\documentstyle[12pt,twoside,alltt]{article}
\textwidth=6in
\oddsidemargin=0.25in
\evensidemargin=0.25in
\topmargin=-0.1in
\footskip=0.8in
\parindent=0.0cm
\parskip=0.3cm
\textheight=8.00in
\setcounter{tocdepth} {3}
\setcounter{secnumdepth} {4}
\sloppy
 
\newenvironment{proof}{\noindent{\bf Proof:}}{\qed\bigskip}
\newenvironment{proof_sketch}{\noindent{\bf Sketch of 
Proof}\hspace*{1em}}{\qed\bigskip}
 
\newtheorem{theorem}{Theorem}
\newtheorem{corollary}{Corollary}
\newtheorem{lemma}{Lemma}
\newtheorem{claim}{Claim}
\newtheorem{fact}{Fact}
\newtheorem{definition}{Definition}
\newtheorem{assumption}{Assumption}
\newtheorem{observation}{Observation}
\newtheorem{example}{Example}
\newcommand{\qed}{\rule{7pt}{7pt}}
 
\newcommand{\lecture}[4]{
\pagestyle{headings}
\thispagestyle{plain}
\newpage
\noindent
\begin{center}
\framebox{
\vbox{
\hbox to 5.75in { {\bf 6.857 Computer and Network Security
\hfill Fall Term, 1996}  }
\vspace{4mm}
\hbox to 5.75in { {\Large \hfill Lecture #1 : #2 \hfill} }
\vspace{2mm}
\hbox to 5.75in { {\it Lecturer: #3 \hfill Scribe: #4} }
}
}
\end{center}
\markboth{Lecture #1 : #2}{Lecture #1 : #2}
\vspace*{4mm}
}
 
\begin{document}
 
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Lecture command takes 4 arguments:
%               ordinal number of the lecture
%               date of the lecture
%               lecturer
%               scribe---that is you
%
\lecture{2}{September 10, 1996}{Ron Rivest}{Joseph Figueroa} 
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
 
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Your notes start here!
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
 
\section{Physical Security}
 
Physical security is the basis of computer security.  By studying it we 
gain insight into a good metaphor for other types of security which will 
study later on.  We are going to discuss the two main uses of physical 
security: protection against natural risks and malicious attacks.
 
\subsection{Natural Risks}
 
Next we will examine which natural risks are the most common threats to 
computer physical security.  To see specific examples of a variety of things 
that can go wrong, and how things can go wrong simultaneously read 
{\em Computer-Related Risks} by Peter Neumann.
 
\begin{itemize}
\item {\bf Power interruption}:
Power interruption may be hard to recover from.  Sometimes it may
result in permanent system damage, since electronic components are
not designed to absorb sudden power fluctuations.  UPS (uninterrupted
power supply), surge protectors, alternative power generators are
possible security measures although many times their natural state 
is untested and/or broken.
\newline {\it example}: Neumann p. 16.  AT\&T backup battery drain and ultimately causing a 3 airport shut downs.
 
\item {\bf Fire}:
Use of chemical fire supressants (ie. halon), smoke detectors and sprinklers 
are possible security measures.  Chemical fire supressants like halon can be tricky to use because we want to be able to evacuate people easily, but we also want to seal the room to keep the halon contained.  When using water sprinklers to put out fires we have to make sure that the water from the sprinklers will not wet the systems, as this may cause electrical fire and/or water damage (see below.) 
 
\item {\bf Storm/Flood:} Lightning during storms can be very damagging (surge
protectors usually don't protect against surges of these magnitudes).  
The increase of waterfall during storms can critically overload pipes and 
cause them to rupture.  There are two distinctions to be made
between raising waters and falling waters. The first can happen in case
of flood for example. Systems should be placed in high stands and 
possibly in higher floors of buildings (not in the basement.)
Falling waters may happen because of leakage during heavy storms or 
because of fire alarm sprinklers. The easiest form of protection 
in this case is lots of plastic sheets. Others advocate the use of
foam fire extinguishers instead of water ones.  However, the previous security
measures together with a backup system kept offsite would be ideal.
\newline {\it example}: Neumann p. 56.  Passengers were stranded in
Sydney's monorail due to water damage to control computer.
 
\item {\bf Earthquake/Meteor/War}:
These risks may destroy a whole building.  In order to quickly
restart the computer system first of all we need up to date backups
(see section on backups below). Of course the backups should be
kept in a separate place possibly miles away. In some cases a 
{\em cold site} may be needed, i.e. a facility with power, 
cooling and network connections (i.e., at least phone lines), available to 
install a computer system. For more critical task {\em hot sites} may be 
required. A hot site is a facility with a computer system ready to run 
and be used. The cost of maintaining a hot site is high but companies usually
share the services of a single hot site provider (given the very rarity
of use) making the cost fairly affordable. 
 
\item {\bf Communications interruption}:
Lines may be cut by people or animals.  To protect against accidental 
severance of communication lines, duplicate lines at different sites are 
needed.
\newline {\it example}: Neumann p. 15.  Chicago area telephone cable.
\newline {\it example}: Neumann p. 16.  Virginia cable cut.
\newline {\it example}: Neumann p. 17.  Beaver chews on cables.
 
\item {\bf Operator error}: 
Errors such as coffee or coke spills and accidental file deletion are very
common.  Errors such as mounting the wrong tapes or accidentally hitting the
wrong key can also occur.
\newline {\it example}: Neumann p. 77.  Chernobyl accident, 1986.
 
\item {\bf Software/Hardware error}
\newline {\it example}: Neumann p. 68.  Therac-25 chemotherapy machine
killed and injured several patients due to software bugs (ie. hardware 
safelocks were removed and substituted by software ones).
\end{itemize}
 
{\bf Backups:} 
The most effective solution to many of these natural risks is to
create backups.  Many types of backups are possible-- daily, weekly,
and monthly, as well as full, incremental, and differential.  Backups
can be used either for quick restart or restoration of damaged
systems, as well as for record keeping and tracking purposes.  Backups
should be separately stored in a secure place away from the system.
Backups should be regularly tested to make sure that the data on the
backups are intact. Also backups may contain sensitive information so they
should be protected since they provide an attacker with a potential
entry point to private data other than the computer system itself. 
 
\subsection{Preventing Malicious Attacks}
We will focus on attacks where attacker ``needs to get close'' to mount attack,
rather than on penetration by remote login.  Here are some reasons why someone might want to attack: financial gain, disgruntled employee seeking revenge,
you are the first available target, to gain fame, diversion, military 
advantage, etc...  It is important to note the difference between a targetted 
attack and a generic attack: the former requires more robust security measures.
 
\subsubsection{Physical access control}
 
{\bf Walls} and {\bf fences} define the security perimeter, while {\bf
guards} and {\bf locks} enforce access control policy.  Only
authorized users may enter the perimeter.  Possible security leaks
include:
 
\begin{itemize}
\item {\bf Masquerading}:
A person disguised as an authorized user.  This can be done using
forged IDs or pretending to be a repair man.
 
\item {\bf Piggy-backing}:
A person who enters the security perimeter by following an authorized
user.
 
\item {\bf Lock-picking}:
Any locked can be picked.  Sometimes there is substantial savings over
combinatorial brute-force.  However, many times the easiest way is simply 
to go through dropped ceilings or removing the hinges from door.
\newline {\it example}: {\em MIT Lockpicking Guide}
 
(see http://web.mit.edu/course/6/6.857/www/)
 
\item {\bf Visual/auditory access}:
An unauthorized person can gain passwords by bouncing laser off window to
pick up vibrations caused by sound waves.  They can also use binoculars, 
telephone bugs, etc.
\newline {\it example}: Russians spied on Americans by installing a telephone near coderoom.  They got the secret key by hearing the selectric balls on typewriters.
 
\end{itemize}
 
Possible solutions to these attacks include:
 
\begin{itemize}
\item {\bf Safes, doors with special locks}
Locks are useless unless the keys are hard to fake or to obtain (ie. bribery).
\newline {\it example}: Hotel doors with special access keys based on
a sequence of random numbers.
 
\item {\bf Clearing or destroying}
{\it Clearing} overwrites data multiple times with some character.
{\it Destroying} completely destroys the media by, for example, burning or 
melting.  However, it is hard to remove all traces of data (ie. look at
how much information has been gathered from the TWA wreckage).
 
\item {\bf Motion detectors}
\newline {\it example}: the movie {\it Sneakers}.
\end{itemize}
 
\section{Recommended Readings}
\begin{enumerate}
\item {\em Computer Related Risks} by Peter Neumann (war stories about computer
risks due to lack of adequate physical protection.
\item {\em Computer Security} by K.M. Jackson
\item {\em Applied Cryptography} by Bruce Shneier (contains potential term paper topics)
\item {\em Cryptography} by Doug Stinson
\end{enumerate}
 
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Your notes end here!
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
 
\end{document}
