Welcome to the session on Physical Security. Now, Physical Security has been around since we've had castles and moats. You know, a moat around, you know, it's a water, it's a protective barrier. You probably have a portcullis. These are all physical security elements of your building. You might have a locked door as your physical access point. But there's lots of other things that we need to cover and also I want to cover vulnerabilities to security and the first thing I want to talk about is a man trap. So, let me bring up what a man trap is. So, a man trap, as you can see on the screen there, that's a man trap, that's a man trap. But Mark, that's something from the thirteenth or fourteenth century. Well, it is a man trap, but it's not the one I'm thinking of. Probably the one I'm thinking of is probably one that you're thinking of, as opposed to this one. So, if I go to the next part, this is actually a man trap. Now, what's the purpose of a man trap, Mark? So, when people come up to a building, which could be a turnstile for example, it's to stop people piggy-backing or tail-gating behind you, which is another social engineering technique. So basically, you go in there, swipe in there. Once the door's closed behind you, then the door will then open and you go through it, just like you do at the airport, and this prevents piggy-backing and tail-gating, so this is a form of man trap.

Now, there are lots of security points in a building. One of the security points is, gaining access to the building itself. Now, there's a tool out there which allows people to clone your badge, and this one's called Boscloner. So, this is the site called Boscloner, and Boscloner is a device which can scan cards, so it can scan your ID or badge that allows you to enter in a building. It could also be your hotel room. And this is this card is available. It's not-, it's not illegal. Obviously, if people use it for illegal purposes, i.e., to gain unauthorised access, that's a criminal offence. But for training and educational purposes, there's this tool here. Now, there are two versions of the Boscloner device. I'm going to actually demonstrate the classic version to you. The range of this type of device is six feet in the professional one. In the one I'm going to show you, it's the classic version we're going to see, and on the site, it even tells you how to create one of these, and basically it's like a bag on your shoulder containing a lot of electronic equipment. So, let's go down and actually launch the video so you can actually see it in operation. So, this is the video itself. This chap's introducing his device. On his shoulder, you can see a bag and that bag contains all the electric gymmetry required. He's got a blank card in his hand and he's going to show that the card can't swipe into the builder because it's nothing pre-loaded on it. This could be your hotel room of course.

So, he's going to-, he's gonna use what's called an RF ID, which is Radio Frequency Identifying badge tool to scan someone's badge and you can see in front of you there, is a person having a badge on display. So, he's going to try to gain access to it. With this one, I think you only need to get access within three feet. Some of them, you get a range of six feet and then you can get ones that can go further than that. So, he's just going to get within three feet, and then there's a beep sound where the badge has been copied and cloned. So, now it's been paired using Bluetooth, it's been copied to the badge and now he's going to try and gain unauthorised access into the building itself. So, he's going to put the card on there, which could be a hotel card, swipes along there, and then opens the door. Unauthorised access into your hotel room. Well, how do you defend against this type of thing Mark? How do you defend against this type of thing? Well, the best way to, to defend against this type of thing would be to use multi-factor authentication. Have a pin or biometrics in addition to the token itself. A lot of biometrics, if you try to chop someone's hand off, or take their eye out like you see in some of the Marvel movies won't work because it needs blood flow going through the body. So, if you are, you're going to have to keep the people alive, to be able to access the building that way. Obviously, it won't always be an option for you.

The next thing I'm going to show you is bump locking. Now, bump locking is where you basically have the keys at all at the same level. So, this is a standard key that you would see, and you can see the sheer line is there and that the keys are different heights and levels and that's what a standard key would look like. Now, a bump lock, if I click on the little diagram here, a bump lock will be all at the same level. A bump lock will be all at the same level and all you have to do with this one is apply a bit of pressure to the key itself, which makes the barrels jump up and then turn at the same time and then you can gain unauthorised access into that building. This is bump locking. So, interesting enough, Ultion, and I'm not advertising any companies when I'm showing these things, is showing this in operation, a bump lock. So, they're going to demonstrate this one and it's a very brief video, but the last-, the last barrel won't jump up, and this defeats bump locking. So, I'm just going to play the video and obviously talk through it as it's played. It won't take long to go through this video. No advertising on this video. So, normal lock defeated by an attack. So, this is your normal key and your bump key. Put the key into the lock, it goes to the levels of the barrels, bring it back, tap it, normally, that would defeat normal keys. You'd be able to turn it and you get straight access into people's houses. That's a normal bump lock. That's a technique.

Now, resisting this, remember I'm not advertising Ultion, it's just an example, so the keys are all at the same level. Same type of technique again, but the last barrel will not jump up or down, it will just stay where it is. And that will defeat a bump locking attack. This would defeat a bump locking attack. You can't perform the attack because the last barrel has been blocked, so, that would stop that from happening. Now, I'm going to show you Ultion again but that's only because I like their website, and I'm going to show you how to physically, they're going to break into someone's house. So, let's just watch this video very briefly, see the video in operation. So, this is the-, this is a standard lock. They're going to snap the lock off, and then snap the barrel off, and you'll use a screwdriver, and you'll be in house-, in the house within, sort of, nine seconds. The Ultion lock has lock on two sides. It has a lock on the outside and a lock in the inside and he's going to demonstrate the difference between these two locks. He's going to do the same technique, so now he's attacking the Ultion lock now, snapping the barrel off, snapping the barrel, but bear in mind that there's half a lock still inside the thing and now he's going to try and gain entry into it and he will not succeed,.So I'm going to pause the video on this one, we don't need to see any more than that, but that's a good example of bypassing a door lock. So, using Ultion lock to help defend against it.

The next one I'm going to show you is how to bypass and get access to a-, if I just increase the size of this so you can see it. So, what I'm going to do is on this one here, is going to show you a technique. So, this person here, on the left, you have the door facing him and on the right is the door on the other side. And the door on the other side has a passive infra-red control, which basically has got a sensor there and he's going to blow smoke through the door to set the sensor off. He's going to do it on the second time when he does this one, so let's just play this one and you'll see this in operation. He's just describing what this thing does. The door is closed. He can't access it and he's going to vape. He's going to blow the smoke through twice. First time it doesn't pick it up. Depending where the sensors are, depends how effective this can be. So that hasn't picked it up. And the second time he does it - blows the smoke through there, door opens. Straight in to-, unauthorised access into that building. So, that's a good example of accessing the building. Now, to defend against that you can move your sensors back. I've also seen a demonstration on YouTube, where people use an air duster to spray the air-, the duster through the door, at the air-, blow a spray of, like, dust. That can also set a sensor off as well. So, this is bypassing physical security.

What I want to do is, obviously, show you how artificial intelligence can help us with physical security. Artificial intelligence-, here's a nice little website here from the Verge and if I go down, this camera here has been set up. It's an artificial intelligence camera and it's looking for people wearing red. Now, you can see the camera has picked up a couple of people who are not red. Some of it's the reflection of the sun on the tarmac. That's caused a false-, a false positive. You've obviously got the red person. You've also got a red car. Artificial intelligence can assist and help but it's still getting-, it's still not 100%, but it gives you a lot more support in terms of what it can and can't do. What I want to show you next is also another thing that people use. So, we've got artificial intelligence to help us now. Now, we've got robots. So, we've got robots. So, this one is a switch sentry, so it looks like a Dalek and it can go up stairs like a Dalek can, and it has sensors. 360-degree sensors that go around. It also allows people to talk, and you have 360-degree-, and it can be controlled by a human or by a machine, whichever is, is, designed for that purpose.

So, this is a drone. A device that goes around and scanning different things and it can go upstairs and all these types of things. And these are things that are being rolled out to different locations now. Some people have gone the next level on this one. And they're actually using, in addition to robots, and we've seen some quite good robots by some different providers, where you've got in addition to robots going around, you've also got drones or UAVs - which are flying up and they can give you a lot more peripheral vision in terms of what it can do, in terms of viewing the different areas. Obviously, I was talking to someone, on another course and he said to me, 'Mark, you know, we've got oil pipelines where we're working. A drone in the sky, you know, that's a potential fire hazard.' Right, I take on board with that’s saying, but it does give you that extra level of security and bearing in mind, some of these drones can be up for long times, but it gives you extra area-, and obviously it can do thermal imaging and all these types of things as well. So, hopefully, this has been quite an interesting view on physical security, and I look forward to speaking to you in the next session.

Physical threats and controls

About