In this lesson, we're going to be discussing
how threat actors attack
our organization's physical security
using something known as brute force.
When discussing the security of our organizations,
you'll often hear people use the term brute force
as a commonly used attack method.
Now, whether we're talking
about physical security or cybersecurity,
the term brute force really does refer to a type
of attack where access to a system is gained simply
by trying all the possibilities until you break through.
For example, if you're trying
to guess a person's four-digit bank card PIN,
you could begin by trying 0000.
If that didn't work, try 0001.
If that doesn't work, try 0002.
And you keep incrementing your guess one digit each time
until you finally figure out their PIN,
which could have been something like 1423.
Now, in this case, it could take you a lot of time
because you would try over 1,400 combinations
to finally get to 1423.
But the point here is that eventually,
you'll be able to guess that four-digit PIN
because there are only 10,000 possible combinations ranging
from 0000 to 9999.
Now, in the realm of physical security,
we often have a more specific meaning though
when we talk about a brute force attack
and is much more of a violent method
than you may have initially been guessing about.
Now, when we talk about brute force
in terms of physical security,
we are focused on forcible entry,
tampering with security devices,
confronting security personnel
and ramming a barrier with a vehicle.
First, we have forcible entry.
Now, forcible entry refers to the act
of getting unauthorized access to a space
by physically breaking or bypassing its barriers,
such as a window, a door, or a fence.
If an attacker is targeting a window, they might use a rock
or some heavy tools to shatter the glass.
Some more advanced attackers may even use a technique known
as glass cutting to create an entry point
by cutting a large hole into a large plane of glass
and then walking through that hole.
To prevent this type of brute force attack
against your windows, you should select reinforced
or laminated windows to provide better resistance
against these types of brute force attacks.
Another common barrier that brute force is used on is doors.
If your facility uses older or poorly constructed doors,
like those interior bedroom doors in your house,
they can actually be kicked in or broken down
with enough force by simply kicking it or punching it
or using a blunt tool like a battering ram.
Now, when it comes to doors,
the weakest point of a door is actually its lock.
So many brute force attacks simply focus
on breaking the lock off the door
and then they can simply open the door and walk through it.
To prevent this type of brute force attack,
you should select high strength doors with deadbolt locks,
metal frames, and a solid core.
Fences are another common physical security barrier,
but they can also be climbed, cut,
or even rammed down if they're not built
with robust materials.
Also, you can use electric or barbed wire in your fences
to provide some more protection, but a determined intruder
will still find ways to neutralize or bypass those things,
such as placing a rug over the top of a barbed wire fence
to be able to climb over the top of it
without cutting themself.
Second, we have tampering with security devices.
Now, brute force attacks aren't always about destruction
and instead, they sometimes
involve manipulating security devices
to create new vulnerabilities that could be exploited.
For example, a security gate is designed to control access
into your facility, but if an attacker can force them
to remain open using an object or tool,
this provides an easier way to bypass the security gate.
Similarly, security cameras and sensors can be blinded
with paint, lights or by using mirrors
to create a physical redirection of their line of sight.
Also, your sensors or alarms can be smashed or disabled,
which can render them useless.
To protect against these kinds of attacks,
the key is having redundancy
in your physical security measures.
By having multiple layers
or backups of your security measures, you can ensure
that if one line of defense is compromised by an attacker,
that your other defenses
are still going to remain operational and online.
Third, we have confronting security personnel.
Now, one of the most aggressive forms
of a brute force attack involves a direct confrontation
or attack of your organization's security personnel.
This is by far one of the most egregious attacks
that you're going to find
because it's not only a criminal act,
but can also be a life-threatening act
towards your security personnel.
Often, your attackers will employ distraction techniques,
physically assault your security guards, or even use weapons
to overpower your facility security guards
or other security staff
in order to gain access to a building.
To mitigate against this risk,
security personnel often undergo rigorous training
in both conflict resolution and self-defense.
Additionally, security staff
should always have a quick means
of communication to call for backup
or alert others of a potential security breach or attack.
Fourth and finally, we have ramming barriers with vehicles.
Now, this is another dramatic and destructive form
of brute force attack that's going to use a car, truck
or other motorized vehicle to ram
into the organization's physical security barriers,
like their fences, gates, or even the side of the building.
Most of our organizations aren't going to be subject
to this kind of attack
unless you work for the government, the military
or a particularly interesting target for an attacker,
something like a bank that has lots of money
or valuables on site.
Now, to help defend against this kind of an attack,
you should install bollards
or reinforce barriers to prevent vehicles
from being able to drive into your facilities.
These bollards are specifically designed to absorb
and dissipate the energy
of a fast moving vehicle that is crashing
into them in order to prevent the vehicle
from reaching its intended target,
like the inside of your facility.
So remember, brute force attacks
and physical security are a direct,
often violent approach to bypassing your security measures.
Brute force attacks exploit the physical vulnerabilities
of a system, whether it's through a window, a gate
or even a security guard to gain access to your facilities.
By understanding the different kinds of tactics
that an attacker could use to conduct a brute force attack,
you're going to be better prepared to develop a robust,
multi-layered physical security plan
to protect your data centers
and other organizational facilities.
Always remember, while brute force attacks
are considered to be a pretty direct and brute method,
their simplicity can often make them highly effective
as an attack method against poorly defended facilities.