Subject: RE: RFC 2527 Physical Security Controls Question

From: [email-masked]
Date: Tue, 14 Dec 1999 12:40:50 -0800

in the commercial world ... it is almost alwas a cost benefit trade-off ...
there are both penetration exploits and denial-of-service exploits.

a financial operation might have assets where management operations yield a
couple billion a day. if the operation of the infrastructure is dependent on
security features ... then crippling the security infrastructure might disable
the ability to perform financial management transactions and result in the
significant losses for the duration of the security infrastructure outage.

theft because of security problems not only may put reputation at risk, but may
represent a problem in any court &/or litigation. Litigating theft of
trade-secrets valued at several billion can be put at risk if security
procedures aren't proportional to the value of the trade-secret (it was
explained to me as analogous to not having fence around swimming pool and being
liable if somebody fell in ... having value of several billion out in the open,
of course somebody will steal it ... and it won't really be their fault).
claimed value of several billion for trade-secrets may necessitate demonstrating
security procedures valued at tens of millions or more ... and have no
obvious/known weakness (the bigger the value the higher the fence).

---

From: "Aram Perez" <[email-masked]>
Date: Tue, 14 Dec 1999 17:40:07 -0800

Hi Tim,

> John Kennedy and Lynn Wheeler both made excellent points about the potential
> need for absolute top-grade physical security in a commercial CA operation.
> It all seems to come down (as always) to risk assessment and balancing the
> cost of security against it's benefits.
>
> In the commercial world, especially in the financial and medical sectors, the
> potential liability for a CA operator could be enormous, easily justifying
> the cost of physical security measures rivalling that found around weapons of
> mass destruction.
>
> This brings up an interesting question though...  For a government, it's very
> easy to designate a resourse as being sufficiently valuable to authorize the
> use of deadly force to protect it - try to get close to a stealth aircraft
> sometime. For commercial applications, however, even where billions of
> dollars may be at stake, it's harder (if not impossible) to implement that
> final line of security.
>
> So for you non-government types, would your CA physical security include
> lethal defenses?  Can anyone think of any application for a non-government CA
> that would require such defenses?  I'm not talking about just armed guards
> here...  I'm talking about defenses that would kill an unauthorized
> individual who entered protected space BEFORE they did any damage besides
> entering that space.

The only CA that I'm aware that might have this type of defense system is
one run by DigiCrime, Inc. (http://www.digicrime.com).

;-)

Aram Perez

---

From: [email-masked]
Date: Tue, 14 Dec 1999 22:05:21 -0500

Timothy,

I challenge your notion that high security equals lethal defense. A private
key used to sign certificates is very different than a stealth aircraft. I
may not be able to revoke a stealth aircraft that falls into the hands of an
adversary.

Frank Balluffi
CertCo

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
Sent: Tuesday, December 14, 1999 8:23 PM
To: [email-masked]
Cc: [email-masked]
Subject: Re: RFC 2527 Physical Security Controls Question

In the commercial world, especially in the financial and medical sectors,
the 
potential liability for a CA operator could be enormous, easily justifying 
the cost of physical security measures rivalling that found around weapons
of 
mass destruction.

This brings up an interesting question though...  For a government, it's
very 
easy to designate a resourse as being sufficiently valuable to authorize the

lethal defenses?  Can anyone think of any application for a non-government
CA 

Timothy M. Metzinger
Technical Director
Drug Enforcement Administration
Office of Information Systems
(202) 307-9884
(888) 385-0705

---

From: "Phillip M Hallam-Baker" <[email-masked]>
Date: Wed, 15 Dec 1999 14:41:36 -0500

Bob,

> However, in all of those cases the justification would be to 
> protect human life,
> and only secondarily to protect property and major financial 
> assets.  

I can't think of many cases in which a PKI would be the last barrier 
protecting such facilities. In the case of a reactor you can run the 
boron feed pumps and so on...

In the UK nuclear installations are guarded by the British Nuclear Police
which is the only part of the police force which is permitted to carry
firearms at all times. I suspect they are authorized to fire if someone
attempts to steal nuclear material but they have yet to shoot one of 
the many protestors who make a habit of unauthorized entries to such
facilties.

> Unlike 
> a government that could conceivably deploy automatic, lethal defenses to 
> protect nuclear missiles, 

Actually the US is one of a very small number of governments that could
do this. The rest have signed up for the landmine ban treaty!

> US law strongly frowns on people who 
> set up deadfall 
> devices or shotguns triggered to go off if someone attempts to 
> open a door.  

If for no other reason than such devices have a habit of going off
and killing innocent bystanders, in particular the emergency services.

> Another problem is how to deal with the conflicting demands of 
> the fire codes and security.

Quite so, deployment of deadfall devices is probably contrary to
every fire code in the country.

Failing to attend to fire codes can itself be a serious problem.
For example anyone who digs out a bunker has to be aware of the
possibility of methane gas build up. More than one pumping station 
has gone up as visitors have neglected the no-smoking signs.

Folk who build secure bunkers underground would be well advised
to consider such issues. After all a fire is likely to compromise 
one's security substantially...

	Phill

---

From: [email-masked]
Date: Wed, 15 Dec 1999 12:13:30 -0800

one of the X9.59/AADS scenerios is that the public key operation becomes
integrated into the infrastructure of the financial transaction. If that
infrastructure has spent several hundred million on security & integrity
infrastructure ... then all components have to be at the same level of
security/integrity or it puts the infrastructure at risk (don't want to
introduce new risk and failure modes).

That somewhat reverses the question ... rather than how much has to be spent on
the PKI specific implementation ... it becomes all components have to meet same
minimum integrity/security requirements; that goes for both availability (denial
of service attacks) as well as compromise (& ability to then do fraudulent
transactions).

For some infrastructures, the security/integrity infrastructure may only
represent thousands of dollars ... while some commercial operations the
security/integrity infrastructure may represent hundreds of millions.

So if public key becomes integral to the core operation (say on a transaction by
transaction basis)  ... then its associated infrastructure has to at least meet
the requirements of that infrastructure (w/o introducing new risk and failure
modes).

Furthermore, there may be situations were there is no level of liability &
insurance that would make any kind of trusted 3rd parties acceptable

The other issue not to be overlooked ... is that one of the biggest threats to
(at least) commercial operations are insiders. Some of the human factors issues
may change when only hundreds of billions of dollars are at stake.

---

From: "Bob Jueneman" <[email-masked]>
Date: Wed, 15 Dec 1999 11:41:45 -0700

There are certainly a number of commercial applications where the use 
an armed, lethal, and strong response to a forcible intrusion or attack would 
be both prudent and justifiable.  I am thinking about a nuclear reactor, a 
control center that administers regional gas or electrical power supplies,
a major banking facility, a printing company that prints Traveler's Checks,
etc.

However, in all of those cases the justification would be to protect human life,
and only secondarily to protect property and major financial assets.  Unlike 
a government that could conceivably deploy automatic, lethal defenses to 
protect nuclear missiles, US law strongly frowns on people who set up deadfall 
devices or shotguns triggered to go off if someone attempts to open a door.  
(Having said that, some states allow the use of deadly force to prevent arson, 
and a few allow deadly force to protect against theft, but not unattended force.)

In the case of a CA that is only protecting signing keys and not encryption keys, 
such defenses would be "overkill".  Instead, various trip-guards could and perhaps 
should be deployed to cause key zeroization in the event of an attack, in order 
to prevent compulsion of personnel.  This should be in addition to the 
tamper-detecting circuitry contained within a FIPS 140-1 level 3 or 4 device, for
unless they have been disarmed they will sign what they are told to.

To go back to the original request, I would suggest that the physical security 
requirements outlined in the Industrial Security Manual have stood the test of time, 
and are defensible as a reasonable and prudent set of precautions.

I no longer have a copy of the ISM, but I would suggest that the requirements for a 
Closed Area would be the minimum for a CA.  If I were doing it, I would tend to 
make the outer peripheral area a Closed Area, to be used for administrative and 
technical office space.

The next level up would be a Strong Room or Vault, one that is suitable for the storage
of Top Secret documents in the open.  This would be where I would put the firewalls,
servers, etc. -- everything but the crypto devices that actually sign the most important 
certificates.

The inner sanctum might very well deserve SCIF treatment, including Red/Black power 
separation, but would presumably not require the attention to acoustic controls, assuming
the personnel don't sit around reading off the content of the keys!  

But what is more important than the physical strength and the ability to withstand an overt 
penetration is the degree to which the area would withstand a covert attack.  Sheet rock 
walls can be penetrated, repaired, and repainted very easily within a shift, and maybe even 
within an hour or so, so it is important to have appropriate infrared or microwave area 
alarm systems that cover the walls, floor, and ceiling.

Another problem is how to deal with the conflicting demands of the fire codes and security.

When I was with GTE Laboratories, we set up a closed area for cellular fraud investigations
that was built to Strong Room specifications.  The main access was controlled by a fingerprint
reader which was under my control (with a backup person in my group).  The rear door had a 
strong three-position combination lock on it.

The combination to that lock was sealed in plastic in an envelope that was kept for emergency 
response purposes by the building guards, so they could gain entry in case of fire. The rear door was 
always alarmed, and the front door was alarmed after hours. More importantly, however, there were
TWO sets of alarms -- one of which was wired to the building alarm system, and one of which was 
internal to and controlled within our area, and physically protected.  So in the event of an emergency
the building guards could get in, but they couldn't get in undetected, even if they turned off the 
building alarm system.

In addition, the most sensitive inner area should be designated a Two Man No Lone Zone. 
Two people should be required to enter the area together, preferably using two fingerprint readers 
or at least two physical keys, and those people should also be required to use a fingerprint 
reader to exit the facility.  The interior alarm should be activated shortly after the first person 
exits, to make sure someone doesn't stay behind unsupervised.

Finally, it must be recognized that the most devastating security compromises have not been caused
by external attacks, but by authorized insiders.  All of the physical security in the world won't 
help if your people can be compromised by say an offer of $100,000. So you need personnel 
investigations, bonding, etc., etc. The problem is typically getting your HR department to accept 
those requirements.

Bob

>>> <[email-masked]> 12/14/99 06:22PM >>>

Timothy M. Metzinger
Technical Director

---

From: [email-masked]
Date: Wed, 15 Dec 1999 16:52:43 EST

In a message dated 12/15/99 1:42:10 PM Eastern Standard Time, 
[email-masked] writes:

<< There are certainly a number of commercial applications where the use 
 an armed, lethal, and strong response to a forcible intrusion or attack 
would 
 be both prudent and justifiable.  I am thinking about a nuclear reactor, a 
 control center that administers regional gas or electrical power supplies,
 a major banking facility, a printing company that prints Traveler's Checks,
 etc. >>

This is exactly the kind of debate I wanted to spark, and I agree 
wholeheartedly with your reasoned response.  I agree that the danger to a CA 
that only issues signing keys is minimal... A CA that issues encryption keys 
is another matter, since it's compromise or destruction could render 
extremely valuable information unrecoverable.

While in the US and UK, there is the common theme that you only take life to 
protect life, there are other countries (and subcultures like organized 
crime) who take a markedly different view.  God forbid one of us ever gets 
hired to build a CA for the Russian Mafia....

I think the Industrial Security Manual is an excellent starting point since 
it mirrors most DOD standards.  But it also has one significant weakness; it 
was initially written to protect paper documents and other concrete (as 
opposed to virtual) objects.  Special care must be taken to protect against 
the latest and greatest threats (perhaps EMP) to computers.

---

From: [email-masked]
Date: Wed, 15 Dec 1999 17:02:39 EST

In a message dated 12/15/99 3:17:16 PM Eastern Standard Time, 
[email-masked] writes:

<< So if public key becomes integral to the core operation (say on a 
transaction by
 transaction basis)  ... then its associated infrastructure has to at least 
meet
 the requirements of that infrastructure (w/o introducing new risk and failure
 modes).

Boy oh boy is that an important statement!  I paraphrase it as "If you 
integrate PKI into a business process, in such a way that the process DEPENDS 
on the PKI working properly, you've just held your business process hostage 
to your PKI." 

Thus, as you say, the PKI needs to meet the requirements and not introduce 
new risk.  I don't think there is any way to introduce PKI into a process 
without introducing some new failure modes, but that just means you have to 
compensate for those failure modes to keep the risk acceptable.

All of which means to me that we need to be VERY cautious when trying to 
"improve" a process with PKI.  Remember that it can take as long (or longer) 
to remove automation from a process as it did to add it.

---

From: [email-masked]
Date: Wed, 15 Dec 1999 15:19:46 -0800

there is slightly related thread running in sci.crypt newsgroup ("Attacks on a
PKI")  ... i've archived some of my postings at:

http://www.garlic.com/~lynn/99.html#226
http://www.garlic.com/~lynn/99.html#228

the full thread is available from places like dejanews