Physical Security
Learning outcomes:
- Explain why physical access is dangerous, and why physical security is often overlooked
- Identify physical threats to systems, such as servers, cables, backups, and peripheral devices
- Describe ways to protect systems, such as secure boot, signed updates, and allowlisting
- Describe security risks from Internet of Things (IoT) devices at home and at work
Would you like to download my PowerPoint to follow along?
- What is physical security, and why is it important?
- An overlooked problem
- What physical access means
- Why it's dangerous: if someone can touch it, they can usually get into it
- Things that are overlooked
- Servers
- Network cables, for example a LAN tap
- Data storage
- Backups
- Physical security
- Legality
- Lock sport in the security community
- Lock sport demo and activity
- Protecting systems
- Operating systems
- Fake updates that trick users, and watering hole attacks
- Secure boot and locking the BIOS
- Remote and forced updates
- Getting users to update
- Applications
- Flash, retired in 2020, a classic example of a risky plugin
- Who to trust, and websites that want your trust
- Signed updates
- Allowlisting and denylisting
- Allowlists
- Denylists
- You'll still see whitelist and blacklist in older tools, documentation, and job postings. The industry is moving away from those terms because they tie white to good and black to bad, and the new terms say what the list does.
- Example: Chromebooks
- Example: corporate mobile devices
- Peripheral threats
- Printers, routers, copiers, and fax machines
- USB devices
- Phones and tablets
- What happens to them after use?
- IoT: a new threat
- Smart home devices
- Business issues, for example vending machines on Wi-Fi
Suggested Activities and Discussion Topics:
- Activity: walk around a building you use often. List 3 physical security weaknesses you notice, without testing them.
- Discussion: what should happen to a company printer or copier when it's replaced? Why?
- Discussion: is lock sport ethical? Where is the line?
- Follow the instructions on this PDF (accessible HTML version)
Would you like to see some more classes? View all classes