This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "Top 10 2014-I10 Poor Physical Security"
Craig Smith (talk | contribs) |
Craig Smith (talk | contribs) |
||
Line 22: | Line 22: | ||
{{Top_10:SubsectionTableBeginTemplate|type=main}} {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=freetext|title=Is My Physical Security Sufficient?|position=firstLeft|year=2013|language=en}} | {{Top_10:SubsectionTableBeginTemplate|type=main}} {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=freetext|title=Is My Physical Security Sufficient?|position=firstLeft|year=2013|language=en}} | ||
− | Physical | + | Checking for Poor Physical Security includes: |
+ | * Reviewing how easily a device can be disassembled and data storage mediums accessed or removed | ||
+ | * Reviewing the use of external ports such as USB to determine if data can be accessed on the device without disassembling the device. | ||
+ | * Reviewing the number of physical external ports to determine if all are required for proper device function | ||
+ | * Reviewing the administrative interface to determine if external ports such as USB can be deactivated | ||
+ | * Reviewing the administrative interface to determine if administrative capabilities can be limited to local access only | ||
{{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=freetext|title=How Do I Physically Secure My Device?|position=right|year=2013|language=en}} | {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=freetext|title=How Do I Physically Secure My Device?|position=right|year=2013|language=en}} | ||
Line 30: | Line 35: | ||
# Ensuring USB ports or other external ports can not be used to maliciously access the device. | # Ensuring USB ports or other external ports can not be used to maliciously access the device. | ||
# Ensuring device can not be easily disassembled. | # Ensuring device can not be easily disassembled. | ||
− | # | + | # Ensuring only required external ports such as USB are required for the product to funtion |
+ | # Ensuring the product has the ability to limit administrative capabilities | ||
+ | |||
+ | Please review the following tabs for more detail based on whether you are a [https://www.owasp.org/index.php/OWASP_Internet_of_Things_Top_Ten_Project#tab=Manufacturers Manufacturer], [https://www.owasp.org/index.php/OWASP_Internet_of_Things_Top_Ten_Project#tab=Developers Developer] or [https://www.owasp.org/index.php/OWASP_Internet_of_Things_Top_Ten_Project#tab=Consumers Consumer] | ||
+ | |||
{{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=example|position=left|risk=1|year=2013|language=en}} | {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=example|position=left|risk=1|year=2013|language=en}} | ||
'''Scenario #1:''' The device can be easily disassembled and storage medium is an unencrypted SD card. | '''Scenario #1:''' The device can be easily disassembled and storage medium is an unencrypted SD card. |
Revision as of 23:12, 9 February 2015
Threat Agents | Attack Vectors | Security Weakness | Technical Impacts | Business Impacts | |
---|---|---|---|---|---|
Application Specific | Exploitability AVERAGE |
Prevalence COMMON |
Detectability AVERAGE |
Impact SEVERE |
Application / Business Specific |
Consider anyone who has physical access to the device. | Attacker uses vectors such as USB ports, SD cards or other storage means to access the Operating System and potentially any data stored on the device. | Physical security weaknesses are present when an attacker can disassemble a device to easily access the storage medium and any data stored on that medium. Weaknesses are also present when USB ports or other external ports can be used to access the device using features intended for configuration or maintenance. | Insufficient physical security could lead to compromise of the device itself and any data stored on that device. | Data could be stolen or modified and the device taken control of for purposes other than what was originally intended. Could your customers be harmed? Could your brand be harmed? |
Is My Physical Security Sufficient?
Checking for Poor Physical Security includes:
|
How Do I Physically Secure My Device?
Adequate physical security requires:
Please review the following tabs for more detail based on whether you are a Manufacturer, Developer or Consumer |
Example Attack Scenarios
Scenario #1: The device can be easily disassembled and storage medium is an unencrypted SD card. SD card can be removed and inserted into a card reader to be modified or copied. Scenario #2: USB ports are present on the device. Custom software could be written to take advantage of features such as updating via the USB port to modify the original device software. In both cases, an attacker is able to access the original device software and make modifications or simply copy specific target data.
|
References
OWASP External |