Social Engineering and Physical Security

1. Social Engineering and Physical Security BAI514 – Security I

2. Social Engineering • Social engineering involves obtaining protected information from individuals by establishing relationships with them and manipulating them • Two types of social engineering • Human-based • Computer-based

3. Social Engineering • Human-Based Social Engineering (Person-to-Person) • Impersonation (masquerading) • Attacker pretends to be someone else • eg. repairman, employee, student, etc. • In Person • Attacker gathers information in person on the premises of the organization • Dumpster diving • Shoulder surfing

4. Social Engineering • Human-Based Social Engineering (cont.) • Important user posing • Attacker pretends to be an individual in a position of authority to intimidate users • Technical support (help desk) • Attacker poses as a technical support person • Authorization by a third party • Attacker convinces an unsuspecting individual that he or she is authorized by a third party in a position of authority

5. Social Engineering • Computer-Based Social Engineering • Mail / IM attachments • When opened install a Trojan • Pop-up windows • Simulate an urgent condition on the users system and instruct the user to perform an action • Spam mail • Initiate fraud by a variety of means • Websites • Fake website appears legitimate but collects user credentials

6. Social Engineering • Reverse Social Engineering • Attacker convinces a target individual that he or she is having a problem or may have one soon and the attacker is ready and willing to help • Uses three steps • Sabotaging the target’s equipment • Ensuring the target is aware that the attacker is a person of authority and has the skills needed to repair the equipment • Providing assistance in solving the problem and, in doing so, gaining the trust of the target and obtaining access or information

7. Social Engineering • Phishing • The process of obtaining sensitive personal data, usually financially related, under false pretenses from unsuspecting individuals for fraudulent purposes • Bank account numbers • PINs • SINs • etc

8. Social Engineering • Phishing (cont.) • Phishing messages and Web hosting can be based on • servers whose organizations tolerate phishing activity • computers that have been compromised • reputable Web hosting providers that are unaware of the content

9. Social Engineering • Phishing (cont.) • A typical phishing attack • Hacker will send a fraudulent email with false headers to indicate the email is from a bank • Message will ask for confirmation of the victim’s account information and password • Message will contain a link to a web server that generates a windows that looks like the bank’s site • User will be prompted to enter userid and password

10. Social Engineering • Hidden Frames • Used to maintain the state of a web site without using cookies to store session variables • Store data until required • Attacker can define two frames • Primary visible frame • Hidden frame containing the running attack

11. Social Engineering • URL Obfuscation • Used to obscure a fake web site’s URL • Representing characters in URL as hex format • Expressing the domain name as decimal IP address in different formats • hex • octal • decimal • dword • Adding irrelevant text after “http://” and before the @ symbol • e.g. http://login.citibank.com/secure_login/login@attacker.com

12. Social Engineering • HTML image mapping • Allows the ability to link different parts of a single image to different hyperlinks (i.e. other websites) • Entire text of email might be represented as an image • no matter where you click, you’re going to the attackers website!

13. Social Engineering • Identity Theft • Stealing another person’s personal information and using that information to assume that person’s identity • Once obtained, attacker can start making purchases or signing up for services • Credit card fraud • Mail fraud • Other financial transactions

14. Social Engineering • Identity Theft (cont.) • Attack vectors • Phishing • Stealing information from financial institutions • Dumpster diving • Stealing email • Stealing credit card numbers • Stealing wallet or purse

15. Social Engineering • Identity Theft (cont.) • Warning signs • Unauthorized or unknown long distance calls on victim’s phone • Phone calls from collection agencies regarding unknown accounts • Denial of credit when applying for new accounts • You wake up one morning and realize you’re not who you think you are

16. Social Engineering • Defending Against Social Engineering Attacks • Best defenses are personnel related • Policies and Procedures • Must have comprehensive, up-to-date information security policies • Personnel must read the policies and be able to recognize potential social engineering attacks

17. Physical Security • Physical security is a necessary countermeasure to hacking • Concerned with • Physical access • Environmental issues • Power source(s) • Biometrics • Fire protection • Inventory control • Media erasure/destruction • etc.

18. Physical Security • Threats to physical security • Human actions • War • Labor strikes • Sabotage • Theft • Vanalism • Natural events • Storms • Earthquakes • etc. • Disasters • Release of toxic gases • Fire • Power outage • Water damage • Equipment failure

19. Physical Security • Physical Security Implementation • Includes various controls • Facility • Personnel • Environment • HVAC • Fire safety • Access • Fax machines • Physical

20. Physical Security • Physical Security Implementation (cont.) • Facility controls • Must be an integral part of planning and design of data facilities • Issues • Heights • Fire ratings of walls and ceilings • Weight ratings • Electrical conductivity of floors (to reduce static electricity) • Window security • Door security • Emergency exits • Fire suppression • Shut-off switches • Air conditioning • positive air pressure (to protect against airborne particles entering the building) • UPS

21. Physical Security • Physical Security Implementation (cont.) • Facility controls (cont.) • Site selection considerations • Local environment • Security situation, types of other facilities in area • Joint tenancy • Restrictions/complications/vulnerabilities caused by other tenants • Visibility • Prominence of building • Transportation • Accessibility, congestion, etc • Emergency services • availability of police, fire, medical

22. Physical Security • Physical Security Implementation (cont.) • Facility controls (cont.) • Access logs for facility entry • Violations • Modification of access privileges and by whom • Time and date of access attempt • Successful/Unsuccessful attempts • Point of entry • Name of individual attempting access

23. Physical Security • Physical Security Implementation (cont.) • Company Personnel Controls • Procedures related to HR such as hiring, termination, background checks, performance reviews, etc. • Employment background, reference, and education reviews • Security clearances • Personnel performance reviews • Non-disclosure agreements • Exit interviews • Return of company property • Change of passwords and encryption keys

24. Physical Security • Physical Security Implementation (cont.) • Environmental Controls • Electrical power • Heating • Ventilation • Air conditioning (HVAC) • Humidity

25. Physical Security • Physical Security Implementation (cont.) • Fire Safety Controls • Principal life safety control • Impacts • Personnel safety • Economic impact from losses • Loss of critical documents/data

26. Physical Security • Physical Security Implementation (cont.) • Fire Safety Controls (cont.) • Combustible Material Classes

27. Physical Security • Physical Security Implementation (cont.) • Fire Safety Controls (cont.) • Fire Suppression Classes

28. Physical Security • Physical Security Implementation (cont.) • Fire Safety Controls (cont.) • Fire Detection • Critical to life safety • Heat Detectors • Respond to either rate of temp change or actual temperature • Flame Detectors • Respond flame pulsation or infrared emissions • Smoke Detectors • Respond to smoke interference • Interference with ionization current

29. Physical Security • Physical Security Implementation (cont.) • Fire Safety Controls (cont.) • Fixed fire extinguishing • Water sprinkler system • Wet pipe • Dry pipe • Deluge • Preaction • Combines wet and dry pipe

30. Physical Security • Physical Security Implementation (cont.) • Access Controls • Applies to both physical and data entities • Access cards • Dumb – simple id card with picture • Smart – embedded intelligence

31. Physical Security • Physical Security Implementation (cont.) • Access Controls (cont.) • Biometric • Provides an automated means of identifying and authenticating a living person based on physiological or behavioral characteristics • Finger prints • Face recognition • Retina scan • Gait • Hand geometry • Voice • Signature dynamics

32. Physical Security • Physical Security Implementation (cont.) • Access Controls (cont.) • Intrusion Detection Systems

33. Physical Security • Physical Security Implementation (cont.) • FAX machines • Place in secure, restricted access area • Protect FAX servers with security hardware and software

34. Physical Security • Physical Security Implementation (cont.) • Physical Facility Controls • Guards • Guard dogs • Fences • Mantrap • Bollards • Lights • Video cameras • PC/laptop controls • Tethers, etc.

35. Physical Security • Physical Security Implementation (cont.) • Physical Facility Controls (cont.) • Locks • Warded locks • common padlock opened with a key • Tumbler locks • more secure locks that use pin tumblers, lever tumblers, or wafer tumblers • Combination locks • dials or series of wheels that require correct combination • Programmable locks • electronic or mechanical keypad or card-key • Device locks • used to secure equipment (cables, port block, etc.)

36. Physical Security • Physical Security Implementation (cont.) • Storage Media Controls • Data encryption • Cable locks (for laptops) • Secure storage of paper and magnetic media • Backing up data • Storing critical data offsite • Destroying paper documents and magnetic media • Auditing media use and storage

37. Physical Security • Physical Security Implementation (cont.) • Storage Media Controls (cont.) • Data Remanence and Object Reuse • Data remanence is the data that remains on magnetic media following erasure • Object reuse is the reusing of data storage media • Data remanence safeguards • Clearing – overwriting magnetic medium, usually done when media remain in the original environment • Purging – degaussing or overwriting media intended to be removed from a monitored environment • Destroying – physical destruction of the media

38. FIN