UNITED STATES CERT COORDINATION CENTER Allow only appropriate physical access to computers

Allow only appropriate physical access to computers.
In addition to the steps you take to prevent inappropriate electronic access to a computer, you should also strive to allow only appropriate physical access. What this means can vary depending on the locations of computers—whether they are in locked offices or in open-plan space, for example.

Physical access also includes activities such as installing or removing hardware.

Why this is important
If unauthorized persons can physically access a computer, the integrity of that system is at considerable risk. If a system is connected to internal networks, then intruders can access resources in a way that bypasses all of your network perimeter defenses.

To preserve the confidentiality and availability of data, you must prevent the computer and its storage media from being removed from the facility by unauthorized persons.

If new hardware, such as a modem, is installed it may create new electronic access paths to the computer and make your network available to intruders.

How to do it
Prevent installation of unauthorized hardware and modification of authorized hardware.
Installation of new hardware can lead to security problems in several ways:


Installing a modem allows a direct connection from the computer to the public telephone network, which may then permit electronic access into your network from anywhere in the world, bypassing your perimeter defenses.

Installing a removable-media storage device or printer makes it easy to copy information and carry it away from your site.

Installing a boot device that precedes the authorized device in the boot sequence allows the computer to be restarted in a configuration that bypasses your security precautions.
You should lock the computer case, if possible. This may require third-party locking devices such as keys, cables, or racks. If a key is used, ensure that the key is protected, yet still accessible to authorized users. Make a backup key and protect it in a secure offsite location.

You may also want to remove or disable the external connectors on the computer.

Deploy the computer in a secure facility.

Deploying the computer in a secure facility helps to prevent unauthorized access to the computer, theft, and destruction. Methods of secure deployment may include using surveillance cameras or placing the computer in a locked room that uses controlled physical or electronic access which is recorded. Pay special attention to controlling the access of vendors, contractors, and other visitors.

As a general rule, do not deploy network servers in an individual's office.

Locate the computer so unauthorized viewing of the monitor and keyboard cannot occur.

Provide additional shielding against electronic eavesdropping or interference, if required.

Secure the network wiring and other network connection components.

For security purposes, ensure that the network cabling is not placed in a physical location where it can be easily accessed. Note that this requires you to trade the convenience of access for network maintenance for greater security.

Policy considerations
Your organization's security policy for networked systems should


specify who is or is not allowed to install new hardware or modify existing hardware in a computer

specify the circumstances under which users may or may not use storage devices with removable media

specify the circumstances under which users may take storage media or printed information away from your site

require that network servers be deployed in physically secure locations

specify the circumstances under which third parties (vendors, service providers) are permitted to physically access your systems and how such access is to occur. 1
Other information
If you need to protect against unauthorized monitoring, eavesdropping, or interference of electronic emanations coming from your computing equipment, you may need to consider physical protection technologies such as TEMPEST (Transient Electromagnetic Pulse Emanation Standard). Refer to http://www.dewsite.com/fyeo/tempest.html#Government and http://www.eskimo.com/~joelm/tempest.html for further information on TEMPEST.



--------------------------------------------------------------------------------

Footnotes
1 Refer to the module Security of Information Technology Service Contracts [Allen 98].


[back to top] [full list of modules, practices, and implementations]


--------------------------------------------------------------------------------
Copyright 2000 Carnegie Mellon University.

See the conditions for use, disclaimers, and copyright information.

CERT® and CERT Coordination Center® are registered in the U.S. Patent and Trademark office.
This page was last updated on June 12, 2000.