2.4 Physical attacks

Question 1

Physical attacks

Answer 1

• Old-school security– No keyboard, no mouse, no command line
• Many different ways to circumvent digital security– A physical approach must be considered
• If you have physical access to a server, you have full
  control– An operating system can’t stop an in-person attack
• Door locks keep out the honest people

Question 2

Brute force

Answer 2

• The physical version - No password required
• Push through the obstruction - Brawn beats brains
• Check your physical security– Check the windows, try the doors
• Attackers will try everything– You should be prepared for anything

Question 3

RFID cloning

Answer 3

• RFID is everywhere - Access badges, key fobs
• Duplicators are on Amazon - Less than $50
• The duplication process takes seconds– Read one card, copy to another
• This is why we have MFA– Use another factor with the card

Question 4

Environmental attacks

Answer 4

• Attack everything supporting the technology– The operating environment
• Power monitoring– An obvious attack
• HVAC (Heating, Ventilation, and Air Conditioning) and
  humidity controls– Large data centers must be properly cooled
• Fire suppression– Watch for smoke or fire