2KKUU7ita

86
Part II: Putting Ethical Hacking in Motion
✓ Where are fire-detection and -suppression devices — including alarm
sensors, extinguishers, and sprinkler systems — located? Determine
how a malicious intruder can abuse them. Are they accessible via a wireless
or local network with default login credentials? Are these devices
placed where they can harm electronic equipment during a false alarm?
✓ Where are water and gas shutoff valves located? Can you access them,
or would you have to call maintenance personnel when an incident
arises?
✓ Are local telecom wires (both copper and fiber) that run outside of the
building located aboveground, where someone can tap into them with
telecom tools? Can digging in the area cut them easily? Are they located
on telephone poles that are vulnerable to traffic accidents or weatherrelated
incidents?
Countermeasures
You might need to involve other experts during the design, assessment, or
retrofitting stages. The key is placement:
✓ Ensure that major utility controls are placed behind closed and lockable
doors or fenced areas out of sight to people passing through or nearby.
✓ Ensure that someone walking through or near the building cannot
access the controls to turn them on and off.
Security covers for on/off switches and thermostat controls and locks for
server power buttons, USB ports, and PCI expansion slots can be effective
defenses. Just don’t depend on them fully, because someone with a hammer
can easily crack them open.
I once assessed the physical security of an Internet colocation facility for a
very large computer company. I made it past the front guard and tailgated
through all the controlled doors to reach the data center. After I was inside,
I walked by equipment that was owned by very large companies, such as
servers, routers, firewalls, UPSs, and power cords. All this equipment was
completely exposed to anyone walking in that area. A quick flip of a switch or
an accidental trip over a network cable dangling to the floor could bring an
entire shelf — and a global e-commerce system — to the ground.
Office layout and usage
Office design and usage can either help or hinder physical security.
Attack points
Hackers might exploit some office vulnerabilities. Consider these attack points: