Skip to content

3.md

Latest commit

 

History

History
521 lines (503 loc) · 38.8 KB

3.md

File metadata and controls

521 lines (503 loc) · 38.8 KB
Raw

3.0 Architecture and Design

3.1 Explain use cases and purpose for frameworks, best practices and secure configuration guides.

  • Industry-standard frameworks and reference architectures (James Messer, Jason Dion, Mike Meyers)
    • Regulatory
      • "Industries under governmental regulation frequently have an approved set of architec- tures defined by regulatory bodies." (Conklin)
      • Examples:
        • Sarbanes-Oxley Act (SOX)
        • The Health Insurance Portability and Accountability Act (HIPAA)
        • The Gramm-Leach-Bliley Act of 1999 (GLBA)
    • Non-regulatory
      • Strong suggestesions
      • Maybe have regulation in the works
      • In your best interest
      • Right thing to do
    • National vs. international
    • Industry-specific frameworks
      • Process management: "Getting the IT 'product' to work best with the organization." (Messer)
      • Best practices
      • Examples:
        • Control Objectives for Information and Related Technologies (COBIT).
        • ITIL. Multiple stages of the IT lifecycle.
  • Benchmarks/secure configuration guides (James Messer)
    • Platform/vendor-specific guides
      • Web server
        • Run server from non-privileged account
        • Configure file permissions
        • Prevent data leaks, unauthorized server access
        • Configure SSL certs
        • Monitor access and error logs
      • Operating system
        • Service packs, security packages
        • User account passwords, account limitations
        • Limit network access
        • Provide ongoing monitoring
      • Application server
        • Disable unnecesary services
        • Install security patches
        • Limit access from other devices
      • Network infrastructure devices
        • Don't use defaults for authentication
        • Security updates
    • General purpose guides
  • Defense-in-depth/layered security (James Messer)
    • Physical controls
      • Locks, fences, cameras
        • "Fencing acts as the first line of defense against casual trespassers and potential intruders." (uCertify)
      • Card/badge access
      • Security guard
    • Vendor diversity
      • "Having multiple suppliers creates vendor diversity, which reduces the risk from any single supplier... Having only a monoculture raises risks when something specific to that environment fails." (Conklin)
    • Control diversity
      • Administrative
        • Policies and procedures
        • Onboarding and offboarding
      • Technical
        • Hardware and software
        • Firewalls, active directory authentication, disk encryption
        • DMZ
        • Hashing and salting passwords
        • Intrusion prevention system
        • VPN access
        • Anti-virus, anti-malware software
    • User training
      • "The best defense is to implement a strong user training program that instructs users to recognize safe and unsafe computing behaviors. The best form of user training has proven to be user-specific training, training that is related to the tasks that individuals use computers to accomplish." (Conklin)

3.2 Given a scenario, implement secure network architecture concepts. (Mike Meyers)

  • Zones/topologies (James Messer, Mike Meyers)
    • DMZ
      • "An additional layer of security between the Internet and you." (Messer)
    • Extranet
      • Private DMZ
      • "A private network for partners." (Messer)
    • Intranet
      • Private. Only available internally.
      • Company business, documents, announcements. (Messer)
      • No external access. Accessible internally or via VPN.
    • Wireless
      • 802.1X standard for connection.
        • Use normal network login credentials.
        • No shared passphrase.
    • Guest
      • Meetings, demonstrations.
      • Internet access only.
      • Integrate with "captive portal"
        • Require username/password
        • Avoid unauthorized use
    • Ad hoc
      • Wireless without an access point
      • Point to point communication
      • e.g. AirDrop
      • Difficult to manage
      • MDM can allow, disallow, set parameters
    • Honeynets, honeypots
      • Attract hackers, bots
      • Recon, intel on attempted intruders
      • Honeypot: single-use/single-system
      • Honeynet: group of honeypots
    • Network Address Translation (NAT)
      • IPv4 support being exhausted
      • Not a security mechanism
      • Unprotected NAT can be circumvented
      • Combined with statement firewall for security
  • Segregation/segmentation/isolation (James Messer)
    • Useful for speed, security, and compliance
    • Physical
    • Logical (VLAN)
      • Separated logically instead of physically
      • "Cannot communicate between VLANs without Layer 3 device / router." (Messer)
    • Virtualization
      • Instant and complete control
      • Build new network programmatically
      • Route between IP subnets
    • Air gaps
      • "Air gaps is the term used to describe when no data path exists between two networks that are not connected in any way except via a physical air gap between them." (Conklin)
  • Tunneling/VPN (James Messer, Mike Meyers)
    • Site-to-site
      • "Site-to-site communication links are network connections that connect two or more networks across an intermediary network layer." (Conklin)
    • Remote access
      • "Remote access via a tunnel or VPN has the same effect as directly connecting the remote system to the network—it’s as if the remote user just plugged a network cable directly into her machine." (Conklin)
  • Security device/technology placement (James Messer)
    • Sensors
      • "Sensors are devices that capture data and act upon it... They can report on what they observe, they can use multiple readings to match a pattern and create an event, and they can act based on proscribed rules." (Conklin)
    • Collectors
      • "Collectors are sensors, or concentrators that combine multiple sensors that collect data for processing by other systems." (Conklin)
    • Correlation engines
      • "Correlation engines take sets of data and match the patterns against known patterns." (Conklin)
    • Filters
      • "Packet filters process packets at a network interface based on source and destination addresses, ports, or protocols, and either allow passage or block them based on a set of rules." (Conklin)
    • Proxies
      • "Proxies are servers that act as a go-between between clients and other systems; in essence, they are designed to act on the clients’ behalf." (Conklin)
    • Firewalls
      • "Firewalls at their base level are policy enforcement engines that determine whether traffic can pass or not based on a set of rules." (Conklin)
    • VPN concentrators
      • "A VPN concentrator takes multiple individual VPN connections and terminates them into a single network point." (Conklin)
    • SSL accelerators
      • "An SSL accelerator is used to provide SSL/TLS encryption/decryption at scale, removing the load from web servers." (Conklin)
    • Load balancers
      • "Load balancers take incoming traffic from one network location and distribute it across multiple network operations." (Conklin)
    • DDoS mitigator
      • "DDoS mitigators by nature must exist outside the area that they are protecting. They act as an umbrella, shielding away the unwanted DDoS packets." (Conklin)
    • Aggregation switches
      • "An aggregation switch is a switch that provides connectivity for several other switches. Think of it as a one-to-many type of device. It’s the one switch that many other switches connect to." (Conklin)
    • Taps and port mirror
      • "Most enterprise switches have the ability to copy the activity of one or more ports through a Switch Port Analyzer (SPAN) port, also known as a port mirror. This traffic can then be sent to a device for analysis." (Conklin)
      • "A Test Access Point (TAP) is a passive signal-copying mechanism installed between two points on the network. The TAP can copy all packets it receives, rebuilding a copy of all messages. TAPs provide the one distinct advantage of not being overwhelmed by traffic levels, at least not in the process of data collection." (Conklin)
  • SDN (James Messer)
    • "Software-defined networking (SDN)... enables network engineers to reconfigure the network by making changes via a software program, without the need for re-cabling. SDN allows for network function deployment via software." (Conklin)

3.3 Given a scenario, implement secure systems design. (Mike Meyers 1, Mike Meyers 2)

  • Hardware/firmware security (James Messer)
    • FDE/SED (Mike Meyers)
      • "Full disk encryption (FDE) and self-encrypting disks (SEDs) are methods of implement- ing cryptographic protection on hard disk drives and other similar storage media with the express purpose of protecting the data even if the disk drive is removed from the machine." (Conklin)
    • TPM
      • "The Trusted Platform Module (TPM) is a hardware solution on the motherboard, one that assists with key generation and storage as well as random number generation. When the encryption keys are stored in the TPM, they are not accessible via normal software channels and are physically separated from the hard drive or other encrypted data locations." (Conklin)
    • HSM
      • "A hardware security module (HSM) is a device used to manage or store encryption keys. It can also assist in cryptographic operations such as encryption, hashing, or the application of digital signatures. HSMs typically are peripheral devices..." (Conklin)
    • UEFI/BIOS
      • "Unified Extensible Firmware Interface (UEFI) is the current replacement for BIOS. UEFI offers significant modernization over the decades-old BIOS, including the capability to deal with modern peripherals such as high-capacity storage and high-bandwidth communications." (Conklin)
    • Secure boot and attestation
      • "Secure Boot is a mode that, when enabled, only allows signed drivers and OS loaders to be invoked." (Conklin)
      • "Secure Boot enables the attestation that the drivers and OS loaders being used have not changed since they were approved for use." (Conklin)
    • Supply chain
      • "In today’s world of global manufacturing with global outsourcing, attempting to identify all the suppliers in a hardware manufacturer’s supply chain, which commonly changes from device to device, and even between lots, is practically futile in most cases." (Conklin)
    • Hardware root of trust
      • "A hardware root of trust is a concept that if one has a trusted source of specific secu- rity functions, this layer can be used to promote security to higher layers of a system... Examples of roots of trust include TPM chips in computers and Apple’s Secure Enclave coprocessor in its iPhones and iPads." (Conklin)
    • EMI/EMP
      • "Electromagnetic interference (EMI) is an electrical disturbance that affects an electrical circuit. EMI is due to either electromagnetic induction or radiation emitted from an external source..." (Conklin)
      • "An electromagnetic pulse (EMP) is a burst of current in an electronic device as a result of a current pulse from electromagnetic radiation." (Conklin)
  • Operating systems (James Messer, Mike Meyers)
    • Types
      • Network
      • Server
      • Workstation
      • Appliance
      • Kiosk
      • Mobile OS
    • Patch management
      • Hotfix: "small software update designed to address a specific problem, such as a buffer overflow in an application that exposes the system to attacks." (Conklin)
      • Patch: "more formal, larger software update that can address several or many software problems." (Conklin)
      • Service pack: "large collection of patches and hotfixes rolled into a single, rather large package." (Conklin)
    • Disabling unnecessary ports and services
    • Least functionality
      • "A system should do what it is supposed to do, and only what it is supposed to do." (Conklin)
    • Secure configurations
      • "Having systems properly configured prior to use can limit the number of user caused incidents." (Conklin)
    • Trusted operating system
      • "A trusted operating system is one that is designed to allow multilevel security in its opera- tion. This is further defined by its ability to meet a series of criteria required by the U.S. government." (Conklin)
    • Application whitelisting/blacklisting
      • "Application blacklisting is essentially noting which applications should not be allowed to run on the machine... Application whitelisting is the exact opposite: it consists of a list of allowed applica- tions." (Conklin)
    • Disable default accounts/passwords
  • Peripherals (James Messer, Mike Meyers)
    • Wireless keyboards
    • Wireless mice
    • Displays
    • WiFi-enabled MicroSD cards
    • Printers/MFDs
    • External storage devices
    • Digital cameras

3.4 Explain the importance of secure staging deployment concepts. (James Messer)

  • Sandboxing
    • "Sandboxing refers to the quarantine or isolation of a system from its surroundings... Virtualization can be used as a form of sandboxing with respect to an entire system." (Conklin)
  • Environment
    • Development
    • Test
    • Staging
      • "The primary purpose of staging is to serve as a sandbox after testing, so the test sys- tem can test the next set, while the current set is deployed across the enterprise." (Conklin)
    • Production
  • Secure baseline
    • "This process of establishing software’s base security state is called baselining, and the resulting product is a secure baseline that allows the software to run safely and securely." (Conklin)
  • Integrity measurement
    • "Integrity measurement is the measuring and identification of changes to a specific system away from an expected value." (Conklin)
  • Operate and Maintain phase (uCertify):
    • Ensure that all baselines are met.
    • Complete internal and external audits.
    • Complete tasks outlined in the blueprints.
    • Manage service level agreements as outlined in the blueprints.
    • Completing audits is not part of any of the other phases.

3.5 Explain the security implications of embedded systems. (James Messer)

  • SCADA/ICS
    • "SCADA is an acronym for supervisory control and data acquisition, a system designed to control automated systems in cyber-physical environments." (Conklin)
    • "A SCADA system is also known by names such as distributed control system (DCS) and industrial control system (ICS), the variations depending on the industry and the configuration. Where computers control a physical process directly, a SCADA system likely is involved." (Conklin)
  • Smart devices/IoT
    • Wearable technology
    • Home automation
  • HVAC: heating, ventilation, and air conditioning
  • SoC
    • "System on a chip (SoC) refers to a complete computer system miniaturized on a single integrated circuit, designed to provide the full functionality of a computing platform on a single chip." (Conklin)
  • RTOS
    • "Real-time operating systems (RTOSs) are designed for systems where the processing must occur in real time and data cannot be queued or buffered for any significant length of time." (Conklin)
  • Printers/MFDs
    • "Printers and multifunction devices (MFDs), which combine a printer, scanner, and fax, have embedded compute power to act as a print server, manage the actual printing or scanning process, and allow complete network connectivity." (Conklin)
  • Camera systems
  • Special purpose
    • Medical devices
    • Vehicles
    • Aircraft/UAV

3.6 Summarize secure application development and deployment concepts. (Jason Dion)

  • Development life-cycle models (James Messer, Mike Meyers)
    • Waterfall vs. Agile
      • Waterfall: "This is a linear, sequential process, and the model discourages backing up and repeating earlier stages." (Conklin)
      • "Agile methods rely on quick turns involving small increases in functionality." (Conklin)
  • Secure DevOps (James Messer)
    • Security automation
      • "Automating routine and extensive security processes allows fewer resources to cover more environment in a more effective and efficient manner." (Conklin)
    • Continuous integration
      • "Continuous integration is the DevOps manner of continually updating and improving the production code base." (Conklin)
    • Baselining
      • "Baselining is the process of determining a standard set of functionality and performance. This is a metrics-driven process, where later changes can be compared to the baseline to gauge their impact on performance and other variables." (Conklin)
    • Immutable systems
      • "An immutable system is a system that, once deployed, is never modified, patched, or upgraded. If a patch or update is required, the system is merely replaced with a new system that is patched and updated." (Conklin)
    • Infrastructure as code
      • "Infrastructure as code is the use of code to build systems, rather than manually configur- ing them via normal configuration mechanisms. It is a way of using automation to build out systems, reproducible, efficient and is a key attribute of enabling best practices in DevOps." (Conklin)
  • Version control and change management (James Messer)
  • Provisioning and deprovisioning (James Messer)
    • "Provisioning is the process of assigning to users permissions or authorities to access objects. Users can be provisioned into groups, enabling them to be managed as a group rather than individually." (Conklin)
    • "Deprovision- ing is the removal of permissions or authorities. In secure coding, the practice is to provision a thread to an elevated execution permission level (e.g., root) only during the time that the administrative permissions are needed." (Conklin)
  • Secure coding techniques (James Messer, Mike Meyers)
    • Proper error handling
      • "During an exception, it is common practice to record/report the condition, including supporting information such as the data that resulted in the error... The worst case is when it is echoed to the user." (Conklin)
    • Proper input validation
      • "Considering all inputs to be hostile until properly validated can mitigate many attacks based on common vulner- abilities." (Conklin)
    • Normalization
      • "The step of creating the canonical form, or simplest form, of a string before processing." (Conklin)
    • Stored procedures
      • "Precompiled methods implemented within a database engine. Stored procedures act as a secure coding mechanism because they offer an isolation of user input from the actual SQL statements being executed." (Conklin)
    • Code signing
      • "Applying a digital signature to code, providing a mechanism where the end user can verify the code integrity." (Conklin)
    • Encryption
      • "You should not attempt to implement standard algorithms by yourself. Vetted, proven cryptographic libraries exist for all major languages, and the use of these libraries is considered best practice." (Conklin)
    • Obfuscation/camouflage
      • "The hiding of obvious meaning from observation... Adding obfuscation or camouflage to a system to make it harder for an attacker to understand and exploit is a good thing." (Conklin)
    • Code reuse/dead code
      • "For some complex functions, such as cryptography, reuse is the preferred path. In other cases, where the lineage of a component cannot be established, then the risk of use may outweigh the benefit." (Conklin)
      • "Dead code is code that while it may be executed, the results that it produces are never used elsewhere in the program." (Conklin)
    • Server-side vs. client-side execution and validation
      • "Never trust input without validation... The veracity of client-side execution actions cannot be guaranteed. Server-side execution of code can be secured making it the preferred location for sensitive operations such as input validation." (Conklin)
    • Memory management
      • "The actions used to control and coordinate computer memory, assigning memory to variables and reclaiming it when it is no longer being used." (Conklin)
    • Use of third-party libraries and SDKs
      • "Using these proven resources can reduce errors and vulnerabilities in code, making this a positive move for secure development." (Conklin)
    • Data exposure
      • "Data exposure is the loss of control over data from a system during operations... Exposed data can be lost to unauthorized parties (a failure of confidentiality) or, equally dangerous, can be changed by an unauthorized party (a failure of integrity)." (Conklin)
  • Code quality and testing (James Messer, Mike Meyers)
    • Static code analyzers
      • "Static analysis involves examination of the code without execution." (Conklin)
    • Dynamic analysis (e.g., fuzzing)
      • "Dynamic analysis involves the execution of the code as part of the testing." (Conklin)
      • "Fuzzing (or fuzz testing) is a brute force method of addressing input validation issues and vulnerabilities. The basis for fuzzing a program is the application of large numbers of inputs to determine which ones cause faults and which ones might be vulnerable to exploitation." (Conklin)
    • Stress testing
      • "Load testing involves running the system under a controlled speed environment. Stress testing takes the system past this operating point to see how it responds to overload conditions." (Conklin)
    • Sandboxing
      • "The execution of computer code in an environment designed to isolate the code from direct contact with the target system." (Conklin)
    • Model verification
      • "The program results for a given set of inputs need to match the expected results per the system model... Verification is the process of checking that the software developed meets the model specification." (Conklin)
  • Compiled vs. runtime code
    • "Compiled code is code that is written in one language, then run through a compiler and transformed into executable code that can be run on a system." (Conklin)

3.7 Summarize cloud and virtualization concepts. (James Messer, Jason Dion, Mike Meyers)

  • Hypervisor (Jason Dion)
    • "A low-level program that allows multiple operating systems to run concurrently on a single host computer." (Conklin)
    • Type I
      • "Type I hypervisors run directly on the system hardware. They are referred to as a native, bare-metal, or embedded hypervisors in typical vendor literature." (Conklin)
    • Type II
      • "Type II hypervisors run on top of a host operating system." (Conklin)
    • Application cells/containers
      • "A container holds the portions of an OS that it needs separate from the kernel. So, in essence, multiple containers can share an OS, yet have separate memory, CPU, and storage threads, guaranteeing that they will not interact with other containers." (Conklin)
  • VM sprawl avoidance (James Messer)
    • "You can lose track of a VM among many others that have been created... An organization needs to implement VM sprawl avoidance through policy. It can avoid VM sprawl through naming conventions and proper storage architectures, so that the files are in the correct directory, making finding the correct VM easy and efficient." (Conklin)
  • VM escape protection (James Messer)
    • Escape: "Where software, either malware or an attacker, escapes from one VM to the underlying OS." (Conklin)
  • Cloud storage
  • Cloud deployment models (James Messer)
    • SaaS (Mike Meyers)
      • "The offering of software to end users from within the cloud." (Conklin)
    • PaaS (Mike Meyers)
      • "The offering of a computing platform in the cloud. Multiple sets of software working together to provide services, such as database services, can be delivered via the cloud as a platform." (Conklin)
    • IaaS (Mike Meyers)
      • "Rather than building data centers, IaaS allows firms to contract for utility computing as needed." (Conklin)
    • Private
      • "Essentially reserved resources used only for your organization—your own little cloud within the cloud." (Conklin)
    • Public
      • "When the cloud service is rendered over a system that is open for public use." (Conklin)
    • Hybrid
      • "Where elements are combined from private, public, and community cloud structures. When examining a hybrid structure, you need to remain cognizant that, operationally, these differing environments may not actually be joined, but rather used together." (Conklin)
    • Community
      • "Where several organizations with a common interest share a cloud environment for the specific purposes of the shared endeavor." (Conklin)
  • On-premise vs. hosted vs. cloud (James Messer)
    • "On-premise means it is on your site. Hosted means it is somewhere else, a specific location. In the cloud refers to having it distributed across a remotely accessible infrastructure via a network, with specific cloud characteristics—scalability, etc." (Conklin)
  • VDI/VDE (James Messer)
    • "Virtual desktop infrastructure (VDI) and virtual desktop environment (VDE) are terms used to describe the hosting of a desktop environment on a central server. VDI refers to all the components needed to set up the environment. VDE is what the user sees, the actual user environment." (Conklin)
  • Cloud access security broker (James Messer)
    • "Act as security policy enforcement points between cloud service providers and their customers to enact enterprise security policies as the cloud-based resources are utilized." (Conklin)
  • Security as a Service (James Messer)
    • "The outsourcing of security functions to a vendor that can offer advantages in scale, costs, and speed... Different security vendors offer different specializations, from network security, web application security, or e-mail security, to incident response services and even infrastructure updates." (Conklin)

3.8 Explain how resiliency and automation strategies reduce risk. (James Messer, Mike Meyers 1, Mike Meyers 2)

  • Automation/scripting (Mike Meyers)
    • Automated courses of action
      • "A single script that has been tested and approved for use." (Conklin)
    • Continuous monitoring
      • "A system that has monitoring built into it, so rather than monitoring being an external event that may or may not happen, monitoring is an intrinsic aspect of the action." (Conklin)
    • Configuration validation
      • "When you place a system into service, you should validate its configuration against security standards, ensuring that the system will do what it is supposed to do, and only what it is supposed to do, with no added functionality." (Conklin)
  • Templates
    • "Master recipes for the building of objects, be they servers, programs, or even entire systems." (Conklin)
  • Master image
    • "A premade, fully patched image of your organization’s systems." (Conklin)
  • Non-persistence
    • "When a change to a system is not permanent... This is useful for machines deployed in places where users can invoke changes, download stuff from the Internet, and so forth." (Conklin)
    • Snapshots "Instantaneous savepoints in time on virtual machines. These allow you to restore the virtual machine to a previous point in time." (Conklin)
      • "If a system crashed, restoring the snapshot would be the fastest way to restore the system." (uCertify)
    • Revert to known state
      • "The capability to produce a restore point, a copy of key files that change upon updates to the OS." (Conklin)
    • Rollback to known configuration
      • "Another way of saying revert to a known state, but it is also the specific language Microsoft uses with respect to rolling back the registry values to a known good configuration on boot." (Conklin)
    • Live boot media
      • "An optical disc or USB device that contains a complete bootable system." (Conklin)
  • Elasticity
    • "The ability of a system to dynamically increase the workload capacity using additional, added-on-demand hardware resources to scale out." (Conklin)
  • Scalability
    • "Design element that enables a system to accommodate larger workloads by adding resources either making hardware stronger, scale up, or adding additional nodes, scale out." (Conklin)
  • Compared: "Elasticity is related to dynamically scaling a system with workload, scaling out, while scalability is a design element that enables a system both to scale up, to more capable hardware, and to scale out, to more instances." (Conklin)
  • Distributive allocation (James Messer)
    • "Distributive allocation is the transparent allocation of requests across a range of resources. When multiple servers are employed to respond to load, distributive allocation handles the assignment of jobs across the servers... Distributive allocation directly addresses the availability aspect of security on a system." (Conklin)
    • A distributive allocation creates a "technological scavenger hunt."
    • "Makes it more difficult to target and exploit an application instnace." (Messer)
    • Redundancy aides in providing availability.
  • Redundancy (Jason Dion)
    • Power supplies may experience "surges, spikes, sags, brownouts, and blackouts" (Dion)
      • Surge: "An unexpected increase in the amount of voltage provided." (Dion)
      • Spike: "A short transient in voltage that can be due to a short circuit, tripped circuit breaker, power outage, or lightning strike." (Dion)
      • Sag: "An unexpected decrease in the amount of voltage provided." (Dion)
      • Brownout: "Occurs when the voltage drops low enough that it typically causes the lights to dim and can cause a computer to shut off." (Dion)
      • UPS: Uninterruptible Power Supply.
        • Can provide line conditioning.
      • Backup generator
    • Data redundancy (see RAID)
    • Network redundancy
    • Server redundancy
      • Cluster
        • Failover cluster
        • Load-balancing cluster
    • Site redundancy
  • Fault tolerance
  • High availability (HA)
  • RAID (Jason Dion, Mike Meyers)
    • RAID 0: Striping without parity - one logical disk split across multiple physical disks
    • RAID 1: Mirroring - one logical disk duplicated across two disks
    • RAID 5: Striping with parity - uses incremental drive; "Fault taulerant, only requires an additional disk for redundancy"
      • Requires at least three disks
    • Fault resistant: RAID 1 or RAID 5
    • Fault tolerant: RAID 1, RAID 5, RAID 6
    • Disaster tolerant: RAID 10 or 0+1
    • Combined types
    • Stripe of mirrors: 1+0

3.9 Explain the importance of physical security controls. (James Messer, Mike Meyers, Mike Meyers)

  • Lighting
    • Bad actors avoid
    • Better for video recording
  • Signs
    • Warn people away from restricted areas
    • Instructs visitors
    • Fire exits
    • Warn of dangers
    • Informational
  • Fencing/gate/cage
    • Transparent or opaque
    • Difficult to cut
    • Prevent climbing
  • Security guards
    • Physical protection
    • Validates identification of employees
    • Guess access
    • ID badge
  • Alarms
    • Circuit is opened or closed
    • Door, window, fence
    • Motion detection
      • Radio reflection or passive infrared
    • Duress
  • Safe
    • Protect tapes, laptops, drives
    • Difficult to steal
  • Secure cabinets/enclosures
    • Challenge: aircooling
    • Enclosed cabinets with locks
  • Protected distribution/Protected cabling
    • Protected distribution system (PDS)
    • Physically secured cabled network
    • Protect cable and fiber cuts and taps
    • Sealed metal conduit
  • Air gap
    • Physical separation between networks
  • Mantrap
    • All doors normally unlocked
      • Opening one door causses others to lock
    • All doors normally locked
      • Opening one door prevents others from being unlocked
    • One door open / others locked
      • When one is open, the other cannot be unlocked
    • One at a time, controlled groups
      • Managed control through an area
  • Faraday cage
    • Blocks electromagentic fields
      • Microwave oven windows
    • "Known by some as TEMPEST, it is a DoD program designed to block Van Eck emissions. A computer’s monitor or LCD display produces electromagnetic radiation that can be remotely observed with the cor- rect equipment, called Van Eck emissions. TEMPEST was the code word for a National Security Agency (NSA) program to secure equipment from this type of eavesdropping." (Conklin)
  • Lock types
    • Lock and key
    • Deadbolt
    • Electronic locks
    • Token-based
      • Magnetic swipe card or proximity reader
    • Multi-factor
      • Smart card and PIN
  • Biometrics
    • Fingerprint, iris, voiceprint
    • Difficult to change
  • Barricades/bollards
    • Channel people through specific point
    • Allow people, prevent vehicles
  • Tokens/cards
    • Smart card
    • USB tokens
    • SMS code to phone
  • Environmental controls
    • HVAC (Mike Meyers)
    • Hot and cold aisles
    • Fire suppression (Mike Meyers)
      • Water is generally bad
      • Halon: no long manufactured. Destroys ozone.
        • Replaced with Dupont FM-200.
      • Class A
        • Type: Combustibles (wood, paper)
        • Contains: Foam, water
      • Class B
        • Type: Liquids (gasoline, oil)
        • Contains: CO2, foam, powder
      • Class C
        • Type: Electrical (electronic equipment)
        • Contains: CO2
      • Class D
        • Type: Combustible metals (sodium, magnesium)
        • Contains: Powder
        • "Dry powder is a suppression method for a fire that has magnesium, sodium, and potassium as its elements." (uCertify)
      • "Water or soda acid should be used to suppress a fire that has wood products, laminates, and paper as its elements." (uCertify)
  • Cable locks
    • Connect hardware to something solid
    • Most devices have a standard connector. Reinforced notch.
  • Screen filters
    • Privacy filters
  • Cameras
    • CCTV
    • Properties
    • Focal length (shorter is wide angle)
    • Depth of field (how much is in focus)
    • Illumination requirements (see in the dark)
  • Motion detection
  • Logs
  • Infrared detection
  • Key management
    • Manage physical and digital keys
    • Formal process for generation
    • Key breaches
      • Protocol for when key is compromised