Chapter Secure Sites Defending Sites and Systems Cobb's Guide to PC & LAN Security, Part 2 of 3 Free Electronic Edition, Creative Commons License, © 1996-2010, Stephen Cobb This chapter deals with hardware-based site and system access controls, covering keys, locks, cards, token-based systems, and biometric authentication. Which of these technologies wdl be appropriate to your needs depends upon the threats that you face, the value of the assets that you are defendmg, and the resources available for that defense. The emphasis is on physical devices for controhng access. In the first in- stance, these are considered in relation to perimeter or site security, which in practi- cal computer-security terms means controlling who is allowed near your systems. Some of the same technology also can be applied to control the use of those sys- tems, allowing or preventing system access. For example, you might have to enter a four-digit access code to enter your office, then insert an ID card into a reader to boot up your personal computer (terms such as ID wdl be defined in a moment). Given the current trend toward system integration in physical security systems, it is conceivable that you would use one card or token to do many things, from entering the parking garage in the morning, opening your office door, booting up your PC and logging onto the company network, buying lunch in the company cafeteria, and checking out of the garage at the end of the day. Securing the Perimeter In chapter 4, I looked at techniques for preventing the theft of computer equipment, whch is an important part of what is calledphysical security. However, physical se- curity also involves regulating who actually uses your computers. Obviously, the in- Secure Sites 217 1. Site access 2. Office access 3. Computer area access B. System admin access Figure 6.1 Diagram of access control. formation on those computers is going to be a lot more secure if you can control who uses them. The security measures employed to accomplish this vary from the obvi- ous and inexpensive to the exotic and expensive. They operate at two levels. First, you need to be able to control who can get near enough to your computers to use them. Then you need to control what anyone who gets close enough can do when they get there (see Figure 6.1). In other words, if you control who can come into the office, you should know all of the potential users. If you further control who can use the computers, you should know who the actual users are. The word "should" is significant in those last two sen- tences for two reasons. First of all, it is important to recognize that access control systems are not 100% effective. Second, the mere fact that you have access controls in place d act as a major deterrent to computer abuse and misuse. The basics of access control Some people credit the Chinese with the first comprehensive access control system. Apparently, around 1000 B.C., the Emperor began to require servants at the Imper- ial Palace to wear rings engraved with intricate designs that identified areas of the palace where they were permitted to enter. The premise of site access control re- mains the same today. organizations of all sizes use such systems to manage access to sensitive areas. The three main functions of access control are: 218 Chapter Six Allowing access to those who are authorized. Denying access to those who are not authorized. Determining who has used access privileges and when. Consider how the most basic access control system, the locked door and key, han- dles these functions. Suppose you are the proprietor of a small business with three employees located in a one-room office that has only one door. You give each em- ployee a key to that door, thus authorizing their access to the office. Access to unau- thorized persons is denied because they don't have keys. You can determine when access privileges have been used by the fact that people are in the office. Clearly there are a lot of gaps in this site access control system, but it might well be entirely adequate for a small organization where there is a high level of trust. The most obvious gap is that you, as proprietor, will have only limited knowledge of who has used their access privileges during those times when you are not in the office. The most obvious way to make the system more restrictive is not to give everyone a key. Persons who are not issued a key then will have conditional access, meaning that they can get in only if someone with a key lets them in or lends them a key. The larger the organization and the more complex the space that it occupies, the less reliable the basic locked-door-and-key system becomes. There are more doors to be locked and additional levels of authorization beyond the simple has-key/doesnlt have-key option. Physical key management, which was discussed in chapter 4, be- comes a serious problem. It gets progressively harder to keep track of who has keys to whch locks. Keys can be borrowed, stolen, lost, and copied. The revoking of access privileges becomes a very serious problem. For these reasons, many organizations use more sophsticated systems, based on keys or other technology. More advanced systems Various technologies have been applied to address the problems cited earlier. These include electromagnetic locks, programmable locks, keypads, electronic tokens, and magnetic stripe cards (see Figure 6.2). Exploring all of these devices in detail is be- yond the scope of this text; however, a brief account of each will help you plan fur- ther investigations if your responsibilities encompass this field of security now or in the future (one of the best places to learn more about these systems and stay in touch with the latest developments is Security Magazine, a monthly publication de- voted to physical security). All of these technologies provide improved key management, and some allow more precise control of access privileges (for example, person X can enter room Y, but not after 6:00 P.M.). Some systems also can track the use of privileges (card nun- ber 21 was used to enter room A at 6:49 A.M.). Some even can report attempted abuse (card number 21 attempted to enter room B after 9 P.M. on three consecutive nights this week). However, it is important to bear in mind that few access control systems actually guarantee the identity of a person using an access privilege. Badges can be borrowed, and numbers can be shared (see the later section on biometrics for ways of solving ths problem). Secure Sites 219 Figure 6.2 A variety of modern keys and cards Electromagnetic locks. An electromagnetic lock, like the one shown in Figure 6.3. can be operated with a conventional key, but circuitg allows the security officer to override the lock to cope with various conditions, such as: No key required during normal business hours Key required to enter on evenings and weekends No access, even with key, on evenings and weekends Key required to enter during business hours Figure 6.3 An electromagnetic lock 220 Chapter Six Electromagnetic locks can be used to prevent exit from certain doors unless it is an emergency and to sound an alarm if the door is used for an exit. These locks can be built to withstand serious attacks. The example in Figure 6.3 has a "holding force" rating of 1650 pounds. Programmable locks and tokens. One of the most common examples of program- mable locks are the ones on hotel room doors that use keys with holes in. The key it- self contains no indication as to which door it operates. The lock on the door can be programmed to accept only those keys with a specific pattern of holes. This allows the management to cancel keys very easily. Several examples of different styles of programmable locks can be seen in Figure 6.4. These locks require a special key that contains a unique identity code stored in ROM. Locks can be programmed to accept and reject keys based on their codes, al- lowing the system manager to cancel specific keys. Note that this type of key does not physically open the lock but is briefly inserted so that it can be read. Ths type of key sometimes is referred to as a token, because it triggers, rather than performs, the opening of the lock. You can increase the security of the system by adding a key- pad. Ths limits entry to persons who have a valid keyltoken and who know the nu- meric pass code. Locks of ths kind can be fitted with memory chips that allow hand-held "interrogation" to download and report recent "transactions," such as which keys were used and when. Keypads. There are considerable advantages to using keyless locks, referred to as keypad systems, such as the one shown in Figure 6.5. These often are seen in retail establishments and high-traffic public access areas. They limit access to people who know the numeric pass code. This code can be changed at anytime, which has the ef- fect of terminating access to those persons who are not informed of the new code. Figure 6.4 Programmable lock Secure Sites 221 Figure 6.5 Keypad entry system. Cards. There are several different technologies that employ an encoded device of credit card proportions, such as the one in Figure 6.6 or those shown earlier in Fig- ure 6.2.