159

There are some basic social engineering approaches to use that work in most situations, not just tailgating: urgency authority curiosity pretexting Urgency Be someone with a specific task to perform that needs to be done right now. The classics are a delivery person with full arms and someone looking to pick someone else up. A family member needing to ...


137

This is not a problem that has a social solution. No amount of corporate policy will save you. Humans are social animals. In the end, if people can let other people in, they will. Even if you may be very security aware and not let anyone in, 95% of your collegues will act differently. You have to work with human nature, not against it. So if you want to ...


121

You are essentially asking if it is safe to pass secret parameters in a GET request. This is actually classified as a vulnerability. It is not feasible to brute force a sufficiently long pseudorandom string, assuming the server simply returns a static 404 response whenever an invalid path is specified, but there are numerous other security issues in practice ...


116

RAM is used to store sensitive non-persistent information in a lot of cases. Encryption keys would be a common example. Sometimes it is possible to remove RAM and place it into another device to dump the contents - often with the aid of liquid nitrogen. For more information, see the Wikipedia article for Cold Boot Attack.


114

It's called anti-drill plate. With the anti-drill rotating plate, the drill bit won't be able to go through the cylinder. It's supposed to be in hardened steel and act as an other layer of security. When you drill a cylinder lock, you have to go with small drill bit first. You will then use bigger and bigger drill bit on the little hole you made. The plate ...


102

Poor password choices The primary threat that a car lock protects against is theft of the car or of objects inside the car. Most theft is opportunistic, not targeted: go to a parking lot, try multiple cars until you find a poorly protected one. With passwords or PIN, you know that many people are going to pick password or 1234 or for the more paranoid their ...


96

Use a strong and difficult password for the root user. Secondly, always login and work from another user with no administrative rights (and also a strong password). Enable the BIOS password option. Every time you power on your computer, the BIOS itself will ask you for a password before even booting on. It will also prevent everyone from applying changes to ...


92

I hate to be this guy, but Law 3: If a bad guy has unrestricted physical access to your computer, it’s not your computer anymore. You are asking how to best lock a plywood door. People are giving you very good suggestions for locks, but none of them matter since your system is physically vulnerable and your attackers are competent. They will just use ...


84

Because it's easier to get an electronic system wrong, and when you get it wrong it costs you a lot of money and bad PR to fix it: Chrysler recalls 1.4 million cars due to electronic key hacks Land Rover recalls 65,000 cars due to electronic key hacks BMW sends OTA patch for 2.2 million cars affected by electronic key hacks There are a lot of ways to get ...


81

I don't think that you interpret the rule you've heard in the right way. If an attacker has physical access to an encrypted but switched off device he cannot simply break the encryption provided that the encryption was done properly. This is true for an iPhone as much as it is for an fully encrypted notebook or an encrypted Android phone. The situation is ...


78

Just stand outside the door at some distance talking on your phone. Don't look at the door, don't look at the person coming to open it, don't look like you want to get in. Don't ask to be let in. Don't engage in conversation. Just let the person open the door and go through. Then in the last second before it closes and lock, you calmly walk through still ...


74

Could I mitigate that risk by taking a regular usb cable and cutting the data (but not the power) cables? Or does the usb protocol needs a data handshake to begin charging? Such a cable does exist, so a data handshake must not be required. Such cords are discussed on some Stack Exchange sites: Micro USB cables that only charge but no data, no mounting etc ...


72

To be clear: a Knox Box is a lock box that holds keys for emergency personnel. If the fire department needs to get inside your building while it is locked, the fire crew will have a key to unlock your Knox Box and retrieve your building's key. There are a couple of ways to mitigate this risk. The easiest IMO is security cameras that watch your doors. If ...


70

Physical access, in many, likely most, situations means a total loss of security - for a variety of reasons (this all assumes encrypted disks): Theft - An attacker could steal the server or disks, to attack at their pace. This allows an attacker to take their time, and you have no idea if they've actually gained access to data. Physical Modification - If I ...


68

Depending on the performance you require and money you are willing to expend, a removable "Live USB" or completely bootable normal system on a USB "hard drive" (a small ssd would work great) might be an ideal solution considering your "unique" constraints of needing high security against local attackers. It would allow you to just leave the compromised ...


63

You protect yourself by politely challenging people who are trying to get in without using the controls. You simply ask to see their pass or offer to escort them to reception/security. I use the simple phrase, "I'm sorry, I do not know who you are so I cannot just let you in. May I escort you to reception?" If they resist, I monitor them and quietly inform ...


60

Everything I reference the 10 immutable laws of security, especially #3: If a bad guy has unrestricted physical access to your computer, it’s not your computer anymore Of course a computer sitting unattended at a coffee shop for 5 minutes isn't going to be as vulnerable as a computer that spends a year at NSA headquarters, but you would be surprised ...


59

I have exactly the opposite problem. Why do we use these silly password based systems that have major flaws when physical keys have secured everything relatively successfully for centuries? The password based system is horribly flawed. Few people understand how easy it is to guess passwords. Forgetting passwords is incredibly common, far more common than ...


57

There is a Security User Experience (SUX) downside, which you might consider to be minor. As someone who is more kinestheticly inclined, I don't memorize things like phone numbers or PINs: I memorize patterns. If I was forced to use this keypad, I would have to use a compensating method to remember the actual digits (like writing it down). While not ...


51

The problem isn't with this situation in particular. Let's assess the situation here: You're a trustworthy person to them The password is very likely securing trivial data Giving you the password isn't that big of a deal in this case. The problem (like you stated in your question) is that getting him in the habit of giving out passwords. I'd definitely go ...


51

When you read up on the source quoted in the article, you will notice that it apparently isn't talking about a "real" Farraday cage around the Sistine Chapel (putting a whole building under a wiremesh dome would be ridiculous even for the Catholic church) but rather about a figurative one in form of: the installation of equipment which blocks any ...


51

USB devices can negotiate the provided current from the host device. If power negotiation is not possible (because you cut the data wires), a maximum of 100 mA is supplied. This means you can charge devices, but it may be slower than usual. Devices such as LockedUSB do the power negotiation on both sides, while not allowing data to pass between devices. ...


50

In approximate order of increasing complexity (not security, and methods may be combined), here are some ideas that would be easy for anyone used to puzzles/writing code/maths. A more complete idea is below. NB: when I say "secret" I mean not written in the book. These are all easy, and most useful to deter the casual thief. Have a memorised secret ...


41

Although not entirely in line with the OP's question, I wanted to share a different solution. You could take a powerbank with you. Small powerbanks capable of charging your phone at least 1 time don't take up too much space. You can charge the powerbank at the airport terminal, in your hotel, or even on the flight (as there's no risk for malicious data ...


41

The main element, as you've said, is to not look like you're waiting for your mark to arrive. What you need is a prop that gives a visual indication why you're standing outside the door. Useful props (that would explain your presence) would include: Cigarette or e-Cig. Lunch-bag(s). Coffee(s) from a local distributor. Box of doughnuts. Having a bulky item ...


40

You asked, ‘if passwords should expire periodically, then should door locks expire periodically?’. Well, from a false premise you can derive any conclusion! The premise of periodic password expiration is foolish and counterproductive and damages security by imposing pointless administrivia on users for feeble defense against hypothetical attack vectors. ...


39

The cheap solution is to put up scary “no tailgating - everyone must badge in at this door - no exceptions - don’t risk your job - report all tailgate requests to Joe at 123-456-7890” signs at each unattended controlled portal. Make sure there are obvious cameras in the vicinity. If you want people to challenge someone, it’s much easier for them to do so ...


38

What Deunis said, except it is not only an anti-drill plate. The fact that it rotates freely makes it anti-drill on top. Originally, these were an upgrade for existing lock cylinders which didn't have built-in protection against being pulled out, which became a popular method (the most popular?) of breaking in the 80s. Locks at that time didn't have the ...


38

Password rotation policies are in place to reduce specific risks which allow an attacker to get (and use) the user’s password. These risks are password reuse, credential phishing or other forms of social attacks to get the password, compromise of a server and thus access to the hashed passwords or brute forcing. None of these risks really apply for physical ...


35

Your data is probably* safe if the following three criteria are met: You have FileVault turned on (full disk encryption). Your laptop requires a password on boot and every time you open the lid (auto screen lock). Your password is not well known (easy to guess). TL;DR; If you don't have FileVault turned on, then your data is in plaintext and anyone can ...


Only top voted, non community-wiki answers of a minimum length are eligible