CEH Module 21: Physical Security

Ethical Hacking and Countermeasures Version 6

Module XXI Physical Security

Trusted by over 1 million members

Try Scribd FREE for 30 days to access over 125 million titles without ads or interruptions! Start Free Trial Cancel Anytime.



















Real World Scenario , , was asked to do a physical security test by the Chief of a well-known database firm. Their database was . believed their systems were secure, but wanted to be sure of it. c ae wen o e rm on e pre ex o mee ng its Chief. Before entering the lobby, Michael had driven around the building and checked for





















Real World Scenario , , proceeded through the warehouse, to what was an obvious entrance into the office building. Michael . took the elevator down, and entered the room, which was secured with cipher locks and access cards. He we went stra trai ht to the the ta e rack racks. s. There here he studi tudied ed the the racks, as if looking for specific information. He grabbed a tape with an identifier that looked some someth thin in like like ACC ACCT9 T95Q 5QTR TR1. 1.





















News





















Module Objective This module will familiarize you with: Security Statistics Physical security Need Ne ed for for h sica sicall secu securi ritt Factors that affect physical security Physical Security checklist

Wireless Security Laptop Thefts





















Module Flow Security Statistics

Checklist

Mantrap

Physical Security

Locks

Challenges in Ensuring Physical Security

Need For Physical Security

Wireless Security

Spyware Technologies























Security Facts Receive Receive alarm commu communica nications tions - 28% Access control technology technology with with identification identification cards - 90%





















News





















Understanding Physical Since man always had something important to protect, he found various methods of





















Physical Security Physical security describes measures taken to protect personnel, critical asse assets ts and and s stem stemss a ains ainstt deli delibe bera rate te and and acci accide dent ntal al thre threat atss Physical security measures can be:





















What Is the Need for Physical

To prevent any unauthorized access to computer systems























Who Is Accountable for Physical





















Factors Affecting Physical





















Physical Security Checklist





















Physical Security Checklist:





















Gates







































































































































































































































































Authentication Mechanism

Face recognition systems can be tricked by masquerade techniques Signature recognition and hand geometry face the common problem of matching the patterns from a large database which might lead to higher number of false positives and false negatives Retinal scan can hinder accuracy if the user does not focus on a given point for scan. Iris scan machines are very expensive





















Faking Fingerprints

Iden Identi tify fy your targ arget whose fin finger gerprin printt you want ant to fak fake

Glasses, door knobs, and glossy paper can be good sources





















Faking Fingerprints (cont’d)

Photog otogra raph ph the the fing finger erpr prin intt and and scan the the imag imagee

Use a professional image editor to work on the scanned image. You need to get the exact image of the fingerprint to use as mo , rom w c t e ummy s ma e





















Faking Fingerprints (cont’d) a sma rop o g ycer ne o e p n e process o making the dummy. Use a roller for letter press printing

After the glue dries up, it is pulled off the foil, and is cut to finger size

Theatrical glue glue is used to glue the the dummy onto onto your own finger





















Ph sical Securit Checklist























Smart Cards A smart card is a plastic card about the size of a credit card, with an embedded microchip that can be loaded with data





















Security Token

According to the search security definition, “A security token is a small hardware device that the owner carries to





















Computer Equipment Maintenance computer equipment maintenance





















Wiretapping According to www.freesearch.com wiretapping is the ’ conversations by connecting a listening device to their telephone





















Remote Access company Remote access is an easy way for an employee of a firm to work rom any p ace outs e t e company s p ys ca oun ar es























Lapse of Physical Security





















Locks





















Locks (cont’d)





















Lock Picking





















Lock Picking Tools







































































































































































































































































Laptop Security Countermeasures Encrypt sensitive data Back up everything on the laptop race race a sto sto en apt aptop s ocat on Set BIOS password on the laptop Consider laptop PC insurance





















Mantrap Mantrap provides alternate access for resources It consists of two separate doors with an airlock in airlock in between It restricts access to the secure areas It permits users to enter the first door and requires authentication access to exit from the second door





















Mantrap: Diagrammatical Request for access (Normally Open) equ eques or acc access ess Closed)

Request for access (Normally Open)

orma rma y

eque equess or acce access ss (Normally Closed)

Door Closed Switch (Closed = Secure)

Door Closed Switch (Closed = Secure)

Door 1

Door 2

Inputs

Inputs

Door 1

Door 2

Outputs

Outputs





















TEMPEST TEMPEST refers to Transient Electro Magnetic Pulse Emanation Surveillance

Technology for monitoring the devices that emit electromagnetic radiations Sources of TEMPEST • Func Functi tion onal al Sour Source cess signal generators • Inci Incide dent ntal al Sour Source cess • Do not generate generate electrom electromagnet agnetic ic energy energy such such as as elec electr trom omec echa hani nica call swit switch ches es and and bru brush sh-t -t e moto motors rs





















Challenges in Ensuring Physical

Enforcing security policies

Restrictions for sharing experience and knowledge Cost and Time factors Terrorism























Spyware Technologies , , by your employees can defeat your physical security policy





















Spying Devices Spy Glasses

Lock Pick Set





















Spying Devices (cont’d) Hibb Hibben en Claw Claw

Spray to see things





















Spying Devices (cont’d) Voice Recorders

Voice Changer





















Spying Devices (cont’d)























Physical Security: Lock Down





















Tool: DeviceLock





















Blocking the Use of USB Storage





















Track Stick GPS Tracking





















What Happened Next











































































CEH Module 21: Physical Security

Recommend Documents