280 lines
12 KiB
Plaintext
280 lines
12 KiB
Plaintext
|
|
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
|
%% N.I.A. %%
|
|
%% Network Information Access %%
|
|
%% 10MAR90 %%
|
|
%% Lord Kalkin %%
|
|
%% FILE #7 %%
|
|
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
|
|
|
:_Computers: Crime, Fraud, Waste Part 3
|
|
:_Written/Typed/Edited By: Lord Kalkin
|
|
:_Information Security
|
|
PHYSICAL SECURITY
|
|
|
|
|
|
Traditional Security: Locks, Fences, and Guards
|
|
|
|
Physical security once meant keeping a computer and its
|
|
information from physical harm by surronding the computer facility with
|
|
locks, fences, and guards. But physical security has changed to
|
|
accomodate the realities of today's computer enviroment -- an enviroment
|
|
that is often a typical office setting with many small computers, word
|
|
processors, and portable terminals.
|
|
|
|
Physical security is concerned with controls that protect
|
|
against natural disasters ( e.g., fires, flood, or earthquakes ), and
|
|
accidents. Physical security controls regulate the enviroment
|
|
surrounding the computer, the data input, and the information products.
|
|
In addition to the site where the computer equipment is housed, the
|
|
enviroment includes program libraries, logs, records, magnetic media,
|
|
backup storage areas, and utility rooms.
|
|
|
|
Whether physical security controls are called enviromental
|
|
controls, installation controls, or technical controls, they must be
|
|
responsive to today's enviroment and they must be cost-effective. For
|
|
exapmle, installing costly fire suppression may be essential to protect
|
|
a large computer that process sensitive data but may not be justifiable
|
|
to protect a single microcomputer.
|
|
|
|
CRIMES, ABUSES, AND WASTE
|
|
|
|
Computers have been shot, stabbed, stolen, and intentionally
|
|
electrically shorted out. Disks and tapes have been destroyed by
|
|
spilled beverages, and computers have been harmed by water leaks.
|
|
Computers have been seriously damaged by temperature extremes, fire,
|
|
electric power surges, natural disasters, and a host of accidents.
|
|
Information has been intercepted, stolen, sold, and used for the
|
|
personal gain of an individual or for the benefit of a company.
|
|
|
|
- Small computers are an especially attractive target for thieves.
|
|
- During a fire, disks stored in nonfireproof cabinets and
|
|
floppy disks left next to computer terminals were destroyed by
|
|
a sprinkler system. Thousands of dollars were spent
|
|
reconstructing the information they contained.
|
|
|
|
But accidents and ordinary contaminants are propably the major
|
|
cause of damage to computers and realted equipment.
|
|
|
|
COMPUTER GERMS:
|
|
|
|
SPILLS, SMOKE, AND CRUMBS
|
|
HEAT AND HUMIDITY
|
|
|
|
CLUES
|
|
|
|
The following clues can help indicate physical security
|
|
vulnerabilities:
|
|
|
|
1. Smoking, eating, and drinking are permitted in the computer
|
|
work area.
|
|
2. Computer equipment is left unattended in unlocked rooms or is
|
|
otherwise unsecured.
|
|
3. There is no fire alert or fire protection system.
|
|
4. Disks are left in desk drawers; there are no backups of disks
|
|
5. Strangers are not questioned about being in the computer area.
|
|
6. An inventory of computer equipment or software in
|
|
nonexistant, incomplete, never updated, or not verified after
|
|
it is completed. Inventory shortages occur frequently.
|
|
7. Printouts, microfiche, or disks containing sensitive data are
|
|
discarded as normal trash.
|
|
8. Locks which secure computer equipment or provide access to
|
|
computer equipment are never changed.
|
|
9. No assessment is made of the computer site, i.e., how
|
|
vulnerable is it to access by unauthorized persons, to fire
|
|
or water damage, or to other disasters.
|
|
|
|
"THIS PRINTOUT IS WORTH $$$$$!!! IT WILL GET ME INTO THE SYSTEM."
|
|
|
|
PHYSICAL SECURITY CONTROLS
|
|
|
|
1. Prevent intentional damage, unauthorized use, or theft.
|
|
|
|
Small computers can be locked or bolted to work stations and
|
|
access to them limited by computer equipment cover locks. Lock offices
|
|
where they are located. Ensure individuals are responsible and
|
|
accountable for the small computer they use.
|
|
|
|
If the information used by a goverment program is processed by a
|
|
major computer facility, check to see how physical access to the
|
|
facility and to related locations are controlled. Methods such as logs,
|
|
locks, identifiers ( such as badges ), and guards may be appropriate.
|
|
|
|
The input of sensitive information requires proper handling of
|
|
source documents. Proper handling means giving the same security
|
|
considerations to these documents whether they provide input to
|
|
automated or nonautomated systems. Consideratiosn may involve securing
|
|
the area, logging the documents, ensuring that only appropiate cleared
|
|
persons see these documents, and using burn abgs or other approved
|
|
disposal methods.
|
|
|
|
Carefully consider computer location. Is it too accessible to
|
|
unauthorized persons or susceptible to hazards?
|
|
|
|
Alert Staff:
|
|
|
|
Be aware of common access-gaining schemes, such as
|
|
"piggy-backing," where an authorized worker is followed into
|
|
the computer area by a stranger carrying an armload of
|
|
computer printouts or by persons claiming to be maintenance
|
|
workers.
|
|
|
|
Know persons with authorized access to the computer area and
|
|
challenge strangers.
|
|
|
|
Many people believe that locked and guarded doors provide total
|
|
physical protection. But electromagnatic emissions from other computers
|
|
can be intercepted and automated information read. Recommended
|
|
protections (e.g., equipment modification and shielding ) must take into
|
|
the account the level of security required by the automated information
|
|
and the fact that such an interception is rare, but mare occur.
|
|
|
|
An inexpensive precautionary measure is making sure that
|
|
telephone and computer transmission lines are not labled as to
|
|
their function and that their location is secured. In a network
|
|
system, dedicated transmission lines -- which preform no other
|
|
function -- may be required. In an increasing number of
|
|
situations, dedicating a small computer to a single application
|
|
may be the most cost-effective protection device.
|
|
|
|
Each of the four technologies used to transmit automated
|
|
information can be intercepted: cable ( wiretapping ), microwave (
|
|
interception ), satellite ( satellite recieving atenna), and radio
|
|
frequency ( interception ).
|
|
|
|
Protection technologies which may be called for include
|
|
encryption of information, dedicated lines, security modems, and
|
|
the alteration of voice communications by scrambling the single,
|
|
converting it to digital form, and using encryption.
|
|
|
|
2. Enviromental hazards can wreck havok with large and small computers
|
|
alike.
|
|
|
|
Take measures to prevent, detect, and minimize the effects of
|
|
harxards such as fire, water damage, air contaminants, excessive heat,
|
|
and electricity blowouts.
|
|
|
|
Protect against fire damage with regulary tested fire alert
|
|
systems, and fire suspression devices. Protect small computers with
|
|
covers to prevent damage from sprinkler systems. Do not store
|
|
combustibles in the area.
|
|
|
|
Static electricuty can erase memory in small computers.
|
|
Antistatic pads and sprays can help control this. Users can be reminded
|
|
to discharge static electricity by touching a grounded object.
|
|
|
|
Power surges can erase memory, alter programs, and destroy
|
|
microcircuits. An uniterrupted power source allows enough time to shut
|
|
down a computer without losing data. Prevent momentary power surges
|
|
from damaging computers by using voltage regulators. In a thunderstorm,
|
|
unprotected small computers can be turned off and unplugged.
|
|
|
|
Excessive heat can be controlled by air-conditioning systems and
|
|
fans, and by ensuring that air can circulate freely. A common problem
|
|
is stacking peripheral equipment or blocking air vents on terminals or
|
|
small computers.
|
|
|
|
Air filters can remove airborne contaminants that harm equipment
|
|
and disks. Consider banning smoking near small computers.
|
|
|
|
Locate computers away from potential water hazards, such as
|
|
plumbing pipes, areas known to flood, or even sprinkler systems if other
|
|
fire protection devices are available.
|
|
|
|
Keep food, beverages, and ashtrays away from the computer.
|
|
|
|
Keep equipment in good working order. Monitor and record
|
|
hardware maintainence. This provides both an audit trail of persons who
|
|
have had access to system and a record of contract fulfillment.
|
|
Remember that maintainence personnel must carry proper identification.
|
|
|
|
3. Protect and secure storage media ( source documents, tapes,
|
|
cartridges, disks, printouts ).
|
|
|
|
-- Maintain, control, and audit storage media inventories.
|
|
-- Educate users to the proper methods for erasing or destroying
|
|
storage media.
|
|
-- Label storage media to reflect the sensitivity level of the
|
|
information they contain.
|
|
-- Destroy storage media in accordance with the agancy's
|
|
security provisions.
|
|
-- Ensure that access for storing, transmitting, marking,
|
|
handling, and destroying storage media is granted only to
|
|
authorized persons.
|
|
-- Plubicize procedures and policies to staff.
|
|
|
|
Consider posting the following reminders -- Disks are Fragile
|
|
and Good Management Practices Provide Protection -- Where everyone can
|
|
see them.
|
|
|
|
-=- Disks are Fragile -=-
|
|
|
|
-- Store in protective jakets.
|
|
-- Don't write on jackets.
|
|
-- Protect from bending.
|
|
-- Don't touch disks directly
|
|
-- Insert carefully into the computer.
|
|
-- Protect from coffee and soda spills.
|
|
-- Maintain acceptable tempuratures (50C-125C)
|
|
-- Prevent erasures by keeping disks away from magnetic sources
|
|
such as radios and telephones.
|
|
-- Store in areas, such as metal cabinets, protected from fire
|
|
and water damage.
|
|
-- Handle disks in accord with their sensitivity marking.
|
|
|
|
|
|
-=- Good Management Practices Provide Protection -=-
|
|
|
|
-- Lock disks and tapes when not in use.
|
|
-- Use a filing system to keep track of disks and tapes.
|
|
-- Don't lend storage media with sensitive information to
|
|
unauthorized persons.
|
|
-- Return damaged or defective disks with sensitive information
|
|
only after degaussing or after a similar procedure.
|
|
-- Dispose of disks with sensitive information by degaussing,
|
|
shredding, and following agency security procedres.
|
|
-- Dispose of printouts and printer ribbons with sensitve
|
|
information by following agency security procedures.
|
|
-- Secure printouts of passwords and other access information.
|
|
|
|
4. be sure that adequate plans are made for contingencies. Remember
|
|
that the intent of contegency plans is to ensure that users can continue
|
|
to preform essential functions in the event that information technology
|
|
support is interrupted. End users of information technology
|
|
applications, as well as computer installations that process these
|
|
applications, are required to hove contingency plans.
|
|
|
|
Contingency plans must be written, tested, and regularly
|
|
communicated to staff.
|
|
|
|
Contingency plans must take into account backup operations,
|
|
i.e., how information will be processed when the usual computers cannot
|
|
be used, and the recovery of any information which is lost or destroyed.
|
|
|
|
With small computers and word processors especially, the
|
|
contigency plans should address selected equipment breakdowns, such as a
|
|
single printer servicing many stations.
|
|
|
|
Procedures and equipment should be adequate for handling
|
|
emergency situations ( fire, flood, etc. ).
|
|
|
|
Store backup materails, including the contingency plan, in a
|
|
secure and safe location away from the computer site.
|
|
|
|
Contingecny procedures must be adequate for the security level
|
|
and criticality of the information.
|
|
|
|
Know what to do in case of an emergency and be familiar with the
|
|
contingency plan.
|
|
|
|
Remember what the contingency plan may be operating at a time of
|
|
great stress and without key personnel. Training of staff is vital.
|
|
|
|
N.I.A. - Ignorance, There's No Excuse.
|
|
Founded By: Guardian Of Time/Judge Dredd.
|
|
|
|
[OTHER WORLD BBS]
|
|
|
|
|
|
|