True or false: cyber security starts and ends with traditional IT such as PCs, smartphones, laptops, and network hardware?
False.
In this age of WiFi, 4/5G, mesh networks, Bluetooth, and so on, there are bits and bytes flying all around us at any given moment. These technologies provide the ultimate in modern convenience – but they also mean that the line between cyber security and physical security is getting blurrier by the day.
So, what risks might be lurking on the airwaves at any given time? How can businesses acknowledge and mitigate those risks? What exactly is “penetration testing” and its close cousin “physical penetration testing?” Let’s get those definitions out of the way first…
What is Penetration Testing?
Penetration testing, or “pentesting” for short, is where an authorised cybersecurity expert launches a simulated cyber attack against a network, data store, or computer system in an attempt to uncover exploitable weak spots in that system’s cyber defences. By using the same infiltration methods as the bad guys, a pentester is able to uncover precisely where and how the target system is vulnerable. They can then advise those using that system where their cyber weaknesses lie and how to remedy them before someone more nefarious finds them.
What is Physical Penetration Testing?
Not all penetration testing involves simply sitting in an office, miles away, trying to remotely infiltrate a system with long screeds of Matrix-style code. Criminals increasingly lean on softer attack vectors like social engineering in order to get their way.
Social engineering isn’t just limited to fraudulent phishing and vishing attacks. Particularly brazen cybercriminals may turn up in person to carry out their evil misdeeds. They may hang around in your car park, in range of your WiFi, trying to infiltrate your systems that way. They may even use social engineering tactics to try and gain physical access to your premises.
Physical penetration testing is, therefore, where an ethical pentester tries to access some element of your physical premises, systems, employees, and infrastructure in order to test those systems for cybersecurity weak points.
3 ways physical security meets cyber security:
1. WiFi – What is WiFi and what is it used for?
We’re all intimately familiar with WiFi by now, but let’s take a moment to explore the technicalities. WiFi, short for Wireless Fidelity, is a technology that allows devices like PCs, laptops, smartphones, et al. to form a high speed, internet enabled network without having to worry about plugging into an Ethernet network port.
Wireless networks need a central hub – such as a WiFi access point (AP) or router – in order to operate. Any WiFi device within range (and with the WiFi network’s password, if present) will be able to connect to the network in question. WiFi’s physical range can depend on a number of factors but in optimal conditions and with recent technology, an access point’s signal can reach over 50 metres!
What are the cyber risks of WiFi?
WiFi is incredibly convenient, but there is a security trade-off to consider. Our colleagues at Just Firewalls explored the problems with WiFi security in far more detail than we will here, but let’s briefly echo a couple of their points.
WiFi is merely a technology for moving data around – it doesn’t include any ingrained security measures that protect its users. This is why cyber security experts advise caution when using public networks like those in cafes or hotels – because you don’t know that organisation’s level of cyber security, and you don’t know who could be listening in.
Cyber criminals can sometimes introduce an “evil twin” access point that appears as a duplicate of your network’s own WiFi network, but allows the criminal to harvest all of the data that flows through. Some network users may connect to this duplicate network in error – allowing the criminal to listen in on communications, steal login credentials, introduce vulnerabilities into the network, and more.
Hardware added without the IT department’s explicit approval or oversight (called “shadow IT”) can also cause an issue. Wireless access points installed without the right security measures can act as woefully under-defended points of ingress for hackers.
Learn More Here: 7 Enterprise Wi-Fi Risks You Need to Know About Today
How to Stay Safe Using WiFi?
- There are specialist Intrusion Prevention Systems developed for WiFi networks, imaginatively called Wireless Intrusion Prevention Systems. These systems monitor the radio waves for unauthorised frequencies and unexpected activity, and can effectively shut down anything suspicious.
- Cybersecurity training is a must for any organisation, and should include practical instructions that help your team use WiFi-enabled technologies securely.
- Thorough penetration testing can shed light on areas where your WiFi defences may be weak, therefore informing how you can tighten your wireless network security in future.
2. RFID
What is RFID & what is it used for?
RFID or Radio Frequency Identification is a contactless technology that allows any item with an embedded RFID chip to be identified with the right reader. RFID technology is commonly used in physical access cards and fobs; in credit/debit cards for payment; pets’ ID chips; for asset and inventory tracking; and even in passports.
When an RFID chip (embedded in a card or document) is passed within range of an appropriate reader, this powers the chip on, causing it to identify itself and be read. The physical range at which the chip can be read depends on the tech in question. Some RFID systems require the chip and the reader to be less than a metre from each other, but some systems with battery-powered chips can read up to 100m!
What are the cyber risks of RFID?
With the right equipment, it’s possible for a criminal to lurk within a card reader’s radius, eavesdrop on successful scans, and effectively replay that information to the reader to gain entry to a premises. Similarly, and with the right gadgets, it’s possible to simply stand near someone with a RFID card on them and clone it.
Though more recent RFID technology is encoded and encrypted in such a way as to minimise these risks, it’s unlikely that all organisations using RFID for their access control are using the latest technology. Probably far from it. This gets quite scary when you think about the kind of premises that use RFID technology for physical access control: hotel rooms, hospitals, care homes, nurseries – it doesn’t bear thinking about.
But when a card comes to the end of its usable life, that’s not to say that the risk goes away. RFID chips need to be properly destroyed before they can be discarded – you never know who might fish a sensitive access card out of the bin! Even shredding the card doesn’t guarantee that it’s no longer usable.
However, rather reassuringly, RFID crime relating to payment cards is practically non-existent. It’s much easier for criminals to get their hands on card details in other ways.
How to stay safe using RFID?
- Ensure that your RFID systems are using the latest encryption and encoding technology available to you. The more RFID advances, the more strides are being made in keeping cards and scans safe from criminal activity.
- Be aware of the risks inherent in the RFID tech you use and train card/device holders on proper security measures. If you’re particularly concerned, provide your team with RFID blocking wallets to keep their RFID cards/documents secure when they’re out and about.
- Set up a physical penetration testing arrangement with a cybersecurity firm to find where your current defences may be letting you down.
- When a card needs to be retired, don’t just chop it in half and chuck it in the bin. Invest in reliable, secure RFID card destruction services… like ours! Got some old RFID cards that need destroying? Get in touch today.
3. Just turning up!
This might sound like an odd one, but hear us out. If a stranger turned up to your premises – perhaps appearing confused, in some kind of distress, or maybe with a bit of a confident swagger – would you let them in? How much access to your premises (and the valuable systems housed therein) would they possibly be able to access?
On an average day, would your security or reception personnel manage to keep them away from anything too sensitive? Or could someone simply stride upstairs and into offices and sensitive server rooms without anyone batting an eye? It sounds weird, but it happens!
And continuing from the technologies discussed above – would they be able to pluck a sensitive RFID card left on a tabletop, pocket it, and leave? Would they be able to gather your WiFi password from an errant sticky note – or simply by asking?
When someone turns on the charm or appears in some kind of unfortunate situation, we feel naturally obliged to help. However, they could be simply using social engineering – the psychology that cybercriminals often employ in order to get us to do their bidding.
Read More: What Is Social Engineering? And How Can You Stay Safe?
Three isn’t the magic number
These three methods may seem scary enough, but they’re far from the only ways that physical and cyber security intersect. From Near-Field Communications to “baiting” attacks, there are many other ways that determined cybercriminals can get their way.
Are you wondering where your own cyber weak spots are hiding? Worried about the “unknown unknown” cyber-dangers lurking within – and outside of – your IT infrastructure?
Just Cyber Security’s penetration testing services hunt down your cyber security loopholes and give you the advice and support to close them – tightly and quickly.