Subject: Re: RFC 2527 Physical Security Controls Question

From: [email-masked]
Date: Tue, 14 Dec 1999 20:22:32 EST

John Kennedy and Lynn Wheeler both made excellent points about the potential 
need for absolute top-grade physical security in a commercial CA operation.  
It all seems to come down (as always) to risk assessment and balancing the 
cost of security against it's benefits.

In the commercial world, especially in the financial and medical sectors, the 
potential liability for a CA operator could be enormous, easily justifying 
the cost of physical security measures rivalling that found around weapons of 
mass destruction.

This brings up an interesting question though...  For a government, it's very 
easy to designate a resourse as being sufficiently valuable to authorize the 
use of deadly force to protect it - try to get close to a stealth aircraft 
sometime. For commercial applications, however, even where billions of 
dollars may be at stake, it's harder (if not impossible) to implement that 
final line of security.  

So for you non-government types, would your CA physical security include 
lethal defenses?  Can anyone think of any application for a non-government CA 
that would require such defenses?  I'm not talking about just armed guards 
here...  I'm talking about defenses that would kill an unauthorized 
individual who entered protected space BEFORE they did any damage besides 
entering that space. 

Timothy M. Metzinger
Technical Director
Drug Enforcement Administration
Office of Information Systems
(202) 307-9884
(888) 385-0705

---

From: Tony Bartoletti <[email-masked]>
Date: Tue, 14 Dec 1999 18:07:44 -0800

>individual who entered protected space BEFORE they did any damage besides 

Tim,

I'm a University of California employee, so I will assume I'm not a
"government type" :)

It occurs to me that structures warranting the kind of protection we
are talking about would have several layers to penetrate.  Consequently,
an intruder would likely have to reveal themselves as bearing lethal
means in the course of an attempted apprehension by the "guards".
If the intruder brandishes a gun, I don't believe the guards need an
act of congress to use deadly force.

So we are really talking about an "army-sized" assault upon a facility.
Here, perhaps there are issues to be addressed.  If a breach of the
perimeter causes inner safeguards to kick in, such as (well-marked)
electric fences, so-to-speak, are these means allowed?

In general, are there non-lethal means that are effective when
applied with sufficient extension? (tear gas, paralyzing fields, etc.)

Granted, if the facility could be taken out by a 500 lb bomb delivered
by a private plane, I don't think one will be able to fire anti-aircraft
munitions under threat, but then I'm not an expert in law ;)

___tony___

Tony Bartoletti                                             LL
IOWA Center                                              LL LL
Lawrence Livermore National Laboratory                LL LL LL
PO Box 808, L - 089                                   LL LL LL
Livermore, CA 94551-9900                              LL LL LLLLLLLL
phone: 925-422-3881   fax: 925-423-8081               LL LLLLLLLL
email: [email-masked]                                   LLLLLLLL

---

From: "Mike Davis" <[email-masked]>
Date: Tue, 14 Dec 1999 18:19:31 -0800

Tim,

Let's hope not!  Strong physical defenses on the order of a SCIF might well
represent an appropriate standard of physical security appropriate for a CA.
We are not talking about needing a huge facility here so the costs might in
fact be quite reasonable.  For the intrusion scenario, recall that the CA
key is protected by cryptographic methods as well.  The CA key should also
be protected within a tamper resistant module that would cause the key to
zeroize if attempts were made to open it.  This seems to work well enough
(is an accepted practice) for top secret keying material.  Would it really
be required to waste the CA compound and the intruder to protect theft of an
encrypted key?

Mike Davis
Senior Security Architect
SAIC
Center for Information Security Technology

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
Sent: Tuesday, December 14, 1999 5:23 PM
To: [email-masked]
Cc: [email-masked]
Subject: Re: RFC 2527 Physical Security Controls Question

In the commercial world, especially in the financial and medical sectors,
the
potential liability for a CA operator could be enormous, easily justifying
the cost of physical security measures rivalling that found around weapons
of
mass destruction.

This brings up an interesting question though...  For a government, it's
very

lethal defenses?  Can anyone think of any application for a non-government
CA

Timothy M. Metzinger
Technical Director

---

From: "John C. Kennedy" <[email-masked]>
Date: Tue, 14 Dec 1999 18:27:56 -0800

Lethal?  You mean like the deadly nerve gas that is released if you tamper
with a SafeKeyper box?
(I'm *joking*, maybe... :-)  Actually, Steve's plug for the SafeKeyper box
is quite appropriate.  It remains a very elegant piece of
crypto-engineering.

I'd prefer to see a system design that spread the the risk around rather
than require the protection of a single box-of-bits with lethal defenses.
I mean, try explaining to a 60 Minutes news team why the accidental
vaporization of the cleaning lady was an unfortunate result of maintaining
the integrity of your high-assurance, We-are-the-only-source-of-trust.com,
e-commerce CA.

If you start with the assumptions that (1) root keys have a low but
much-greater-than-zero chance of compromise and (2) that they will
probably need to be replaced at the least convenient time, you will
probably end up with a more robust system and a more survivable business
model.

-John

---

From: "Phillip M Hallam-Baker" <[email-masked]>
Date: Wed, 15 Dec 1999 10:40:30 -0500

> individual who entered protected space BEFORE they did any damage besides

What an utterly bizare idea. This is PKI, not James Bond. Dr No
might require such a security system but I can't see that such a
system would serve any commercial purpose.

I would be very suspicious about any such system. I would see it
as introducing the very serious threat of complacency. I am much
happier trusting concrete and steel than 007 type booby-trap gadgets.

It isn't as if disarming explosive devices is impossible. Security is
a function of the difficulty of disarming preventative devices rather
than the seriousness of a device being triggered.

Besides which I doubt that operating such a system would be legal
in most countries. Burglars don't have many legal rights but in
the UK at least use of lethal force is only permitted in self defence.
Defence of property is not a justification. Anyone building such a
device would (quite rightly) face a murder charge if it went off.

Even in Texas I suspect that the fire dept would have something to
say on the matter.

Rather than kill the attacker it would surely be a much simpler
matter to destroy any cryptographic keying material. This should
not in itself be a problem if there was an equally well protected
disaster recovery site. The principal risk is not destruction of
keying material but theft of keying material - particularly if it
was undetected.

The NSA is rumoured to use explosives in certain crytosystems. My
understanding is that the purpose was to destroy the keying material
and not to kill someone probing.

		Phill