COSC 316 COMPUTER HOSTS SECURITY

1
COSC 316 COMPUTER HOSTS SECURITY

• SOUNDARARAJAN EZEKIEL
• COMPUTER SCIENCE DEPARTMENT
• INDIANA UNIVERSITY OF PENNYLVANIA
• INDIANA, PA 15705

2
Part II Security Building BlocksChapter 8
Physical Security for Servers

• We will talk about
• Planning for the Forgotten Threats
• Protecting Computer Hardware
• Preventing Theft
• Protecting your data
• Example- A failed site inspection

3
Chapter 8 Physical Security for Servers

• Many companies spend more monies to prevent break
  in New York companies spend hundred of thousand
  in day time but some cleaning crew get inside
  during night time
• 100,000 computer stolen during holiday
• Physical security is very difficult
• It is a forgotten threats
• First you need to have written plan part of
  security policy plan should include
• Descriptions of the physical assets that you are
  protecting
• Descriptions of the physical areas where the
  assets are located

4
Continue

• A description of your security perimeter- the
  boundary between the rest of the world and your
  secured area- and the holes in the perimeter
• The threats( attacks, accidents, natural
  disasters) that you are protecting against and
  their likelihood
• Your security defense, and ways of improving them
• The estimated cost of specific improvements
• The value of the information that you are
  protecting
• For the detailed security plan you need to ask
  the following questions
• Does anybody other than you ever have physical
  access to your computers
• What would happen if that person had a breakdown
  or an angry outburst and tried to smash your
  system with a hammer

5
continue

• What happen if someone in the employ of your
  biggest competitor were to come into the building
  unnoticed?
• If there were a fire in your building and the
  computers were rendered unusable, would the
  inability to access these systems cripple or
  destroy your organization?
• If some disaster were to befall your system,
  how would you face your angry users?
• The Disaster recovery plan- plan for immediately
  securing temporary computer equipment and for
  loading your backups onto new systems incase your
  computer is ever stolen or damaged

6
Recovery Plan

• Establish a plan for rapidly acquiring new
  equipment in the event of theft, fire, or
  equipment failure
• Test this plan by renting or borrowing a computer
  system and trying to restore your backups
• Other contingencies
• Loss of phone service or network connections-
  how will the loss of service impact your regular
  operations
• Vendor continuity- How important is support? ..
• Significant absenteeism of staff will this
  impact your ability to operate?
• Death or incapacitation of key personnel- can
  every member of your computer organization be
  replaced? What are the contingency plans?

7

• Protecting Computer Hardware
• Assets such as jewelry are easy to protect if
  stolen it is easy to sell danger for the
  property
• For computer hardware not for the property it
  is for the information
• If the backup itself stolen and destroyed
  information is irreplaceable
• Computer is easily damaged lighting storm and
  other ways
• Protecting against environmental dangers
• Fire
• Bad at surviving in the fire heat can melt the
  circuits
• Handheld fire extinguisher near the doorway of
  your computer room train your personnel or
  yourself in the proper use of the fire
  extinguisher

8
Protecting Against Environmental Dangers

• Fire
• Check the recharge state of each fire
  extinguisher every month
• If you have gas discharge system, make sure
  everyone who enters the computer room knows what
  to do when the alarm sounds. Post warning sign in
  the appropriate places
• If you have an automatic fire-alarm system, make
  sure you can override it in the event of a false
  alarm
• Ensure that there is telephone access for your
  operators and users who may discover a fire
• Modern computer will survive with automatic
  sprinkler system provided that the computer is
  turned off before the water starts to flow
  power automatically cut if the water sprinkler
  triggers.

9

• Smoke- very damaging to computer equipments
  here are some guidelines
• Do not permit smoking in your computer room or
  around the people who use the comptuers
• Install smoke detectors in every room with
  computer or terminal equipment
• If you have a raised floor, mount smoke detectors
  underneath the floor as well.
• If you have suspended ceiling, mount smoke
  detectors above the ceiling tiles
• Get a carbon monoxide detectors it will not
  affect the computer but it will affect the
  personnels

10
Protecting Against Environmental Dangers

• Dust- dust destroys data many kind of dust are
  somewhat conductive short circuits, fail and
  other problems
• Keep your computer room as dust free as possible
• If your computer has air filter, clean or replace
  them on a regular basis
• Get a special vacuum for your computer and use
  it on a regular basis
• Earthquakes- some parts of the world are subject
  to frequent and sever earthquakes
• Avoid placing computers on any high surfaces
• Do not place heavy objects near computers
• Place computers under strong tables
• Do not place computers near windows
• Physically attach computer to the surface

11
Protecting Against Environmental Dangers

• Explosion- Computers are not prone to
  explosions
• Consider the real possibility of an explosion on
  your premises
• Keep your backups in blast-proof vaults or off
  site
• Keep computers away from windows
• Extreme Temperatures
• Bugs
• Electrical Noise
• Lighting
• Vibration
• Humidity
• Water

12
Preventing Accidents

• Food and Drinks
• Controlling physical access
• Raised floor and dropped ceilings
• Entrance through air ducts
• Glass walls
• Defending against Vandalism
• Ventilation holespouring acids coca-cola
• Network Cables cutting a part of wire
• Network connectors
• Utility connections

13
continue

• Defending against acts of war and terrorism
• Preventing Theft
• Locks
• Tagging
• Laptop recover software and services
• RAM theft
• Encrypt your information make it virtually
  useless
• Protecting your data
• Eavesdropping electronic eavesdropping
• Wiretapping
• Eavesdropping over local area network, wireless,
  by radio, fiber optic cable, keyboard monitors

14
Physical Security continue

• Protecting your backups
• Verify your backups
• Sanitizing media before disposal -- destroy the
  data before you discard devices such as cd
• Sanitizing printed media
• Protecting Local storage
• Printer buffers
• Printer output
• X-terminals
• Function keys
• Unattended terminals

15
Story Failed site inspection

• Authors went to consumer product site and found
  following problems
• Fire hazard
• Potential for eavesdropping and data theft
• Easy pickings no tag, security
• Physical access to critical computers
• Possibilities for sabotage
• Do not think you have Nothing to Loose
• You have lot to lose
• Conclusion
• Physical security matters information is very
  important--

16
Part II Security Building BlocksChapter 9
Personnel Security

• We will talk about
• Background Checks
• On the Job
• Departure
• Other people

17
Personal Security

• Personnel Incidents
• Nick Leeson Baring Bank office in Singapore