2KKUU7ita

88
Part II: Putting Ethical Hacking in Motion
✓ A receptionist or a security guard who monitors people coming and
going. This is the most critical countermeasure. This person can ensure
that every visitor signs in and that all new or untrusted visitors are
always escorted.
Make it policy and procedure for all employees to question strangers
and report strange behavior in the building.
Employees Only or Authorized Personnel Only signs show the bad guys
where they should go instead of deterring them from entering. It’s security
by obscurity, but not calling attention to the critical areas may be
the best approach.
✓ Single entry and exit points to a data center.
✓ Secure areas for dumpsters.
✓ CCTV or IP-based video cameras for monitoring critical areas, including
dumpsters.
✓ Cross-cut shredders or secure recycling bins for hard-copy documents.
✓ Limited numbers of keys and passcode combinations.
Make keys and passcodes unique for each person whenever possible
or, better yet, don’t use them at all. Use electronic badges that can be
better controlled and monitored instead.
✓ Biometrics identification systems can be very effective, but they can
also be expensive and difficult to manage.
Network components and computers
After hackers obtain physical access to a building, they look for the computer
room and other easily accessible computer and network devices.
Attack points
The keys to the kingdom are often as close as someone’s desktop computer
and not much farther than an unsecured computer room or wiring closet.
Malicious intruders can do the following:
✓ Obtain network access and send malicious e-mails as a logged-in user.
✓ Crack and obtain passwords directly from the computer by booting it
with a tool such as the ophcrack LiveCD (http://ophcrack.source
forge.net). I cover this tool and more password hacks in Chapter 7.
✓ Place penetration drop boxes such as those made by Pwnie Express
(http://pwnieexpress.com) in a standard power outlet. These
devices allow a malicious intruder to connect back into the system via