Journal of Physical Security 14(1)
•
0 likes•161 views
This March 2021 issue of the Journal of Physical Security has papers on: • tax credits for physical security R&D • pinhole cameras for surreptitious surveillance • insider threat issues • tamper-indicating seals for fast food in the era of Covid • security for sealed radiological sources Back issues are available for free at https://jps.rbsekurity.com
Recommended
Recommended
More Related Content
More from Roger Johnston
More from Roger Johnston (20)
Recently uploaded
Recently uploaded (20)
Journal of Physical Security 14(1)
- 3. Journal of Physical Security 14(1), i-v (2021) Editor’s Comments Welcome to volume 14, issue 1 of the Journal of Physical Security (JPS). In addition to the usual editor’s rants and news about security that appear immediately below, this issue has papers about R&D tax credits for physical security, pinhole cameras for surreptitious surveillance, insider threat issues, tamper-indicating seals for fast food in the era of Covid, and security for sealed radiological sources. All papers are anonymously peer reviewed unless otherwise noted. We are very grateful indeed to the reviewers who contribute their time and expertise to advance our under- standing of security without receiving recognition or compensation. This is the true sign of a professional! Past issues of JPS are available at http://jps.rbsekurity.com, and you can also sign up there to be notiRied by email when a new issue becomes available. A cumulative table of contents for the years 2004 through 2019 is available at http://rbsekurity.com/ JPSArchives/grand_jps_TOC.pdf JPS is hosted by Right Brain Sekurity (RBS) as a free public service. RBS is a small company devoted to physical security consulting, vulnerability assessments, and R&D (http://rbsekurity.com). As usual, the views expressed in these papers and the editor’s comments are those of the author(s) and should not necessarily be ascribed to their home institution(s), employer, other authors in this issue, or Right Brain Sekurity. ***** Shock and Awe In my view, the January 6 insurrection at the Capitol Building in Washington, D.C. conRirms some general principles about security: 1. Security Maxim #119: Layered security will usually fail stupidly. 3. Security Maxim #80: Warning about threats and especially vulnerabilities will usually be ignored or even attacked. (See also https://www.nbcnews.com/politics/politics-news/ isn-t-Rinal-chapter-analyst-warns-again-about-rise-right-n1253950.) 4. Security Maxim #137: Too often, the good guys think they can deRine the security, when in fact the bad guys get to. It is telling, I believe, to hear how Capitol Police were “shocked” that rioters climbed the “off-limits” Capitol steps after swarming the barriers. i 2. Security Maxim #109: A lack of imagination and effective vulnerability assessment is the most common cause of security failure—the failures in threat analysis, intelligence, management, and communication in this case notwithstanding.
- 21. Journal of Physical Security 14(1), 13-34 (2021) companies will increasingly become reliant on technology to conduct business. Operations with insufYicient protection measures in place continually risk the compromise of critical processes, equipment, and/or data from threats aiming to exploit weaknesses in software, operating systems and hardware. As technology rapidly evolves, the challenges facing businesses in the protection of their network-based assets will become increasingly more difYicult. Thus, cybersecurity will remain a top business priority. Threat Detection Today, it’s not a question of whether an attack against a company’s computer system will occur, but a matter of when. Relying on detection at the edge or only protecting a single node is insufYicient in today’s highly dynamic threat environment. Attack avenues increase as cloud services and multiple data devices are used and equipment are moved into and out of the network. In order to safeguard data, an enterprise must actively institute a detection-in-depth so that attackers will encounter new defenses at every turn. According to Joe Faulhaber4, a Senior Consultant ECG for Microsoft Con.igurations are in constant .lux, hardware is being cycled, software is updating, workloads are moving to the cloud, and users are bringing devices in and out of the network. At the same time, random attacks are entering the system, and there is danger of well-funded, determined external attackers trying to steal valuable data from enterprises as well. Even insiders can be threats, and what an attack looks like can change every day. Thus, detection-in-depth allows the enterprise to increase the probability of detecting an attack, even if one of the layers of defenses has been successfully breached. Detection-in- depth any attack may be achieved by implementing one or more of the following detection methods: Network and Cloud Intrusion Detection that monitors all trafYic into and out of the network or cloud for unauthorized access. These systems have three primary components: o Network Intrusion Detection System (NIDS) that monitors all network trafYic and compares against a library of known attacks o Network Node Intrusion Detection System that monitors a single host in a manner similar to the NIDS o Host Intrusion Detection System that images an entire system’s Yile set and compares it to a previous snapshot. It alerts the administrator to any identiYied differences. Behavior Monitoring This functionality uses machine learning, advanced correlation engine, and/or behavioral biometrics. These methods allow for mapping of the usual threat behaviors such as rootkit installation, attempts for detection of the “sandbox” environment, or 14
- 22. Journal of Physical Security 14(1), 13-34 (2021) attempts to disable security controls. This functionality can be accomplished using the following techniques, among others: o Service and Infrastructure Monitoring detects unexpected service outages throughout the critical infrastructure o Network Protocol Analysis to determine the exploit method used and/or determine what speciYic data was extracted o Network Flow Analysis to identify high-level trends related to the protocols used and bandwidth usage Privilege Escalation Detection – The technique designed to identify when software Ylaws have been exploited in order to gain elevated access to resources that are normally protected from an application or user. It is critical to detect and prevent vertical and horizontal privilege escalation activities as these are generally a precursor to a much more damaging attack to be made later by an attacker. Techniques used to detect privilege escalation include, but are not limited to: o Host Intrusion Detection as previously discussed o File Integrity Monitoring validates the integrity of operating system and application software Yiles by comparing the current Yile state and a known, good baseline. o Attempted Unauthorized User Access Detection o Monitoring SaaS Services such as OfYice 365 or G Suite Event Correlation – A technique that evaluates various occurrences to identify speciYic patterns. This is done by gathering data from the application logs or host logs and analyzing it to identify relationships. Event correlation can be accomplished using the following techniques, among others: o Security Incident and Event Management (SIEM) which is a packaged set of technologies designed to give a holistic view of a network infrastructure. o Malicious Host Communication Detection allows for identifying, isolating, quarantining or blocking potentially dangerous communications that could otherwise exploit your network. o Using a centralized dashboard that prioritizes threats based on user inputs Physical Security – placing access control and intrusion detection devices onto doors, walls, windows and ventilation ducts to computer and server rooms, data centers and other IT-related areas will allow for detection of unauthorized entry. Video surveillance cameras inside these areas and covering exterior doors to those locations will create a visible record of who entered, whether permissive or otherwise. Threat Mitigation Simply because a system is in place with safeguards installed does not mean the system is fully protected as-is from that point forward. Cybersecurity is not a “set it and forget it” environment. Systems that are installed are static, while threats to those systems are 15
- 23. Journal of Physical Security 14(1), 13-34 (2021) constantly evolving. You need to continually assess whether the security solutions in place are still adequate for your needs and determine how to close any newly discovered vulnerabilities uncovered by the assessment. Only in this manner can your systems continue to provide the necessary safeguards against current and evolving threats. The basic means of cybersecurity threat mitigation include, but are certainly not limited to, the following: Risk Assessment is a pro-active, systematic process conducted to evaluate a system, classify the most-likely threats against a system and identify that system’s potential vulnerabilities. This allows an organization to calculate risk and develop a strategy or set of strategies designed to reduce the risk to the lowest acceptable level. Access Control System which secures the network by denying access to a network by non- compliant devices, places them in a quarantine area or restricts their access to the system. According to Cisco Systems5, the general capabilities of a network access control system includes: o ProYiling and visibility to recognize and proYiles users and their devices o Guest networking access to manage guest access o Security posture check to evaluate security-policy compliance o Incidence response which mitigates network threats by enforcing security policies o Bidirectional integration with other security and network solutions o Policy lifecycle management to enforce policies for all operating scenarios Intrusion Detection System to monitor all trafYic into and out of the network as discussed above. Video Surveillance System cameras to overwatch critical systems and access points into controlled or restricted spaces housing IT systems Policies and Procedures – these form the backbone of any organizational effort to reduce or mitigate risk. They demonstrate senior leadership support, outline the issue, deYine acceptable operating criteria and highlight everyone’s roles and responsibilities within the established guidance. Without policies and procedures, organizations simply “wing it” and will Yind it difYicult – if not impossible – to establish the desired risk management, organizational behavior and operating culture. Automated Device Data Wiping – Employ tools that automatically sync to Active Directory or other domain management software to trigger automatic data wiping of exiting employee’s devices. This reduces the risk of the manual wiping process not being completed which would allow the employee to continue to access an organization’s critical information. These accounts must still be manually audited to ensure the accounts were actually deleted and identify and correct system gaps when automated actions do not occur.6 16
- 24. Journal of Physical Security 14(1), 13-34 (2021) Practice Basic Computer/Network Security by following simple, known protocols that include, but are not limited to, the following: Enforcing password policies, which is the most basic method to improve security but is also the hardest to implement. When correctly implemented, strong passwords are secure. However, the requirements to have strong passwords cannot end up placing an undue burden to the computer user. Install patches and software updates to eliminate identiYied vulnerabilities that could be exploited by an attacker. Physical Security/Critical Infrastructure Protection Environment Insider threats to physical security can come from current or former employees, contractors, and trusted business partners, clients and vendors. Once unauthorized physical access is gained into controlled or restricted spaces of an organization, the insider can easily transform the threat from potential to actual and the damage to an organization will begin. Thus, an organization’s physical security controls are equally as important as their IT-based security controls. Insider threats can exploit the physical security in a number of ways, including: Poor Physical Security Environment: This includes: o insufYicient guard oversight o Poor or missing guard post orders or instructions o Unmonitored video surveillance systems o InsufYicient or non-existent physical security system coverage Unauthorized Facility Access: This risk from unauthorized access can manifest itself in a number of forms, such as: o Employees who access facilities without permission before or after standard work hours o Unauthorized employees piggybacking through a door into a controlled or restricted space behind an authorized employee o A former employee whose access rights have not been terminated Physical Property Destruction: Employees breaking into secure spaces, stealing assets or equipment or vandalizing structures or assets In.iltration/Ex.iltration of Physical Property: Activities such as bringing removable assets such as computer equipment, tools and other items either into or out of a facility 17
- 25. Journal of Physical Security 14(1), 13-34 (2021) Custodial Staff Problems: This includes custodial staff who steal assets, documents or who fall victim to socially engineering scams that permit unauthorized physical access rights Threat Detection The two most important active physical security system components that can be used to detect an insider threat are an organization’s security personnel and its physical security technology: Security Personnel o Properly written post orders will provide the guidance necessary for security personnel to respond to any security incident or emergency. o Regular or unpredictable patrols of controlled or restricted areas should be conducted to determine whether unauthorized access has occurred and to respond to incidents detected by security technology. o Security Investigations conducted by specialist personnel with the proper capabilities who look for insider threat indicators so they can stop, or at least interrupt, an insider threat before the damage can be done. Security Technology o Access Control by designating public, controlled and restricted spaces each with their own levels of physical security protection measures o Intrusion Detection sensors and alarms to detect unauthorized entry into a physical location that are controlled or restricted o Video Surveillance provides an overwatch of all areas to detect potential threats o Alert and Noti.ication alarms issued by security technology must be transmitted to the proper personnel for immediate assessment and response, as necessary Threat Mitigation Mitigation efforts center around minimizing the amount of damage that can be done by an inside threat. This is mainly accomplished through understanding the existing vulnerabilities, training employees to understand the damage that can be done by an insider while policies and procedures outline roles and responsibilities, reporting procedures as well as proscribed penalties for violating established protocols. These methods include: Security Risk Assessment outlines existing security conditions, identiYies vulnerabilities and provides a list of measures designed to allow security personnel to develop a comprehensive strategy designed to reduce the organization’s overall risk. Security Awareness – training all employees through messages, emails, broadcasts and computer-based training sessions. Fostering a security culture that includes a high 18
- 27. Journal of Physical Security 14(1), 13-34 (2021) o Changes in overall work performance (i.e., tardiness, absenteeism, increased error rates in work performed, etc.) o Taking more sick days or staying away from work longer than expected after an illness o Changes in social behavior to include conYlict with some regular coworkers or the complete avoidance of others o Neglect of personal hygiene can indicate a depressed state of mind o Expressions of desperation or suicidal ideation Threat Mitigation Given the growing threat to business operations posed by workplace violence, mitigation efforts to minimize the incidence and impact of workplace violence require both management commitment and employee involvement. These mitigation efforts can take many forms, including: Policies and Procedures Policies and procedures form the backbone of any effort to mitigate risk within an organization. The following procedures and policies should be developed and implemented, at a minimum: Emergency Action Plan13 which contains an evacuation plan covering drills for Hostile Intruder and Safe Room Procedures (as applicable). Visitor Protocol Policy that includes access control for former employees and spouses. Domestic Violence Policy – must ensure employees know what services are offered by the organization. Workplace Violence Prevention Policy - reviewed, updated and reissued to all employees annually and includes a “Zero Tolerance” attitude toward workplace violence. Harassment Policy Statement which is reviewed, updated and reissued to all employees annually and includes a “Zero Tolerance” attitude toward harassment of any kind. Training • Implement or update a New Employee Orientation to include training on Workplace Violence Policy, Procedures and Guidelines. • Teach employees to recognize the potential warning signs of workplace violence. These may include, but are not limited to: 20
- 28. Journal of Physical Security 14(1), 13-34 (2021) o Paranoia o Excessive use of Substances and/or alcohol o Unexplained absenteeism, change in behavior or decline in work performance o Depression, withdrawal or suicidal comments o Resistance to changes at work or persistent complaining about unfair treatment o Violation of company policies o Emotional response to criticism or major mood swings • Educate supervisors about their responsibility to thoroughly report, document and investigate every complaint. • Train employees that reporting at-risk situations is their responsibility in emphasizing their value. Assessments • Conduct a workplace assessment by visual observation by in-house or impartial third-party observers and issue an employee questionnaire to aid in identifying potential hazards. • Review recent incidents to identify potential gaps in existing Violence Response Plan. • Assess the most-recent full emergency evacuation drill, and determine if the organization is prepared for chemical, weather, Yire, bomb or hostile intruder threats. Human Capital Development • Personnel Background Screening • Employee Onboarding Training • Situational Awareness Training • Threat Reporting Program • Policies, Procedures and Guidelines • HR Grievance Process • HR ConYlict Resolution Mechanisms Sensitive Information/Controlled UnclassiHied Information Environment Sensitive information is any information that, if released, could result in a loss of advantage over competitors. The unauthorized release of sensitive information could adversely affect the organization, its suppliers and customers and could negatively impact the welfare of its employees. Similarly, Controlled UnclassiYied Information is a category of unclassiYied information that require additional controls to prevent unauthorized release. 21
- 34. Journal of Physical Security 14(1), 13-34 (2021) ▪ Mixing and similar activities Three Fundamental Elements Method ▪ Potential public health impact ▪ Degree of physical access to the product ▪ Ability of an attacker to successfully contaminate the product Hybrid Approach Method that combines the previous two methods CARVER + SHOCK19 - This methodology was created by the military and is applied primarily to the agriculture and food production sectors. CARVER stands for Criticality, Accessibility, Recuperability, Vulnerability, Effect and Recognizability. SHOCK is the combined assessment of the health, psychological, and collateral national-level economic impacts of a successful attack on the target system. Facility-wide Security Measures – the general security measures taken to protect personnel, product, the facility and its associated machinery and utilities Physical Security – as previously discussed above Cyber Security – as previously discussed above Substance Abuse Environment Substance abuse is the overuse of, or dependence upon, addictive substances. Most often, these substances are drugs, alcohol, or both. The losses estimated to substance abuse is simply astonishing: $81 billion in lost proYits annually, while an additional $25 to $53 billion in lost productivity is due to opioid abuse alone.20 Besides the hammering of the bottom line, the problems substance abuse can present to an organization can be further summarized as: Substance use and abuse are potential precursors to insider threat. They could lead to concerning behaviors and both criminal and non-criminal acts against an organization. Insider incidents may include theft of intellectual property, sabotage, espionage, fraud, workplace violence, and non-malicious, accidental incidents. In these instances, insiders may commit malicious acts in order to procure money to support their habits or addictions or, due to the effects of the substances on their behavior, may commit acts of workplace violence. Substance use and abuse may also impact an insider's cognitive abilities, leading to unintentional insider threats. These unintentional acts 27
- 35. Journal of Physical Security 14(1), 13-34 (2021) might include being more likely to click on phishing emails or misplace company equipment.21 There are a number of avenues in which substance abuse can negatively impact a business and its operations. A few, but not all, are listed below: Poor Decision-Making (negligence) which can possibly lead to either the unintentional, non-malicious compromise of an organization’s data or the willful exposure of the data to external actors exploiting the Substance user’s vulnerability. Theft of Assets or Data from an organization in order to sell to support the abuser’s dependency Increased Likelihood of Trouble with coworkers or supervisors, which could potentially develop into a workplace violence situation. Potential Exploitation of the worker’s known substance abuse by an external actor in order to gain access to an organization’s systems, processes or data. Threat Detection Substance abuse can lead to other insider risks as described in this paper. Rather than let the situation spiral out of control to a point where you will be liable for injury, damages, and losses for failing to act, it is best to adopt a pro-active approach. This approach must be performed within an environment that does not present itself as being overtly hostile to the employee, which could trigger a negative response or reaction. Two primary methods that can be employed to detect substance abuse in the workplace are: Direct Observation of behavior by supervisors and coworkers can give rise to suspicions of substance abuse: o Observe an employee’s actions and behaviors for indications of impairment o Document the employee’s behavior, signs, and symptoms for reference o Employ “Reasonable Suspicion Testing” to determine that substance abuse is not the cause of an employee’s suspicious behavior or appearance. Potentially Disruptive Behavior Monitoring: o Badge records for tardiness o Web searches related to alleviating the effects of withdrawal and procuring substances o Within the bounds of legal permissibility, gather information about past arrests and Yinancial stressors potentially resulting from substance abuse o Gather information from HR that could provide recent information on disciplinary actions, security violations and substance abuse test results (the latter, if permitted) 28
- 37. Journal of Physical Security 14(1), 13-34 (2021) Theft of payroll resulting in payment for unearned time and reimbursement for non- existent business expenses. This can be the result of other factors already listed, such as substance abuse. Fraud is much more prevalent in small Yirms (i.e., those with under 100 employees) than larger ones.23. Types of fraud can include: o Asset Misappropriation o Vendor fraud o Accounting fraud o Data theft o Bribery o Payroll Fraud Threat Detection You trust employees with the keys to your business. Sometimes, that trust is betrayed for one reason or another. Methods than can detect that betrayal and uncover employee criminal activity is surprisingly simple, provided you are paying attention. Such detection methods can include, at a minimum: Direct Observation which can often lead to the discovery of employee criminal activity in the workplace. This can include noticing an employee living well beyond his or her means (a possible indicator of fraud), frequent tips or complaints about an employee, or even event correlation of an employee being a constant in time and place of criminal activity Execute Inventory Control and Audits in an impromptu manner using a third-party for objectivity. This auditing Yirm must have a direct reporting line to senior executives and key decision-makers. This include using an outside accountant to examine key Yinancial records: bank records, ledgers and checks. Conduct inventory audits to ensure irregularities or losses are discovered and thoroughly investigated. Establish a Trash Removal Routine that includes breaking down and Ylattening of all boxes, using clear trash bags and ensuring one-way access for employees to trash dumpsters or compactors. Cover trash dumpsters with video surveillance system cameras. Conduct and Document Thorough Investigations of all employee theft reports. The importance of this method cannot be stressed enough. Threat Mitigation Therefore, mitigating criminal activity in the workplace isn’t simply a good idea, it’s an absolute requirement. 30
- 38. Journal of Physical Security 14(1), 13-34 (2021) Establish the proper kind of company culture where employees are engaged and are permitted to report security violations. If employees see a culture in which criminal activities are permitted, then crime will Ylourish. Creating the proper culture starts with, but is deYinitely not limited to, the following: • Provide clear policies that ensure all employees know there will be strict consequences for anyone who commits a crime. Having employees sign the policy annually both impresses upon them the importance the company attaches to the policy and also reinforces in their minds exactly what will happen if they choose to steal from the company. • Create a con.idential employee tip line to allow loyal employees to report their concerns. Follow up on each report • Mandatory employee and contractor background checks to include past employers. Contact all professional references and ask why they left the job. Conduct criminal history checks and do not gloss over any “red Ylags” that appear. • Employee Situational Awareness Training where everyone is reminded to lock up their vehicles, valuables, and personal effects while in the ofYice and to practice personal safety and security measures at all times. Use a Security Management System that allows for reporting and tracking security incidents, managing risks, monitoring the status of security equipment and identify gaps in equipment coverage. Put in and Monitor a Video Surveillance System to discourage negative behavior before it happens and record risky behavior as it happens. Install Access Control Systems to allow access to employees based on work schedule while simultaneously prohibiting unauthorized access. Set up Intrusion Detection Systems on doors to controlled or restricted spaces to alert security personnel of unauthorized entry. Conclusion An insider is someone within an organization who has access to critical data, assets, information and even personnel. The threat arises when someone with privileged access negligently or willfully violates the trust an organization has placed in them, whether by themselves or in concert with an outsider. T hese insider threats can come in many forms, 31