According to a study released in 2000 by the FBI and the
Computer Security Institute (CSI), over seventy percent of all
attacks on sensitive data and resources reported by organizations
occurred from within the organization itself. Implementing an
internal security policy is just as important as an external
strategy. This section explains some of the common steps
administrators and users can take to safeguard their systems from
internal exploitation.
Employee workstations, for the most part, are not as likely to
be targets for remote attacks, especially those behind a properly
configured firewall. However, there are some safeguards that can be
implemented to avert an internal or physical attack on individual
workstation resources.
Modern workstation and home PCs use a BIOS that controls system
resources on the hardware level. Workstation users can set
administrative passwords within the BIOS to prevent malicious users
from accessing or booting the system. BIOS passwords prevent
malicious users from booting the system at all, deterring the user
from quickly accessing or stealing information stored on the hard
drive.
However, if the malicious user steals the PC (the most common
case of theft among frequent travelers who carry laptops and other
mobile devices) and takes it to a location where they can
disassemble the PC, the BIOS password does not prevent the attacker
from removing the hard drive, installing it in another PC without
BIOS restriction, and accessing the hard drive to read its
contents. In these cases, it is recommended that workstations have
locks to restrict access to internal hardware. Specialized security
devices, such as lockable steel cables, can be attached to PC and
laptop chassis to prevent theft, as well as locks on the chassis
itself to prevent internal access. This type of hardware is widely
available from manufacturers such as Kensington and Targus.
Server hardware, especially production servers, are typically
mounted on racks in server rooms. Server cabinets usually have
lockable doors, and individual server chassis also are available
with lockable front bezels for increased security from errant (or
intentional) tampering.
Enterprises can also use co-location providers to house their
servers, as co-location providers offer higher bandwidth, 24x7
technical support, and expertise in system and server security.
This can be an effective means of outsourcing security and
connectivity needs for HTTP transactions or streaming media
services. However, co-location can be cost-prohibitive, especially
for small- to medium-sized businesses. Co-location facilities are
known for being heavily guarded by trained security staff and
tightly monitored at all times.
