive tasks - for example, certain financial operations.
The intended ...
- 239
4
votes
2
answers
371
views
Why fear hardware brought to China, when most of it comes from China?
A lot of people will bring disposable hardware (laptops, phones) to business trips to China, eg. Employee laptops in China.
Considering that most of that hardware was manufactured there, what is the ...
- 202
147
votes
8
answers
16k
views
How should I set up emergency access to business-critical secrets in case I am "hit by a bus"?
I work as the primary developer and IT administrator for a small business. I want to ensure that business can continue even if I suddenly become unavailable for some reason. Much of what I do requires ...
- 1,489
2
votes
1
answer
777
views
CISSP Cert: can an IT sales pro pursue CISSP? [closed]
I am a sales and product professional who has a total of 9 years experience in IT; related to selling products indirectly or directly. I started my career working as a product manager for hardware ...
- 21
2
votes
1
answer
263
views
Apple's Keychain - good security?
This management system runs under a user's password. Should you let this software manage your Disk Utility encrypted folder passwords and the like (e.g. GnuPG!)? My thoughts are, "No." ...
user87589
5
votes
1
answer
291
views
Is the content of my RAM kept if the OS is shut down but the PC is still running?
I just asked myself if the content of my RAM is kept when I shut down the OS but the PC is still running. For example when I do apply updates they sometimes require a reboot. Is the informaiton that ...
- 4,313
2
votes
1
answer
155
views
Cell number and IMEI details
Is there a device I can install to collect cell number and IMEI numbers for people within a vicinity?
We want to install in an area for security reasons so that we are able to trace the people in the ...
- 21
3
votes
4
answers
177
views
Thumbdrive and its obsolescence?
Using USB drives in the corporate environment is always the topic of security because viruses and malware can be introduced maliciously or unintentionally. For corporate environment, I am thinking to ...
- 1,951
8
votes
1
answer
1k
views
Is there a way to physically trace stolen hardware?
This must have been asked before, but I cannot find any related question.
Is it possible to put into hardware, some kind of "transmitter", so that in the event of it getting stolen, it can be ...
- 221
36
votes
14
answers
8k
views
Laptop Anti-Theft Measures
A law firm I've been in contact with has recently been broken into 3 times in the past 4 months. In spite of a number of laptops and other equipment containing sensitive information being stolen, the ...
- 477
3
votes
0
answers
231
views
I want to lock my Macbook lid shut. Where to buy? Alternatives? [closed]
I'm attempting to lock down a computer from unauthorized access. I own a macbook pro late 2011.
Backstory
I've gone through the basics with file vault and firmware password etc. I'm also getting a ...
- 31
13
votes
2
answers
2k
views
What does banking etc. server room protection look like? What happens if it fails?
Given that information security is derived from physical security, as evidenced by this theft, I'm curious as to what protection surrounds my bank account?
There are two main avenues I'm interested ...
- 257