Tech: Why Physical Security is Important to your Data!

Physical Security... locking your doors is important, but it is so much more than that!  While most IT security focuses on technology, network connectivity, firewalls, antivirus, and patching, you cannot overlook the importance of physical security. From employees, teachers and staff members who leave the building with a laptop or tablet to your physical work location, everyone should be aware of their surroundings and take basic precautions to safeguard the equipment and data in their care. Here are some of these basic physical security best practices.

Situational Awareness 
Users should always be aware of where they are and who is around them.  Maintaining situational awareness of their surroundings at all times and paying attention to potential threats is key to keeping data safe. They should not talk loudly on the phone or with colleagues about sensitive topics when others are within earshot. They should not pull out their phone and pay more attention to it than to walking down the street or standing at a train platform. They should not set up their laptop where someone can easily grab it and run off, and a refractive screen filter may be in order for those who work on sensitive data out in the open.

Maintain Control
There will be times when users cannot maintain direct physical control of IT resources, such as when their laptop goes through the X-ray machine at the airport. But they can make an effort to always maintain visual contact with their equipment and ensure that they are not letting their laptop go through the X-ray machine until they are able to go through the metal detector too. Although many TSA agents will balk at this suggestion, it does not hurt to make a best effort.  Users should also ensure that any portable media that is not directly connected to their computer and within sight.  It should always be either in their pocket, or put away out of sight in their bag, which must remain within their control. It only takes a second for someone to grab a USB key or laptop and walk off with it. Don’t provide anyone with the opportunity to grab something of yours while you are not looking.

Encryption
Accidents will happen and things will get stolen.  By encrypting all data on all portable storage and laptop hard drives, when something does grow wings and flies away, at least the sensitive data stored on the hardware will not be readily accessible to the new ‘owner.’ Make sure you use strong encryption, a strong password.  And never, ever write down your password on anything.  If you keep a list of passwords, choose an encrypted app on a secure device to store this information.

Organized Work AreaA clean office is a sign of a security-minded person. If you have stacks of papers, or worse, if your office is filled with a stack of old laptops -- you want to clean it up, now. If you don’t want the cleaning crew, visitors or co-workers to see what they should not, then don’t leave sensitive information on the desk. If you’re away from your computer, lock the screen, and if you have data on a whiteboard erase it before you leave or cover it so that it’s not visible to anyone outside your office and prying eyes.  Your organization should have a mandatory screen lock built in when a computer is left unused for a certain period of time.

Lock It Up
Sensitive documents, DVDs, portable drives, and USB keys should be locked in your desk at the end of the day. Your laptop bag should be locked in your trunk when you must travel with it, and MUST leave it in the car. Avoid doing so when it’s very hot… you don’t want to cook your laptop. When renting cars, make sure they come with a trunk so you can put things away out of sight. In a hotel, a cable lock helps ensure that your laptop is secure when you are using it and have left the room for dinner or time in the gym. The hotel’s cleaning service may be extremely honest and trustworthy, but they may not.  It is not unusual for them to leave the doors open while they are cleaning rooms.  It only takes a second to jump in, grab the laptop, and jump back out.

Don’t Advertise
While those bags with the company logo look really cool, they also advertise who you work for and what is in the bag.  It is important to have identifying information on your laptop and bag, but a discreet card in your bag and a sticker on the laptop is sufficient for that. The same goes for logo wear. When traveling, try to avoid wearing clothes or using bags with the logo of your company so that you are not calling attention to yourself. Sure, everyone will know what you have in your back pack, but without a logo you could be as much a student as a high-end consultant for a big name company. Most physical security involves common sense, situational awareness, and reducing the risk. Stay alert and don’t part with your laptop or files or memory sticks unless you really have to. Even then you can take precautions. Better safe than sorry!

~~~~

Bruce holds a degree in Computer Science from Temple University, a Graduate Certificate in Biblical History from Liberty University and is working a Master Degree in American History at American Public University.  He has worked in educational and technology for over 18 years, specializes in building infrastructures for schools that work to support the mission of technology in education in the classroom.  He also has served as a classroom teacher in Computer Science, History and English classes.  

Bruce is the author of five books: Sands of Time, Towering Pines Volume One:Room 509, The Star of Christmas, Philadelphia Story: A Lance Carter Detective Novel and The Insider's Story: A Lance Carter Detective Novel -- with a new book, Learn the Basics: Digital Forensics, due soon. 

Follow Bruce's Novel releases by subscribing to his FREE newsletter!

Be sure to check out Bruce's Allentown Education Examiner Page, his Twitter and his Facebook!

Tech: What is Data Encryption and Why it is Important!

As those of you who are regular readers know, I have a number of projects "in the hopper".  One of which is a text book on learning the basics of digital forensics.  While I was working on it last night a bit (instead of working on my final paper on how Hitler achieved control of Germany legally in the 1930's -- which is going to be fantastic by the way) I decided to take some of the encryption info that I was working into the book and craft a BLOG post about what data encryption is, and why it is important to everyone.  This is that post...

Encryption can be used to provide both confidentiality and integrity. Confidentiality comes when the file is encrypted in such a way that only authorized users have access to the key. Integrity comes from hashing the file so any change, no matter how minute, can be instantly detected. We can apply both concepts to data in transit or at rest. But what do those phrases mean? 

Data In Transit
Data in transit is defined as any data being accessed over the network, and therefore could be intercepted by someone else on the network or with access to the physical media the network uses. I will be writing up a little piece on physical security of your data soon.  Be sure to check back on that!  On an ethernet network, that could be someone with the ability to access your cabled infrastructure, configure a switch to mirror traffic, or fool your client or a router into directing traffic to them before it moves on to the final destination. On a wireless network, all they need is to be within range. Wireless networks can and should be protected from unauthorized snooping by encrypting all traffic. Strong enterprise networks can use WPA2 Enterprise, but weaker networks may have to use pre-shared keys to establish session keys, like in WPA Personal, or worse, shared keys among all clients as in WEP. For purposes of this post, consider an open network to be like the one you’d use at a coffee shop or hotel.

When you use a clear text protocol like TELNET, HTTP, FTP, SMTP, POP, IMAP, or LDAP, that traffic is referred to as “in the clear”.  Anyone that has access to your network traffic and a readily available tool like Wireshark, they can intercept your traffic, giving them access to read your email, copy your credentials, or even make copies of your files. You need to protect your data’s confidentiality and your own privacy by encrypting this traffic using SSL/TLS, or switching to another encrypted equivalent protocol. TELNET can be replaced by SSH. FTP can be replaced by SFTP. The rest can use encrypted transport with SSL or TLS. When data is encrypted in transit, it can only be compromised if the session key can be compromised.  It is worth mentioning that this is where keeping your network infrastructure up-to-date.  Many older models of switches, routers and network appliances may not support SFTP or SSH for connectivity.

Even though some encryption in transit will use symmetric encryption and a set session key, most will use a certificate and asymmetric encryption to securely exchange a session key and then use that session key for symmetric encryption to provide the fastest encryption/decryption. Any protocol that uses either SSL or TLS, uses certificates to exchange Public Keys, and then the Public Keys are used to securely exchange Private Keys, it becomes very difficult for an attacker to defeat. Most encrypted protocols include a hashing algorithm to ensure no data was altered in transit. This can also help defeat “Man in the Middle” attacks.  It defeats MitM attacks by decrypting and re-encrypting data, which forces the attacker to alter the signature even if they don’t change any of the key data.

If an attacker can fool you into using them as your proxy, or can convince you to click past the certificate warning dialogue box so that you will trust their certificates, this will enable them to run a MitM attack.  The attacker will establish an encrypted session with you, and another with your destination, and be able to intercept your traffic as it passes through their system. That is why it is critical to always use certificates from a third-party Certificate Authority, to never accept a certificate when your client software warns you about an untrusted certificate. Even though it is a big challenge, your users should be trained to never accept certificates that fail and show a warning in their browser. Encryption in transit should be mandatory for any network traffic that requires authentication, or includes data that is not publicly accessible. You don’t need to encrypt your public facing website, but if you want customers to logon to view things, then it is imperative that you use encryption to protect both the logon data, and their privacy while they access your site.

Data At Rest
Encryption of data stored on media is used to protect the data from unauthorized access should the media ever be stolen. Physical access can get past file system permissions, but if the data is stored in encrypted form and the attacker does not have the decryption key, they have no more than a useful paperweight or a drive they can format and use for something else.

Most encryption at rest uses a symmetric algorithm so that data can be very quickly encrypted and decrypted. You don’t want encryption to slow down system performance. However, since the symmetric key itself needs to be protected, they can use a PIN, password, or even a PKI certificate on a smart card to secure the symmetric key, making it very difficult for an attacker to compromise.

Hashing algorithms can be used on files at rest to calculate their value and compare it later to quickly and easily detect any changes to the data. Checksums or hashes are commonly run to validate that a file you have downloaded from the Internet is in fact the authentic file the creator intended, but investigators can hash entire hard drives to validate that any copies made are exact.

Encryption at rest should be mandatory for any media that can possibly leave the physical boundaries of your infrastructure. USB keys, external drives, backup tapes, and the hard drives of all laptops that hold any organizational data should be encrypted without exception. To further enhance the security of your servers and to protect against malicious users or vendors, you should encrypt the hard drives of all your servers too. That way, even if a failed drive is replaced, you don’t have to worry about ensuring its physical destruction to ensure your customers’ and company’s data is secure.

Examples of encryption at rest include the AES-encrypted portable media, some of which include a fingerprint reader for two-factor authentication, and Vault in OS X or Bitlocker in Windows operating systems to secure both the system drives and external media. With encryption in use both in transit and at rest, data can be protected from prying eyes, and users are assured that the data has not been modified in any way. With the prevalence of unencrypted Internet access, and the loss and theft of IT assets today, using encryption should be mandatory for all users and all businesses.

For more information on my upcoming digital forensics textbook, Learn the Basics of Digital Forensics, visit my website -- http://www.bruceasarte.com.


~~~~
Bruce holds a degree in Computer Science from Temple University, a Graduate Certificate in Biblical History from Liberty University and is working a Master Degree in American History at American Public University.  He has worked in educational and technology for over 18 years, specializes in building infrastructures for schools that work to support the mission of technology in education in the classroom.  He also has served as a classroom teacher in Computer Science, History and English classes.  

Bruce is the author of five books: Sands of Time, Towering Pines Volume One:Room 509, The Star of Christmas, Philadelphia Story: A Lance Carter Detective Novel and The Insider's Story: A Lance Carter Detective Novel -- with a new book, Learn the Basics: Digital Forensics, due soon. 

Follow Bruce's Novel releases by subscribing to his FREE newsletter!

Be sure to check out Bruce's Allentown Education Examiner Page, his Twitter and his Facebook!