12

Is Physical Security something that's allowed/supported here at all?

Obviously there's things like egress paths and lock picking that aren't really "IT" at all.. my gut says that really isn't the sort of questions this exchange is designed for?

But also there's "IT" physical security... keypads come to mind?

Is there any sort of ruling here or thoughts on this?

9
  • 2
    did you have a new question in mind? or an existing one to point to? I think generally no, but it might depend..
    – Jeff Atwood
    Jun 25, 2011 at 20:45
  • Do you consider BIOS configuration part of physical security?
    – this.josh
    Jun 26, 2011 at 5:28
  • @this.josh BIOS may be hardware-ish (its really firmware, not hardware), but its not a part of physical security.
    – AviD Mod
    Jun 26, 2011 at 8:41
  • @AviD Yes I know it is firmware, but it does require physical access to the machine to change BIOS values. Outside of bolting the machine to the ground, it was the closest relevent thing I could think of that aproximated physical security.
    – this.josh
    Jun 29, 2011 at 0:43
  • @this.josh actually that's not true either, you dont need physical access to the machine, there are currently drivers and utilities that allow you to access the bios from OS (and even remotely). Besides, "physical access" is not the same thing as "physical security".... :)
    – AviD Mod
    Jun 29, 2011 at 6:13
  • @AviD its been a while since I looked at BIOS settings, are non-volitile settings stored in the same flash as the firmware? It used ot be that the BIOS firmware was stored in a separate memory from the non-volitile settings, and when my button battery died I needed to set the date on every boot :P
    – this.josh
    Jun 29, 2011 at 7:46
  • @this.josh errm, I dont really know... I dont think anyone keeps computers around that long anymore ;). Anyway, I'm far from a BIOS expert, but I'm familiar with other technologies around it, such as Intel's AMT/vPro. Also I think there are BIOS update utils that can be launched from OS, and completed on restart...
    – AviD Mod
    Jun 29, 2011 at 7:55
  • 1
    @AviD do you have a spare math-coprocessor? my 80287 just gave out...
    – this.josh
    Jun 29, 2011 at 8:00
  • FYI ALL! This topic has spurred this debate on area51 regarding physical security and merging the physical security proposal with this site! discuss.area51.stackexchange.com/questions/2370/…
    – Thomas Ward
    Aug 3, 2011 at 12:46

4 Answers 4

Reset to default
12

I tend to err more on the side of being inclusive for anything that comes under the wider 'Information Security' banner for three reasons:

  1. The other Area51 proposals covering physical security seem to have gone nowhere and it would be good to have a place for it which is at least in the right sort of space, for example Social Engineering, Data Centre security (CCTV, electronic locks etc)
  2. The lines between Information Security domains are not rigid - you are likely to encounter associated aspects (eg Disaster Recovery and Resilience often come into the IT space)
  3. I live in the Information Security space with IT Security just being a (sizeable) portion of my day job, so I'm biased

That said, I think the aspects of physical security that include personal protection and anti-terrorism activities may be a tad out of scope.

2
  • I agree, definitely, that something like.. "What's the best martial arts to use to protect myself?" Is nothing like security here... definitely, as you say, more in the realm of 'information' security (both physical and electrical/digital)
    – DKGasser
    Jun 27, 2011 at 19:11
  • @DKGasser - added a couple of examples for detail.
    – Rory Alsop Mod
    Jun 27, 2011 at 19:15
8

Clearly IT departments need to pay close attention to physical security of many kinds, including lock picking. As has been explained here over and over, when your attacker has physical access to your hardware, nearly all bets are off. There is no other place on SE to discuss physical security, and there shouldn't be, because this site brings together the experts that have the right mindset for dealing with technology in the presence of attacks. In fact, I think that is the essential aspect that distinguishes this site from the others, along with the orientation towards risk and threat analysis.

If you think otherwise, where would you draw the line?

  • Allow discussions of crypto, but disallow criteria for defining tamper-resistance of TPMs and HSMs?

  • Allow discussions of bluetooth security, but not bluetooth-based electronic keys for physical locks?

  • Allow discussions of social engineering if it is about getting a password, but not if it is about getting in through the front door?

  • Allow discussions of protocols for SSL handshakes, but not protocols for anti-evidence seals?

I see no particularly useful line to be drawn anywhere on this continuum.

A relevant question is:

4
  • I agree whole-heatedly with what you're saying here about the line being impossible/difficult to draw.
    – DKGasser
    Jun 27, 2011 at 19:10
  • 1
    That link for anti-evidence seals whas the most unsettling thing I've read this week. Specifically 'seals that can be defeated in less than a given amount of time by one person, well practiced in the attack, working alone, and using only low-tech methods.' combined with '19% play a role in nuclear safeguards'
    – this.josh
    Jun 29, 2011 at 7:52
  • @this.josh: Just to be clear: anti-evidence seals are an improvement over existing seals, which nearly all have the problems that you cite.
    – nealmcb
    Jun 29, 2011 at 16:05
  • yes, the anti-evidence seals look promising. What scares me is that low work-product seals are use to protect nuclear assets.
    – this.josh
    Jun 29, 2011 at 16:45
2

Laptop theft seems relevent to physical security. According to the 2008 CSI Computer Crime & Security Survey laptop theft the third most frequent incident type after viruses and insider abuse of networks.

Note: as of this posting (mid-2011) the 2009 version requires subscription

1

What you're calling "IT physical security" is definitely ontopic, and not just keypads either.

I do agree though that lockpicking is not ontopic, therefore it might be a mite tricky to delineate between the types of "physical security".

I think a good guiding principle can be the types of topics that the CISSP Physical Security CBK covers, though I admit I'd be hardpressed to find an ITSec person that is an expert on most of those topics...

2
  • 2
    I still think locksmithing and other domains where there are security professionals should be on-topic.
    – Gilles 'SO- stop being evil'
    Jun 29, 2011 at 21:56
  • @Gilles - the lockpicking proposal on Area51 failed, and the Physical security one appears to have stalled at 22 users, so until something better comes along for it, I'd definitely expect lockpicking to come in here, if only for the fact that so many IT security folks have it as part of their repertoire...(and because it is fun :-)
    – Rory Alsop Mod
    Aug 2, 2011 at 12:05

You must log in to answer this question.