“All electronic equipment emit (or transmit) some level of radio frequency (RF) noise that can be picked up by any nearby piece of metal that could act like an antenna. While the piece of computer equipment might have a wireless network interface card (NIC), the transmissions in question are not coming through it. ”(Gehling, Ashley, & Griffin 2007)
Information security starts at the most fundamental level and then it branches out. The electromagnetic spectrum is the most fundamental level of physical security. Because physical security starts at the electromagnetic spectrum I will begin at the electromagnetic spectrum. The electromagnetic spectrum encompasses radio waves, microwaves, infrared, visible light waves, UV light waves, X-rays and gamma waves. Information within a facility traverses the electromagnetic spectrum with the lowest frequency being radio waves and the highest being gamma waves.
Because information can travel through these frequencies, it means these frequencies can contain covert channels. The design company facilities has to take into account the electromagnetic spectrum and emission leakage. A sound proof room is very important because hackers can detect the sounds from a room to get information. When the door to a room shuts the sound from that room should not escape that room and this has to be built into the design of certain rooms which are deemed critically important to the company.
The company should seek to control the spread of emissions within their organization because controlling the spread of emissions controls the spread of information. Everything from the design of keyboards, to the design of the chairs, to the design of the doors, to the type of light-bulbs, to the geometry of the room itself must be considered.
Below I will list some techniques which can be used to shield, block or prevent the spread of emissions. The first technique is shielding which involves using certain materials such as copper or nickel which can contain the emissions and prevent leakage. There are some newer materials out today which do this better than ever but these materials may be costly. In general the company will want to make sure their products are TEMPEST certified.
An example of an emissions based attack could be a hacker who rather than use a hardware keylogger to capture network passwords instead uses an emissions sniffing keylogger to accomplish the same purpose. The process to accomplish this has been detailed by Vuagnoux and Pasini in their demonstration paper titled: Compromising electromagnetic emanations of wired and wireless keyboards. In their paper they show how easy it is for hackers to monitor keystrokes from afar. It works through walls and can transmit up to 20 meters (Vuagnoux and Pasini). It is this attack and attacks similar to this one that the security team must be concerned about because one rogue employee or rogue hacker could in theory use this attack to see every password typed in.
This attack can be defeated by the use of an on-screen keyboard but then another attack is opened up. The initial solution is to get rid of the password system which relies on keyboards or to use keyboards which are properly shielded in a way so that this attack cannot work. It's also important that the monitor be LCD and designed so that it leaks minimal emissions. Additionally an element of randomness can be added so that the keys on the keyboard are remapped after every keystroke. An on-screen keyboard and a TEMPEST certified monitor is what I would recommend for the company.
Electromagnetic pulse (EMPs) represent a potential threat to availability while Von Eck phreaking and differential power analysis represent threats to confidentiality. Data integrity, confidentiality, availability, are all initially secured physically. Threats to integrity which are benign like cosmic rays or hard drive crashes can compromise data integrity just like a malicious threat such as a virus can. A company must be prepared for both scenarios and keep continuous backups. Data integrity is secured by backups, checksums, and data correction (Goodrich and Tamassia 2011, p. 8).
Once there is sufficient redundancy data integrity with error correction is secure. Availability is secured by physical protections, and computational redundancy (Goodrich and Tamassia 2011, p.8). Data assurance includes policies, permissions, and protections. Policies to specify behavioral expectations that people or systems have for themselves or others. Permissions to describe the allowed behaviors by the agents that interact with a person or system and protections which describe mechanisms in place to enforce permissions and policies (Goodrich and Tamassia 2011, p.10).
Sometimes the weather itself can threaten information availability. Electromagnetic defenses are important because if there is an electric storm expensive hardware can be fried. IElectromagnetic pulse (EMPs) represent a potential threat to availability while Von Eck phreaking and differential power analysis represent threats to confidentiality. Data integrity, confidentiality, availability, are all initially secured physically. Threats to integrity which are benign like cosmic rays or hard drive crashes can compromise data integrity just like a malicious threat such as a virus can. A company must be prepared for both scenarios and keep continuous backups. Data integrity is secured by backups, checksums, and data correction (Goodrich and Tamassia 2011, p. 8).
Remember that in order to defend against emissions leaks the design of the facility or room which contains the equipment must be secure. There can be no emissions leakages in the components such the cables, the doors and walls have to be sound proof, any radio waves must be contained, visible light and UV must be contained, so on. A common way of achieving this kind of containment is to put each computer device inside a capsule or vault which acts as an individualized Faraday cage. Faraday cages are known to be able to be secure from emissions leaks and provide information security.
The design of each room must containing equipment with sensitive information must be carefully considered. Starting with the sound proof doors, but also to be considered are the location or placement of windows, or in some cases if there ought to be windows at all. Improper room architecture can make it easier for hackers to exfiltrate sensitive information without detection.
Van Eck Phreaking is not new. The capabilities to spy on a computer from a van outside someone's home has been possible since the 80s. Computer monitors typically would emit enough radiation that it would be possible to use Van Eck Phreaking techniques to determine exactly what they were doing on the computer. In 2016 we could expect that technology has advanced significantly since the 1980s and if the trend holds then I would expect attackers to be favored over defenders as is the case in general in the realm of cybersecurity.
Electromagnetic pulse (EMPs) represent a potential threat to availability while Von Eck phreaking and differential power analysis represent threats to confidentiality. Data integrity, confidentiality, availability, are all initially secured physically. Threats to integrity which are benign like cosmic rays or hard drive crashes can compromise data integrity just like a malicious threat such as a virus can. A company must be prepared for both scenarios and keep continuous backups. Data integrity is secured by backups, checksums, and data correction (Goodrich and Tamassia 2011, p. 8).
Some of the potential scenarios to consider are:
In the least the employees should receive a warning and some training but the preferred course of action would be to limit employee exposure to dangerous levels of radiation.
“Excessive use of wireless network communication systems has
led to the eruption of many health hazards among its users
leading to long term health losses too. So, common public
should be well educated and mass awareness campaigns should
be initiated from medicos and health inspectors for alleviating
the health issue based problems related to increasing and
enormous use of mobile phones. ”(Ganguly, Guha & Mukhopadhayay 2011)
To do this an incident report mechanism must always be in place. This mechanism should be as close to in real time as possible and should be continuously monitored.
If physical security is in place for the computers within the network then the focus is on the attacks coming from outside the network. “Intrusion detection is the process of monitoring events occurring in a computer system or network and analyzing them for signs of possible incidents that are violations or imminent threats of violations of computer security policies.” (Vacca 2009, p. 240).
Intrusion detection systems monitor network traffic and analyze it to determine whether or not that traffic represents a malicious incident. (Vacca 2009, p.240). A company will have to keep logs in the case there there is an incident report. If records are not kept it's difficult to determine the security level in this area. The recommendation is that a company keep all logs and as much information as is reasonable.
Beyond keeping logs, corporate network security must rely on strong encryption. Encryption can and does get broken and so it's important for to remain on the cutting edge and to keep track of security advisories and software patches.
References
Vacca, John R. Computer and Information Security Handbook. Amsterdam: Elsevier, 2009. Print.
Tosaka, T., Yamanaka, Y., & Fukunaga, K. (2011). Method for Determining Whether or Not Information is Contained in Electromagnetic Disturbance Radiated From a PC Display. IEEE Transactions On Electromagnetic Compatibility, 53(2), 318-324. doi:10.1109/TEMC.2010.2103562
Ab-Rahman, M., Azizan, L., Hassan, M., & Shuhaimi, N. (2011). Single Source Analytical Study on the Performance of Visible Light Communication. Journal Of Applied Sciences Research, 7(11), 1567-1572.
Goodrich, Michael T., and Roberto Tamassia. Introduction to Computer Security. Boston: Pearson, 2011. Print.
Ntogari, G., Kamalakis, T., Walewski, J., & Sphicopoulos, T. (n.d). Combining Illumination Dimming Based on Pulse-Width Modulation With Visible-Light Communications Based on Discrete Multitone. Journal Of Optical Communications And Networking, 3(1), 56-65.
Vibin, A. M., & Prince, S. (2011). Visible Light Wireless Communication for Audio Signals. AIP Conference Proceedings, 1391(1), 377-379. doi:10.1063/1.3643554
Degardin, V., Laly, P., Lienard, M., & Degauque, P. (2011). Compromising Radiated Emission from a Power Line Communication Cable. Journal Of Communications Software & Systems, 7(1), 16-21.
Gehling, R., Ashley, C., & Griffin, T. (2007). Electronic Emissions Security: Danger in the Air. Information Systems Management, 24(4), 305-310. doi:10.1080/10580530701586011
Wang, R., He, F., Wan, Y., & Qi, Y. (2012). Preparation and characterization of a kind of magnetic carbon fibers used as electromagnetic shielding materials. Journal Of Alloys & Compounds, 51435-39. doi:10.1016/j.jallcom.2011.10.061
Ganguly, S. S., Mukhopadhayay, S. K., & Guha, S. K. (2011). Stress to Human Health Due to Electromagnetic Radiation Emitted from Mobile Phone. International Journal Of Bio-Resource & Stress Management, 2(3), 369-372.
Kocher, Paul, Joshua Jaffe, and Benjamin Jun. "Differential Power Analysis." Cryptography.com. Cryptography Research, 1998. Web. 18 Mar. 2012.
Electromagnetic Spectrum - Introduction. (n.d.). Imagine The Universe! Home Page. Retrieved March 18, 2012, from http://imagine.gsfc.nasa.gov/docs/science/know_l1/emspectrum.html
How Printers can breach our privacy: Acoustic Side-Channel attacks on Printers. (n.d.). Information Security and Cryptography Group. Retrieved from http://www.infsec.cs.uni-saarland.de/projects/printer-acoustic/
Oswald, E., & Preneel, B. (n.d.). A Survey on Passive Side-Channel Attacks and their Countermeasures for the NESSIE Public-Key Cryptosystems. COSIC COmputer Security and Industrial Cryptography. Retrieved March 22, 2012, from https://www.cosic.esat.kuleuven.be/nessie/reports/phase2/kulwp5-027-1.pdf
Pasini, S., & Vuagnoux, M. (n.d.). Compromising Electromagnetic Emanations of Wired and Wireless Keyboards - Martin Vuagnoux and Sylvain Pasini. LASEC. Retrieved March 23, 2012, from http://lasecwww.epfl.ch/keyboard/
Information Assurance Business Affairs and Research - NSA/CSS. (n.d.). Welcome to the National Security Agency. Retrieved March 25, 2012, from http://www.nsa.gov/applications/ia/tempest/index.cfm
