\section{Physical Security}

\begin{frame}
   {Hardware Accessibility Vulnerabilities}

   Hardware which is physically accessible can be
   compromised by:

   \begin{itemize}
      \item
      Key logging: Recording the real time activity of a
      computer user including the keys they press. The captured
      data can either be stored locally or transmitted to remote
      machines.
      \item
      Network sniffing: Capturing and viewing the network packet
      level data on your network.
      \item
      Booting with a live or rescue disk.
      \item
      Remounting and modifying disk content.
   \end{itemize}

\end{frame}

\cprotect\note{

   Physical access to a system makes it possible for
   attackers to easily leverage several attack vectors, in
   a way that makes all operating system level
   recommendations irrelevant.

   Thus, security policy should start with requirements on
   how to properly secure physical access to servers and
   workstations.

}

\begin{frame}
   {Hardware Access Guidelines}

   Protective steps include:
   \begin{itemize}
      \item
      Locking down workstations and servers.
      \item
      Protecting your network links against access by people
      you do not trust.
      \item
      Protecting your keyboards where passwords are entered to
      ensure the keyboards cannot be tampered with.
      \item
      Configuring password protection of the \textbf{BIOS} in
      such a way that the system cannot be booted with a live
      or rescue \textbf{CD/DVD} or \textbf{USB} key.
   \end{itemize}

\end{frame}

\cprotect\note{

   For single user computers and those in a home
   environment, some of the above features (like preventing
   booting from removable media) can be excessive, and you
   can avoid implementing them. However, if sensitive
   information is on your system that requires careful
   protection, either it should not be there, or it should
   be better protected by following the above guidelines.

}


\section{BIOS}
\begin{frame}
   {BIOS}

   \begin{itemize}
      \item Lowest level of security
      \item Use \textbf{BIOS} password
      \item Keep updated
   \end{itemize}

\end{frame}

\cprotect\note{

   The \textbf{BIOS} is the lowest level of software that
   configures or manipulates your system. The bootloader
   accesses the \textbf{BIOS} to determine how to boot up
   your machine.

   Setting a \textbf{BIOS} password protects against
   unauthorized persons changing the boot options to gain
   access to your system.  However, it only matters if
   someone can gain physical access to the machine as it
   requires a local presence.

   Also, it is generally recommended that the
   \textbf{BIOS} be kept patched to the latest version of
   the firmware.  However, most \textbf{BIOS} updates have
   nothing to do with security and system administrators
   have also been instructed to apply new \textbf{BIOS}
   only with care, as incompetent \textbf{BIOS} code has
   always been a plague, and unnecessary updates can
   render a system useless.

}


\section{Bootloader}
\begin{frame}
   {Bootloader}

   \begin{itemize}
      \item Use bootloader password
      \begin{itemize}
         \item Can be global or local (to a stanza)
      \end{itemize}
      \item Work in conjunction with \textbf{BIOS} password
      \begin{itemize}
         \item Will not stop attack with removable bootable media
      \end{itemize}
   \end{itemize}

\end{frame}

\cprotect\note{

   You can secure the boot process with a secure password
   to prevent someone from bypassing the user
   authentication step.  This can work in conjunction with
   password protection for the \textbf{BIOS}.

   Note that while using a bootloader password alone will stop a
   user from editing the bootloader configuration during
   the boot process, it will \textbf{not} prevent a user
   from booting from an alternative boot media such as
   optical disks or pen drives.  Thus, it should be used
   with a \textbf{BIOS} password for full protection.

   For the older \textbf{GRUB 1}, it was relatively easy to
   set a password for \textbf{grub}, but for the dominant
   \textbf{GRUB 2} version, things are more
   complicated. However, you have more flexibility and can
   do things like setting individual user-specific passwords
   (which can be the normal login ones.)

   Once again you should not edit \filelink{grub.cfg}
   directly. Rather you edit system configuration files in
   \filelink{/etc/grub.d} and then run
   \textbf{update-grub} or \textbf{grub2-mkconfig} and save
   the new configuration file.

   One explanation of this can be found at
   \url{https://help.ubuntu.com/community/Grub2/Passwords}.

}


