xid-37552792_2.pdf - COS30015 and COS80013Security Aug-17...

COS30015 and COS80013Security Aug-17
1
COS80013 Internet Security
COS30015 IT SECURITY
Week 2
Physical Security
Slide 2

COS30015 and COS80013Security Aug-17
2
Slide 3
Research material
• Textbooks:
– Goodrich Chapter 2
• Netcasts:
– Security Now 211, 213, 137, 90, 94, 291
– Risky Business 240, 163. 159, 129, 73, 70, 52,
51
IT and Internet Security © J Hamlyn-Harris,
Faculty of SET, Swinburne
Slide 4
Locks
• Pin tumbler locks (easy to pick)
• Radial locks (computers)
• Wafer locks (medium security)
• Combination locks (low security)
• Electronic locks
– mag stripe, RFID, keypad, biometric
– easy to change combination
– easy to monitor
IT and Internet Security © J Hamlyn-Harris,
Faculty of SET, Swinburne

COS30015 and COS80013Security Aug-17
3
Slide 5
Access control
• Locks require Access Control Policies
– who has which key
– how are keys issued, returned, disabled
– what happens when someone leaves
– lost/stolen keys
– master keys
IT and Internet Security © J Hamlyn-Harris,
Faculty of SET, Swinburne
Slide 6
Lock picking
• Locks are a deterrent
– Not a security control
• Picks – easy to make
• Pick-guns
• Bump-keys
• Raking
• Drilling out the tumbler
• Impressioning
• Brute force
IT and Internet Security © J Hamlyn-Harris,
Faculty of SET, Swinburne

COS30015 and COS80013Security Aug-17
4
Picking techniques
• Tradition picking
• Raking
• Bump Key
• Pick gun
Defences:
IT and Internet Security © J Hamlyn-Harris,
Faculty of SET, Swinburne
Slide 7
Slide 8
Side channel attacks
• Remove the hinges
• Cut through the door
• Enter through the roof (tiles, vents, manhole)
• Enter through emergency exits, windows
• Social engineering
– deliveries
– tail-gating
– Ask nicely!
IT and Internet Security © J Hamlyn-Harris,
Faculty of SET, Swinburne

COS30015 and COS80013Security Aug-17
5
IT and Internet Security © J Hamlyn-Harris,
Faculty of SET, Swinburne
Slide 9
More Access Controls
• Barcodes
• Mag stripe
• Smart cards
• -
hacking-how-easy-is-it-6130
• SIM cards
• RFID
– Key fobs (hopping codes)
– Passports
Slide 10
Biometrics
• Measures a human characteristic and compares
features of it to those stored in a database.
• Requires:
– Universal – everyome must have the characteristic.
– Distinctive – characteristic must be different for everyone
– Permanent – characteristic must not change with time
– Collectable – must be possible to collect featues of
characteristic easily.
– Low False-positive /false-negative rate
– Hard to forge
IT and Internet Security © J Hamlyn-Harris,
Faculty of SET, Swinburne

COS30015 and COS80013Security Aug-17
6
Slide 11
Biometrics
• Signature
• Face, fingerprint, retina, iris
• Vein scanners, handprints
• Voice, odour, gait
• All are problematic. Fingerprint probably the best.