# Presentation: 160438

## 2005 Physical Security ConferencePhysical Security 101Tom Caddy

- September 26, 2005

## Agenda

- Introduction
- Objective
- Threat Models
- Threat Taxonomy
- Access Threats
- Physical Security
- Role
- Technologies
- External Environment
- Attacks & Mitigations
- Attack Points
- Level of Effort
- Mitigation Strategies
- Challenges
- Standard
- Validation
- Lifecycle
- Constituents
- Summary

## Objective

*“**It should be very clear that ****compromised physical security always means that all security layers have been compromised****. All security discussed in this solution is based on the assumption that physical security has been addressed.** ****Without physical security, ***_***no***_*** other security measures can be considered effective****.*”

- Microsoft Website Discussing System Security

## Physical Security Role

*Physical Security Protects all other Module aspects *

**Critical Security Parameters**

**Data, Information  or Cargo**

**Module Integrity**
**Physical and Logical**

**Physical Security at **
**Cryptographic Boundary**

*Physical Security is Access Control*

## General Threat Models

**Low Threat**
**Environment**
**User/Owner benefit**
**by module**
**security**

**High Threat**
**Environment**
**User/Owner benefit**
**by module **
**compromise**

**Custom Threat**
**Environment**
**High Value Data**
**Unique ****Environment**

**Typically 140-2**
**Level 1 and **
**Level 2 Modules**

**Typically 140-2**
**Level 3 and **
**Level 4 Modules**

**External Environment Effect**
** ****Space**
** ****Vault**

**Data Value**
** ****Cost of Loss**
** ****Cost of Loss of Integrity**

## Threat/Attacker Taxonomy

**Class I - (Clever Outsiders) - opportunistic**
**Intelligent;  limited system knowledge**
**Limited access to module, and limited equipment and tools**
**Exploit obvious weaknesses**

- *IBM Systems Journal v30 no 2 (1991)

## Threat/Attacker Taxonomy

- Class I - (Clever Outsiders) - opportunistic
- Intelligent;  limited system knowledge
- Limited access to module, and limited equipment and tools
- Exploit obvious weakness’
**Class II - (Knowledgeable Insider) - motivated**
**Specialized education, knowledge and experience**
**Significant access to module; sophisticated equipment and tools**
**Exploit subtle vulnerability, create opportunity**

- *IBM Systems Journal v30 no 2 (1991)

## Threat/Attacker Taxonomy

- Class I - (Clever Outsiders) - opportunistic
- Intelligent;  limited system knowledge
- Limited access to module, and limited equipment and tools
- Exploit obvious weakness’
- Class II - (Knowledgeable Insider) - motivated
- Specialized education, knowledge and experience
- Significant access to module; sophisticated equipment and tools
- Exploit subtle vulnerability, create opportunity
**Class III - (Funded Organization) – highly motivated**
**Teams of specialists, complimentary skills, extensive experience**
**Virtually unlimited access to module; advanced analysis and tools**
**Exploit hidden vulnerabilities or create vulnerabilities**

- *IBM Systems Journal v30 no 2 (1991)

## Availability of the module is a major factor in assessing risk
Time that a threat has access to the module(s)

Growing risks to module access
Distribution of systems and other lifecycle phases
Flexibility and configurability 
Administration, maintenance and remote access roles

Invasive vs. Non-Invasive
Skills require specific knowledge, skills and practice in performing a non invasive attack
Non Invasive compromises can be particularly damaging as compromise may not be discovered for considerable time

- Time that a threat has access to the module(s)
- Growing risks to module access
- Distribution of systems and other lifecycle phases
- Flexibility and configurability
- Administration, maintenance and remote access roles
- Invasive vs. Non-Invasive
- Skills require specific knowledge, skills and practice in performing a non invasive attack
- Non Invasive compromises can be particularly damaging as compromise may not be discovered for considerable time

- Availability Risk

**Notes:**
Invasive vs non invasive
140-3 phy sec because it requires physical access to the device and potentially some modification of the environment?  Or not because it is not invasive

## Physical Security Technology

- Chemical

- Materials

- Mechanical

- Electrical

- Physics

- Security

***Detection Ckt***
***Zeroization Ckt***
***Analog Circuits***
***Electromagnetic***
***RF and Emissions***

***Adhesives***
***Solvents***

***Light***
***Radiation***
***Sound***
***Thermal***

***System Requirements***
***Risk Assessment***
***Vulnerability Assessment***
***Security Policy, Manuals***

***Plastics***
***Metals***
***Composites***

***Design***
***Tolerances***
***Fasteners***
***Assembly Processes***

- Cryptographic Module
- Logic, Function
- And Data

***“******Crown Jewels”***

**Notes:**
Details in some cars vs other cars

## External Environment

- Chemical

- Materials

- Mechanical

- Electrical

- Physics

- Security

***External Environment***
***Physical Security***
***Usually only works***
***for limited threats***
***and roles***

**Vulnerabilities**
**and mitigation **
**are often hidden**
** ****in the **
**Details**

**Interfaces **
**between technologies**
** ****can be vulnerabilities**

- Cryptographic Module
- Logic, Function
- And Data

***“******Crown Jewels”***

**Notes:**
Details in some cars vs other cars

## Attack Plan

- Identify the weakest points in the “system”
- Physical inspection
- Available documentation
- Develop “attack” plan based on vulnerable points
- Acquire resources
- Skills
- Tools
- Materials
- Test “attack” plan and refine as necessary

- As currently defined, FIPS 140-2 evaluation
- is a physical security evaluation not a full attack

## Mitigation Strategies

*Tamper Evidence*

*Tamper Resistance*

*Door and Cover Tamper *
*Detection and Response*

*Production Grade*

*Envelope Tamper Detection *
*and Response*

**Security requires trust; Trust requires reliability Commercial Grade equipment is expected to be reliable **

**User detectable Evidence vs. Forensic Evidence or Warranty evidence is effective when User ****is motivated to trust the module**

**Feature to sense basic threat conditions and respond with defensive action – zeroization of critical security parameters**

**Adding complexity, difficulty and risk to compromising a module**

**Feature to sense any breach of the cryptographic ****boundary and respond with defensive action**** – zeroization of critical security parameters**

**Includes concepts of obscurity, vents and pick resistant locks**

## Attack Level of Effort (LOE)

*Increasing  Level of Effort is directly related to an increase in Tamper Resistance not security features*
*Range that effectiveness or tamper resistance of the implementation can have on security*

- L

- O

- E

- T

- r

- u

- s

- t

- a

- n

- d

- L

- e

- v

- e

- l

- o

- f

- E

- f

- f

- o

- r

- t

- f

- o

- r

- S

- u

- c

- c

- e

- s

- s

- f

- u

- l

- A

- t

- t

- a

- c

- k

- 1              2               3               4

**Level of Security**

## Specification Challenges

- Standard
- Security Effectiveness definition vs. Security Feature Definition
- Tamper Resistance Definition
- The affect module embodiment has on tamper resistance
- Allowance for innovation
- Module designs
- Attack methods
- Tools and techniques

## Testing and Evaluation
Testing Efficiency
Establishing a DTR to have an effective test that costs significantly less then the value of an attack

Testing Consistency
Establishing test, lab and personnel requirements that allow multiple test entities and personnel to consistently obtain similar results

- Testing Efficiency
- Establishing a DTR to have an effective test that costs significantly less then the value of an attack
- Testing Consistency
- Establishing test, lab and personnel requirements that allow multiple test entities and personnel to consistently obtain similar results

- Validation Challenges

## Basic...

**Manufacturing**

**Initialization**

**Scrap**

**Operational**

**Typical Transportation Points**

- Cryptographic Module
- Typical Lifecycle

*Current FIPS 140-2 requirements are applicable in the operational environment*

## Expanded.....

**Manufacturing**

**Initialization**

**Scrap**

**Operational**

**Typical Transportation Points**

*For high security devices physical security threats exist throughout the module lifecycle*

- High Security Crypto Module Lifecycle

**Expanded.....**

## Summary

- 140-1 and 140-2 have done a remarkable job of establishing a great foundation
- A high Level of Physical Security is  complicated and cannot be an after thought
- Recognize that effective physical security requires different skills then used during 140-2 logical and assurance compliance
- Recognize the role of Tamper Resistance as a key characteristic in physical security effectiveness
- 140-3 is an opportunity to review, revisit and improve