Lesson 21 Flashcards
Physical Access controls
Physical access controls depend on the same access control fundamentals as network
or operating system security:
• Authentication—create access lists and identification mechanisms to allow
approved persons through the barriers.
• Authorization—create barriers around a resource so that access can be controlled
through defined entry and exit points.
• Accounting—keep a record of when entry/exit points are used and detect security
breaches.
Authentication (physical Access Control)
• Authentication—create access lists and identification mechanisms to allow
approved persons through the barriers.
Authorization (physical Access Control)
• Authorization—create barriers around a resource so that access can be controlled
through defined entry and exit points.
Accounting (physical Access Control)
• Accounting—keep a record of when entry/exit points are used and detect security
breaches.
Site Layout, Fencing, and Lighting
Site layout
•Zone-based design to accommodate traffic flows and surveillance
•Signage
•Industrial camouflage
Barricades and entry/exit points
•Bollards
Fencing
Lighting
•Make staff feel secure
•Assist surveillance
Industrial camouflage
Conversely, entry points to secure zones should be discreet. Do not allow an
intruder the opportunity to inspect security mechanisms protecting such zones (or
even to know where they are). Use industrial camouflage to make buildings and
gateways protecting high-value assets unobtrusive, or create high-visibility decoy
areas to draw out potential threat actors.
fencing
The exterior of a building may be protected by fencing. Security fencing needs to be
transparent (so that guards can see any attempt to penetrate it), robust (so that it is
difficult to cut), and secure against climbing (which is generally achieved by making it tall
and possibly by using razor wire). Fencing is generally effective, but the drawback is that
it gives a building an intimidating appearance. Buildings that are used by companies to
welcome customers or the public may use more discreet security methods.
Lighting
Lighting
•Make staff feel secure
•Assist surveillance
Lock types
Lock types
•Physical (conventional/deadbolt)
•Electronic
•Cipher/combination
•Magnetic swipe card
•Smart card/proximity reader
•Biometric
•Access control vestibules/mantraps and turnstiles
•Cable locksMantraps and turnstiles
Access control vestibule = mantrap
Apart from being vulnerable to lock picking, the main problem with a simple door or
gate as an entry mechanism is that it cannot accurately record who has entered or left
an area. Multiple people may pass through the gateway at the same time; a user may
hold a door open for the next person; an unauthorized user may “tailgate” behind an
authorized user. This risk may be mitigated by installing a turnstile (a type of gateway
that only allows one person through at a time). The other option is to add some sort of
surveillance on the gateway. Where security is critical and cost is no object, an access
control vestibule, or mantrap, could be employed. A mantrap is where one gateway
leads to an enclosed space protected by another barrier.
Cable Locks
Cable locks attach to a secure point on the device chassis. A server chassis might come
with both a metal loop and a Kensington security slot. As well as securing the chassis
to a rack or desk, the position of the secure point prevents the chassis from being
opened, without removing the cable first.
Physical Attacks Against Smart Cards and USB
Smart card attacks
•Cloning
•Skimming
•Card types and vulnerability level
Malicious USB/juice-jacking
•USB data blocker
card cloning
Card cloning—this refers to making one or more copies of an existing card. A
lost or stolen card with no cryptographic protections can be physically duplicated.
Card loss should be reported immediately so that it can be revoked and a new one
issued. If there were a successful attack, it might be indicated by use of a card in a
suspicious location or time of day.
Skimming
Skimming—this refers to using a counterfeit card reader to capture card details,
which are then used to program a duplicate. Some types of proximity card can quite
easily be made to transmit the credential to a portable RFID reader that a threat
actor could conceal on his or her person. Skimmers installed on public readers, such
as ATM machines, can be difficult to spot.
•Card types and vulnerability level
These attacks can generally only target “dumb” smart cards that transfer tokens rather
than perform cryptoprocessing. Bank-issued smart cards, referred to as EMV (Electron,
MasterCard, Visa), can also be vulnerable through the magnetic strip, which is retained
for compatibility.
Malicious USB/juice-jacking
•USB data blocker
Malicious USB charging cables and plugs are also a widespread problem. As with card
skimming, a device may be placed over a public charging port at airports and other
transit locations. A USB data blocker can provide mitigation against these juicejacking
attacks by preventing any sort of data transfer when the smartphone or laptop
is connected to a charge point
Alarm and Sensor Systems
5 main types of alarms
Circuit
•Open or closed
•Detect intrusion through a barrier
Motion detection
•Radar or infrared
•Detect intrusion in a space
Noise detection
Proximity readers
Duress
•Fixed or mobile
Circuit
Circuit
•Open or closed
•Detect intrusion through a barrier
Circuit—a circuit-based alarm sounds when the circuit is opened or closed,
depending on the type of alarm. This could be caused by a door or window opening
or by a fence being cut. A closed-circuit alarm is more secure because an open
circuit alarm can be defeated by cutting the circuit.
Motion detection
Motion detection—a motion-based alarm is linked to a detector triggered by any
movement within an area (defined by the sensitivity and range of the detector), such
as a room. The sensors in these detectors are either microwave radio reflection
(similar to radar) or passive infrared (PIR), which detect moving heat sources.
Noise detection
Noise detection—an alarm triggered by sounds picked up by a microphone. Modern
AI-backed analysis and identification of specific types of sound can render this type
of system much less prone to false positives.
Proximity Readers
Proximity—radio frequency ID (RFID) tags and readers can be used to track the
movement of tagged objects within an area. This can form the basis of an alarm
system to detect whether someone is trying to remove equipment.
Duress
Duress
•Fixed or mobile
Duress—this type of alarm is triggered manually by staff if they come under
threat. There are many ways of implementing this type of alarm, including wireless
pendants, concealed sensors or triggers, and DECT handsets or smartphones. Some
electronic entry locks can also be programmed with a duress code that is different
from the ordinary access code. This will open the gateway but also alert security
personnel that the lock has been operated under duress.
