UNIX Computing Security/Physical security

Suggested topics: server room, media storage and network connections.

The physical security of your computing infrastructure is at least as important as the measures that are applied at the software level. Unauthorized individuals gaining access to a server room can intercept network transmissions, cause servers to reboot from inserted media, or perform malicious destruction of your systems and data.

Companies that value their server computing resources will typically place the systems in isolated rooms with carefully managed environments and protections against power outages. Access to server rooms is limited by means of locks that can require combination codes, special digital cards, or biometric devices. The interior can be monitored using surveillance systems, such as ceiling-mounted camera domes. Perimeter defense is provided by building access mechanisms and security personnel.

However not all the computing infrastructure can be protected to this degree. Access to the network and internal servers can be acquired by accessing an office terminal or workstation. Data can be removed or stolen by the theft of a laptop or disk drive. It is also a simple matter to obtain valuable data, then to copy it onto media for easy removal.

Reboot

When an intruder has physical access to a server, they may be able to reboot the system from alternate media. With the system up, they may be able to mount up the file systems on the server and make whatever changes they would like. When the system is rebooted normally, they may have inserted changes that allow unauthorized privileges. Removalable media devices, such as CD-ROM, floppy disk, magnetic tape or USB disks (including USB pen drives) should be removed from the list of bootable devices, or placed after the primary boot device.

If a removable media device is not present, the system can still be booted into single-user mode. If this level has not been protected by a login prompt, the system can be modified with privileges equivalent to root. Vendors will typically implement a Boot Authentication feature only allows authorized users to boot a system to Single-user mode. Boot authentication can take the form of a BIOS supported power-on password or a specialized program, such as the Linux sulogin command which requires a password before granting access in Single-user mode.

More later...