# data[].attributes.body
Security is normally detailed when it comes to internally protecting data, but when a criminal can get their hands on the hardware or software it can easily become compromised.  This article explains the common occurrences of criminals to go where the money flows.  ATMs were picklocked, causing money to spew, getting drilled into to add a USB that would encrypt malware and even having fake face fronts on them with skimmers.  Registers get skimmers put on them as soon as an employee turns their back.  All of these happen when a criminal has the opportunity.
All to often people do not check for skimmers or expect ATMs to contain malware. We trust that the place of business is actively protecting our information. Sadly that is not true. Busy store clerks are to distracted and/or can not see every gas pump to prevent criminals from tampering with devices and security camera do not prevent thief if there is no one actively watching. While ATMs placed in the open, though convenient to access, are subject to compromise. A plan will need to be set in place to provide physical security for such device that relies less on the human element.
Some of these breaches could have been prevented through physical access security. Malware injection through the use of device's disk drives and USB ports could have been prevented by disabling those ports after they were no longer needed for setup. Preventing other breaches require people to change their habits. ATM skimmers can be avoided by using ATMs located inside banks themselves, and avoiding private remote ones. Employees have to be trained to be vigilant for people trying to get them away from registers and card skimmers.

# data[].attributes.attachment_link.readable_text
Security experts spend a lot of time thinking about how to beef up defenses to deter attackers. That means implementing advanced firewalls to prevent and protect against SQL injection attacks, or upgrading cryptography to maintain safer communications.

IT pros, however, tend not to spend as much time pondering whether physical access to a computer system is locked down. And that is a bit of a shame, considering the experts, more than anyone, should know how easy it is for a crafty hacker to compromise a device once they have their hands on it.

"Whenever an attacker has physical access to a computer, safeguarding that system is much more difficult," Ryan Linn, managing consultant at Trustwave, said. He pointed out that this is particularly true of money machines, such as ATMs and point-of-sale (POS) devices.

Last year was rife with these types of physical compromises. In October, attackers in Mexico were causing ATMs to spit out cash after they picked locks protecting CD-ROM drives and uploaded financial malware via compact disc.

In December, researchers exposed an operation in Europe in which criminals bored through ATM casings to reveal USB ports. They then concealed the holes after compromising the machines with financial malware uploaded via thumb drives.

Also in December, Brazilian authorities in São Paulo removed the front of a sham ATM and uncovered a real one behind it. The fake was rigged with a working monitor so it looked authentic, but the shell actually contained skimmers and other recording devices.

"Criminals tend to follow the money and ATMs are full of cash," Linn said. But physical compromise of digital technologies is not limited to ATMs.

In October, a group of men in Florida entered a Nordstrom store, distracted the staff and proceeded to plant skimming devices and keyloggers on registers. And just days after ringing in the New Year, a crook posing as a worker at a Chinese buffet stole customer card information using a skimming device.

"The criminals are getting more sophisticated and these types of attacks highlight the change in approach," Linn said.

Core digital defenses continue to be a prime focus because of how many effective attacks are carried out remotely, but serious crooks will always seek to exploit weaknesses - and physical security is one such weakness.

From the February 03, 2014 Issue of SC Media

# data[].attributes.attachment_link.title
Physical security in the digital realm | SC Media

# data[].attributes.attachment_link.description
IT pros tend not to spend much time pondering whether physical access to a computer system is locked down.

# data[].attributes.body
This conflict can be attributed to differing priorities, it may be exacerbated by factors such as competition for limited resources, increasing demands for assurance and in some cases, business instability.

# data[].attributes.attachment_link.readable_text
Information security and physical security are frequently viewed as either conflicting or as far removed from one another as the sun is from the moon.

It is generally accepted that physical security is concerned with the protection of physical assets such as the facility and the people, whereas information security is solely concerned with the protection of information. This would include intellectual property of the organization as well as the supporting data.

With this being the case, it is not unusual to hear an IT wizard declaring that the physical security group "Should be required to have a clue!" or a physical security expert claiming "The IT people just don't get it!" However, the two groups can usually agree about having a lock on the server room door.

Although this conflict can be attributed to differing priorities, it may be exacerbated by factors such as competition for limited resources, increasing demands for assurance and in some cases, business instability.

The 2001 Information Security Industry Survey showed a disturbing shift. As expected, more companies spent more than $1 million annually for security of their information. The unsettling news is that there was also a 20 percent increase in companies that decided to spend less that $100,000. The security budgets of 29 percent of the respondents had been cut or frozen and of those, only 24 percent were ever restored to their original funding levels.

This impacts the organization well beyond the information security department. In order to illustrate this, let's go back to basics and look at what security really is.

Security is a very broad field that touches every aspect of a business, from business continuity planning to liability of the organizational entity as well as its senior management. The field is usually divided into approximately 10 interrelated and interdependent domains. Each domain is concerned with applying controls to some aspect of the business. The unifying principle throughout the domains is controlling access to assets in such a way that the confidentiality, integrity and/or availability of the asset are protected. In the case of confidentiality, this would mean controlling people, programs or processes that have access to sensitive information. For integrity, it is controlling people, programs and processes that can modify the data, and for availability, it is controlling which people, programs and processes can use the asset and for what period of time.

With this clearly stated, it becomes obvious that information security and physical security may have different foci, but the same mission: controlling access to organizational assets. This mission dictates that both physical and information security groups put aside their differences and work together to enhance overall security. Composing a standard defense-in-depth or layered security strategy, familiar to both groups, can do this. However, to make it both more effective and efficient than usual, it should be composed of elements of both disciplines, selected to complement each other. Each layer in the defense should have controls that are designed to prevent security breaches, detect breaches (in real-time if possible) and respond in an appropriate manner. In some situations, such as transaction processing, it is also important to have corrective controls in place.

Physical security is the foundation of many of the other security domains, including information security. If it is weak that weakness will become a vulnerability in the information security. For example, consider an organization where the information security is very well implemented. One of the controls is that changes to the system can only be made from the console inside the server room. Suppose, due to a physical security weakness, an intruder could gain access to the console and from there compromise the system and get sensitive information. In this case, despite the technical network controls, there was vulnerability due to the physical security breach.

Other concerns include not only the theft of equipment, but also the search for technical vulnerabilities through physical means. This might include dumpster diving to gain contact lists, proprietary information and passwords. Social engineering is also a typically successful approach to bypassing information security controls. In our last example, the control (passwords) was in place, but it had been poorly implemented. Poor implementation is a weakness in any type of security. Controls must be applied consistently and according to an overall plan that is in accordance with the organizational security policy.

The security policy is the architecture upon which the entire security of the organization depends. It provides the blueprint for selecting appropriate controls, as well as the framework for their implementation. Without a comprehensive policy (or the heroic efforts of a few globally oriented individuals) security will continue to be implemented by domain, thus leaving huge vulnerabilities.

The creation of a sound policy is the responsibility of senior management. This is a step in showing 'due care' and in meeting the legal and regulatory responsibilities concerning data integrity, confidentiality and privacy. This also demonstrates management support for security, avoiding situations such as those that spawned the listing of "the lack of management support" as one of the top three obstacles to effective security in the 2001 Information Security Industry Survey. The policy also sets the stage for security professionals to apply their expertise in protecting organizational assets. When implemented n such a way as to integrate security specialties, the policy will allow for a security organization that will be more effective and make the most of available resources and budgets. A well-written policy will identify the roles and responsibilities of both the physical security team and the information security team.

Even the most well written policy coupled with enthusiastic and collaborative security experts may not be sufficient to protect organizational assets from even a single untrained or unaware individual. It is critical that organizations provide security awareness for their employees. Unfortunately this method of risk mitigation has fallen by the wayside, as organizations have increasingly chosen to spend their training budgets exclusively on training for discrete skills, such as application training or programming skills, and have eliminated the internal security training that taught employees organizational awareness, specific concerns, procedures and solutions. This type of training was intended as a way of reducing unintentional security breaches and bypasses, which resulted in a cost-effective strategy of risk avoidance.

With user education and sound policies to create the framework, physical and information security can interleave skills and controls to form effective, repeatable and consistent security for business assets throughout the organization.

Thresa Lang is a security and training consultant, who also teaches information systems protection at the George Washington University. She is a Cisco Certified Network Associate (CCNA), a systems analyst and a CISSP instructor.

# data[].attributes.attachment_link.title
When Worlds Collide: Physical and Information Security | SC Media

# data[].attributes.attachment_link.description
Information security and physical security are frequently viewed as either conflicting or as far removed from one another as the sun is from the moon.

# data[].attributes.headline
Group 6 (Jeff Kirby, Jared Futral & Josh Degen

# data[].attributes.subject
Group 6 (Jeff Kirby, Jared Futral & Josh Degen

# data[].attributes.body
IT security professional tend to focus more on securing data and devices with software and and neglect restricintg the physical access to a device. After all, a system can be compromised much more easily when hackers have physical access to a device. Attacks involving targeted physical access to a device to gain access to a system are extremely common with ATMs and POS devices. Examples include gaining access to ATM's CD-drive or USB ports to upload  financial malware.

# data[].attributes.attachment_link.readable_text
Security experts spend a lot of time thinking about how to beef up defenses to deter attackers. That means implementing advanced firewalls to prevent and protect against SQL injection attacks, or upgrading cryptography to maintain safer communications.

IT pros, however, tend not to spend as much time pondering whether physical access to a computer system is locked down. And that is a bit of a shame, considering the experts, more than anyone, should know how easy it is for a crafty hacker to compromise a device once they have their hands on it.

"Whenever an attacker has physical access to a computer, safeguarding that system is much more difficult," Ryan Linn, managing consultant at Trustwave, said. He pointed out that this is particularly true of money machines, such as ATMs and point-of-sale (POS) devices.

Last year was rife with these types of physical compromises. In October, attackers in Mexico were causing ATMs to spit out cash after they picked locks protecting CD-ROM drives and uploaded financial malware via compact disc.

In December, researchers exposed an operation in Europe in which criminals bored through ATM casings to reveal USB ports. They then concealed the holes after compromising the machines with financial malware uploaded via thumb drives.

Also in December, Brazilian authorities in São Paulo removed the front of a sham ATM and uncovered a real one behind it. The fake was rigged with a working monitor so it looked authentic, but the shell actually contained skimmers and other recording devices.

"Criminals tend to follow the money and ATMs are full of cash," Linn said. But physical compromise of digital technologies is not limited to ATMs.

In October, a group of men in Florida entered a Nordstrom store, distracted the staff and proceeded to plant skimming devices and keyloggers on registers. And just days after ringing in the New Year, a crook posing as a worker at a Chinese buffet stole customer card information using a skimming device.

"The criminals are getting more sophisticated and these types of attacks highlight the change in approach," Linn said.

Core digital defenses continue to be a prime focus because of how many effective attacks are carried out remotely, but serious crooks will always seek to exploit weaknesses - and physical security is one such weakness.

From the February 03, 2014 Issue of SC Media

# data[].attributes.attachment_link.title
Physical security in the digital realm | SC Media

# data[].attributes.attachment_link.description
IT pros tend not to spend much time pondering whether physical access to a computer system is locked down.

# data[].attributes.body
the Apple iOS 12 update shows us that sometimes things happen and because of an update there are potential breaches even if it isn’t the most sensitive data like bank accounts, photos are still personal attachments for most people. There are plenty of ways to preemptly protect yourself from such things as this particular situation but the best way to yours from this situation is to invest in apps that store photos such as google photos or Microsoft OneDrive. These apps are free and save photos immediately after they are taken to free up space for phones. This method prevents photos from being in your gallery to be shown.  The easiest option is to just disable Siri. As for physical security you’d want to keep your iPhone on you at all times until the next update/patch which isn’t always possible but buying phone clips for your phone will be safely tucked on what ever you clip it on unless it's forcefully stolen but if it is, if you follow the previous suggestions of investing in apps and disabling Siri your contacts and photos will be safe.

# data[].attributes.attachment_link.readable_text
An oversight in Apple's iOS 12 allows unauthorized users to bypass the device's passcode exposing their photos and contacts, a researcher reported.

Independent researcher Jose Rodriguez posted a demonstration in a Spanish-language YouTube video revealing how an attacker with physical access to a user's device could partially unlock the person's content as long as Siri is enabled and Face ID is either disabled or physically covered.

While the procedure is somewhat complex and involves more than 30 steps, a dedicated attacker could easily exploit a device running iOS 12 or higher by using Siri to enable voiceover, using another device to call the target device and going to messages. An English version of the attack demonstration is also available.

The attacker must then go through a series of swipes while listening for audio cues from Siri until they are ultimately able to ultimately scroll through photos and see contacts on the device.

Those who fear their device may be vulnerable to this and other attacks can increase their security by disabling Siri from the lock screen by going into Settings/Touch ID & Passcode, scrolling down to the "Allow access when locked" section and ensuring that Siri is disabled.

# data[].attributes.attachment_link.title
Apple iOS 12 passcode bypass allows unauthenticated access to iPhone features | SC Media

# data[].attributes.attachment_link.description
An oversight in Apple's iOS 12 updates allows unauthorized users to bypass the device's passcode exposing their photos and contacts.

# data[].attributes.body
https://www.scmagazine.com/home/network-security/orlando-airport-all-in-on-facial-recognition-security-screening/

The linked article details how Customs and Border Protection is pursuing bio-metric scanning as a compliment to and hopeful replacement of current airport security procedures. While the article states that the service boasts a success rate of over 99%, there is no shortage of evidence showing that security initiatives at our airports have failed to meet their goals.

This, coupled with increasing concerns for privacy, may leave many skeptical about the feasibility of bio-metric scanning as a security practice within airports.

# data[].attributes.headline
Dire data destruction creates security nightmare. Group 2

# data[].attributes.subject
Dire data destruction creates security nightmare. Group 2

# data[].attributes.body
This article is about how organizations sell their computers without deleting its data properly.
" companies are not fulfilling statutory obligations under such acts as the DPA or Sarbanes-Oxley-Oxley and Gramm-Leach-Bliley”. https://www.scmagazine.com/home/security-news/dire-data-destruction-creates-security-nightmare/

# data[].attributes.body
A lack of physical security can steamroll into an even more serious threat.  In this article you will read how a simple theft in today's information heavy world can impact a large group of people.

# data[].attributes.attachment_link.readable_text
The office of a dentist in California, Cathrine Steinborn, was burglarized and a server containing patient and responsible party information - including Social Security numbers - was stolen.

How many victims? Undisclosed.

What type of personal information? Names, addresses, dates of birth, telephone numbers, Social Security numbers, dental and/or medical insurance information, health background information, treatment information, and billing information.

What happened? The office of Cathrine Steinborn, a California dentist, was burglarized and a server containing the personal information was stolen.

What was the response? The burglary was reported to the police, and an investigation is ongoing. The office has increased physical security and surveillance on premises. The office has encrypted patient and responsible party information, and enhanced physical security of the server on which the information is stored. All impacted individuals are being notified, and offered a free year of credit monitoring and identity restoration services.

Details: The office was burglarized on Jan. 5. Steinborn is unaware of any actual or attempted misuse of the information stored on the server. The server did not contain bank account, driver's license or credit and debit card information.

Source: cathrinesteinborn.com, " California Dentist Provides Public Notice of Data Security Incident," Feb. 20, 2015.

# data[].attributes.attachment_link.title
California dentist announces theft of server containing patient information | SC Media

# data[].attributes.attachment_link.description
The office of a dentist in California, Cathrine Steinborn, was burglarized and a server containing patient and responsible party information - including Social Security numbers - was stolen. How many victims? Undisclosed. What type of personal information? Names, addresses, dates of birth, telephone numbers, Social Security numbers, dental and/or medical insurance information, health background information, treatment information, and billing information.

# data[].attributes.body
Congress is investigating the validity of accusations that Super Micro's server boards were compromised . The original allegations were that individuals associated with the Chinese government were able to embed disguised hardware that would allow backdoor access on server boards destined for Apple, the US government and many others. The fact that the accusations were lodged in the first place is giving the industry pause and causing people to rethink their security when it comes to supply chain attacks that would involve physical breaches to enable corporate and government espionage.

https://www.scmagazine.com/home/security-news/yes-or-no-did-china-physically-hack-supermicro-computers/