Re: Do I have to set another password in the CMOS setting to enhance the security of OS?

From: Alun Jones [MSFT] (alunj_at_online.microsoft.com)
Date: 04/20/05 

Date: Wed, 20 Apr 2005 10:13:02 -0700

"Frank Saunders, MS-MVP IE/OE" <franksaunders@mvps.org> wrote in message
news:OhGrt6bRFHA.3560@TK2MSFTNGP14.phx.gbl...
> "andy smart" <anonymus@discussions.microsoft.com> wrote in message
> news:d4539o$7i7$1@newsfeed.th.ifl.net
>> Indeed, but frankly if somebody has that level of physical access + time
>> + inclination no level of security is going to defete them!
>
> True.

Oh, I don't know...

EFS would certainly be of great use there - as some of the posters here have
found, there's essentially no way to crack it if you don't have the right
credentials in hand. As such, you need to consider it as a measure that
says "I would rather lose this copy of the data than have the wrong person
access it" - the phrasing is deliberately intended to make you think about
backing up EFS-protected files.

Heading more towards either science fiction or military hardware, there are
some devices that endeavour to be "tamper-proof" by destroying themselves
when they detect that some physical attack is in progress.

But yes, one of the "ten immutable laws" is that physical access beats
everything. Physical access risks can be mitigated - through secure
encryption, for instance, or by having such physical access monitored and
logged through a security camera.

Even using encryption is a kind of a gamble, though - today's encryption may
be crackable with tomorrow's hardware or mathematics. Encryption is often
described in terms of protecting data for longer than the time over which
that data is valuable. If I can decrypt a file in six months, but the
information in the file is only useful for three months, then the file is
useless to me as an attacker.

If an attacker can decrypt your credit card number in six months of
attacking a file, though, the attacker will get some benefit.

Alun.
~~~~ 

-- 
Software Design Engineer, Internet Information Server (FTP)
This posting is provided "AS IS" with no warranties, and confers no rights.

Relevant Pages

  • Re: Do I have to set another password in the CMOS setting to enhance the security of OS?
    ... Alun Jones wrote: ... Physical access risks can be mitigated - through secure ... > Even using encryption is a kind of a gamble, ... > useless to me as an attacker. ...
    (microsoft.public.security)
  • Re: How secure are my files?
    ... the ONLY protection the OS can offer against an attacker with ... Without EFS, there are any number of utilities to ... Also note that once an intruder has had physical access to the machine, ... > the part about backing up encryption keys and Recovery Agents. ...
    (microsoft.public.windowsxp.security_admin)
  • Vulnerability in encrypted loop device for linux
    ... An attacker is able to modify the content of the encrypted device ... considered a aim of the encryption mode, so most modes (e.g. ECB, CFB, ... As we need to authenticate the device across mounts and not while it is ... It slows down mount operations but they are ...
    (Bugtraq)
  • [UNIX] Vulnerability in Encrypted Loop Device for Linux
    ... Encrypting a disk device aims to protect against an off-line attacker who ... The encryption mode used by encrypted loop device is CBC. ... We propose 2 types of fixes: one that authenticate at mount time (see ...
    (Securiteam)
  • Re: Question about rsync
    ... The most important aspect of security is improving your weakest links - when you are at the stage that the easiest methodof attack is physical, or personal, then your job as IT security is pretty much done. ... It makes sense to take easy steps to increase security if you can - an attacker might not have the same opinion about the easiest methodof attack as you. ... but it contains information about an algorithm aimed precisely at transferring only those parts of a file that have changed. ... So unless you are doing a backup of a nuclear missile design, encryption on an rsync backup will only make a realistic difference if your network topology is such that the traffic is accessible by more people. ...
    (comp.os.linux.networking)