Physical information security
Physical information security is concerned with physically protecting data and means to access that data (apart from protecting it electronically). Many individuals and companies place importance in protecting their information from a software and/or network perspective, but fewer devote resources to protecting data physically. However, physical attacks to acquire sensitive information do frequently occur. Sometimes these attacks are considered a type of social engineering.
Background
Many individuals and companies consider it important to protect their information for a variety of reasons, including financial, competitive, and privacy-related purposes. People who wish to obtain this information may be computer crackers, corporate spies, or other malicious individuals. This information may be directly beneficial to them, such as industrial secrets or credit card numbers. It may also be indirectly beneficial to them. For example, computer passwords do not have inherent value. However, they provide computer system access that may be used to get other information or to disable a person/company electronically. Sometimes these malicious individuals use electronic means or social engineering to gain information. However, sometimes they use direct physical attacks.
Examples of physical attacks to obtain information
There are several ways to obtain information through physical attacks or exploitations. A few examples are described below.
Dumpster diving
Dumpster diving is the practice of searching through the trash of an individual or business in attempt to obtain something useful. In the realm of information security, this frequently means looking for documents containing sensitive information. However, as more and more information is being stored electronically, it is becoming increasingly useful to those seeking information through this means to search for computer disks or other computer hardware which may contain data. Sometimes this data can be restored to provide a wealth of information.
Overt access
Sometimes attackers will simply go into a building and take the information they need. [1] Frequently when using this strategy, an attacker will masquerade as someone who belongs in the situation. They may pose as a copy room employee, remove a document from someone's desk, copy the document, replace the original, and leave with the copied document. Individuals pretending to building maintenance may gain access to otherwise restricted spaces. [2] [3] They may then be able to walk right out of the building with a trash bag containing documents that were left out in the open or a sticky note which had been left in a partially open desk drawer on which a user had written his/her passwords.
Common Physical Information Security Practices
There are many practices commonly used to decrease the possibility of success for these kind of attacks. Document shredding has become common, and the practice is still growing. Also electronic storage media are often prepared for disposal by purging, which erases files which may have been "deleted" by an operating system but never overwritten with other data.
Many choose to restrict access to areas where information is kept to those possessing a proper identification badge and/or other form of authorization. This attempts both to decrease the ease with which someone could access documents and to decrease the possibility of someone physically tampering with computer equipment. Along the same lines, many companies train their employees to physically protect documents and other sources of sensitive information on an individual level by locking the information in a file cabinet or by some other means. Also, companies request that employees memorize their passwords rather than writing them down as the paper with the password could be seen or stolen.
See also
References
- ↑ Granger, Sarah (2001-12-18). "Social Engineering Fundamentals, Part I: Hacker Tactics". Security Focus. Retrieved 2006-08-27.
- ↑ "Four Men Arrested for Entering Government Property Under False Pretenses for the Purpose of Committing a Felony". U.S. Department of Justice (Press release). The FBI - New Orleans Division. January 26, 2010. Retrieved October 3, 2010.
- ↑ "Four Men Plead Guilty to Entering Federal Property Under False Pretenses Entered Senator Mary Landrieu’s Office to Secretly Record Office Staff Conversations". Department of Justice Press Release. The FBI - New Orleans Division. May 26, 2010. Retrieved October 3, 2010.