Hardware Security

All software security depends on hardware security. If the hardware can be stolen or surreptitiously replaced, secure software will not help. When computers filled a room, stolen computers were not a big problem. Now that laptop and palmtop computers are the fastest growing market, physical security is at least as important as software security.

Some of the most common problems are:

• equipment and removable media is stolen or replaced;
• security can be circumvented by changing hardware setup parameters;
• systems can be booted by unauthorized users;
• systems can be booted from unauthorized software;
• boot media can be re-written by unauthorized software, and
• unauthorized software can be executed from removable media.

Some of the safeguards which can be taken are:

• locked doors and secured equipment;
• lockable cases, keyboards, and removable media drives;
• key or password-protected configuration and setup;
• password required to boot;
• password required to mount removable media;
• read-only boot media, and
• storing removable media in secured areas.

Most of these safeguards are required for the DoD's System High and Compartmented Mode Workstations, which are briefly discussed in a later section.

Other problems related to hardware are eavesdropping via electro-magnetic interference (EMI) detection and analysis, and communications interception. EMI detection is out-of-scope for this report. Communications interception is discussed in Chapter 9.