161
votes
Roles to play when tailgaiting into a residential building
There are some basic social engineering approaches to use that work in most situations, not just tailgating:
urgency
authority
curiosity
pretexting
Urgency
Be someone with a specific task to ...
- 132k
137
votes
Accepted
Defence methods against tailgating
This is not a problem that has a social solution. No amount of corporate policy will save you. Humans are social animals. In the end, if people can let other people in, they will. Even if you may be ...
- 65.8k
121
votes
Can secret GET requests be brute forced?
You are essentially asking if it is safe to pass secret parameters in a GET request. This is actually classified as a vulnerability. It is not feasible to brute force a sufficiently long pseudorandom ...
- 67.3k
113
votes
Accepted
What is the purpose of the rotating plate in front of the lock?
It's called anti-drill plate.
With the anti-drill rotating plate, the drill bit won't be able to go through the cylinder. It's supposed to be in hardened steel and act as an other layer of security.
...
- 759
83
votes
Roles to play when tailgaiting into a residential building
Just stand outside the door at some distance talking on your phone. Don't look at the door, don't look at the person coming to open it, don't look like you want to get in. Don't ask to be let in. Don'...
- 65.8k
81
votes
Accepted
Why is iPhone's internal storage so hard to crack/decrypt?
I don't think that you interpret the rule you've heard in the right way. If an attacker has physical access to an encrypted but switched off device he cannot simply break the encryption provided that ...
- 208k
71
votes
How to safeguard physical keys stored in a fire dept. lockbox?
To be clear: a Knox Box is a lock box that holds keys for emergency personnel. If the fire department needs to get inside your building while it is locked, the fire crew will have a key to unlock your ...
- 621
63
votes
Defence methods against tailgating
You protect yourself by politely challenging people who are trying to get in without using the controls. You simply ask to see their pass or offer to escort them to reception/security. I use the ...
- 132k
59
votes
Accepted
What are the potential risks of leaving a device in public, but locked?
Everything
I reference the 10 immutable laws of security, especially #3:
If a bad guy has unrestricted physical access to your computer, it’s
not your computer anymore
Of course a computer sitting ...
- 31.7k
47
votes
Accepted
Does the saying "physical access = game over" apply to smartphones, too?
"Physical access = game over" is an over-simplification. It absolutely boils down to the outcome of a threat assessment, or what the vendor needs to protect and to what level. The direct answer to ...
- 3,951
43
votes
Roles to play when tailgaiting into a residential building
The main element, as you've said, is to not look like you're waiting for your mark to arrive. What you need is a prop that gives a visual indication why you're standing outside the door.
Useful props ...
- 939
40
votes
If password expiration is applied, should door-lock expiration be applied too?
You asked, ‘if passwords should expire periodically, then should door locks expire periodically?’. Well, from a false premise you can derive any conclusion! The premise of periodic password ...
- 2,674
39
votes
Defence methods against tailgating
The cheap solution is to put up scary “no tailgating - everyone must badge in at this door - no exceptions - don’t risk your job - report all tailgate requests to Joe at 123-456-7890” signs at each ...
- 34.7k
39
votes
What is the purpose of the rotating plate in front of the lock?
What Deunis said, except it is not only an anti-drill plate. The fact that it rotates freely makes it anti-drill on top.
Originally, these were an upgrade for existing lock cylinders which didn't ...
- 5,231
37
votes
If password expiration is applied, should door-lock expiration be applied too?
Password rotation policies are in place to reduce specific risks which allow an attacker to get (and use) the user’s password. These risks are password reuse, credential phishing or other forms of ...
- 208k
36
votes
Accepted
Stolen MacBook: should I worry about my data?
Your data is probably* safe if the following three criteria are met:
You have FileVault turned on (full disk encryption).
Your laptop requires a password on boot and every time you open the lid (auto ...
- 2,386
34
votes
Can secret GET requests be brute forced?
This is a common approach to share public things restricted to the ones who know the URL. An example is Google Docs:
The second option, "Anyone with the link", creates a link similar to yours. Same ...
- 9,086
28
votes
Defence methods against tailgating
(Just a passer-by opinion)
Obviously, a physical gate would work the best.
In case you don't want to install these, you may try to request all employees to challenge tailgaters, as schroeder ...
- 381
27
votes
Selecting a secure PIN for building access
PINs are usually accompanied by some other authentication factor, like biometrics or a physical token. So, the PIN is not a lone factor in authentication.
But you appear to describe a situation where ...
- 132k
25
votes
Why is iPhone's internal storage so hard to crack/decrypt?
The rule you are referring to goes back to Scott Culp and is from this essay he wrote in 2000:
https://technet.microsoft.com/library/cc722487.aspx
In 2000, there was no such thing as an iPhone. ...
- 10.7k
23
votes
Accepted
What countries are at highest risk of espionage on personal devices?
Assuming you have a basic level of Cyber Security measures e.g. ecrypted hard drives, decent user name and password rules, encrypted VPN tunnels etc. I would say there are a number of issues to ...
- 246
22
votes
Does the saying "physical access = game over" apply to smartphones, too?
As a general concept in information security, physical access is a rather severe attack vector.
Standard x86 PCs and servers are particularly vulnerable because they have little or even no ...
- 3,299
20
votes
Can secret GET requests be brute forced?
Bad idea. A number of times I have seen a "secret" URL very quickly getting search engine crawler hits, and then discoverable by web search. Once I even saw someone set up a copy of a reputable ...
- 588
20
votes
Stolen MacBook: should I worry about my data?
I unlocked a Mac laptop that a friend "found in a bin" without knowing the password and accessed all data on it. After a quick bit of googling I created a new account and reset the existing account ...
- 301
18
votes
Does the saying "physical access = game over" apply to smartphones, too?
TL;DR: the answer is yes, given enough (unrestricted) physical access, skills, motivation, and resources.
Long answer
Those laws are often very general laws that express general concepts in ...
- 15.9k
16
votes
Roles to play when tailgaiting into a residential building
Buy one of these:
Look rushed, and knock on the window/door until someone lets you in. Once inside ask for a random name, and have a screenshot of the doordash app on your phone. (Preferably with ...
- 265
16
votes
Accepted
Selecting a secure PIN for building access
You're setting yourself up for an endless game of whack-a-mole. You listed a few ... No matter how many you think of, lazy users will come up with more guessable PINs. It's a church, so think of any ...
- 484
14
votes
Defence methods against tailgating
As a receptionist, I am trained to vet everyone who comes into the building. If I do not recognize that person, I immediately ask if they need help with anything, and who they have come to see. If ...
- 141
14
votes
What are the potential risks of leaving a device in public, but locked?
The two answers so far have focused on inserting a USB device in the laptop. I'd be more concerned about inserting a PCI(e), firewire, or similar device with direct bus access into an expansion slot ...
- 21.6k
12
votes
Selecting a secure PIN for building access
There are only 100000 potential values if you have a 5 digit PIN. That means that a single PIN can be brute forced in a relatively small length of time, unless there is some form of secondary ...
- 27.4k
Only top scored, non community-wiki answers of a minimum length are eligible