1 00:00:00,090 --> 00:00:01,920 In this lesson, we're going to be discussing 2 00:00:01,920 --> 00:00:03,150 how threat actors attack 3 00:00:03,150 --> 00:00:04,920 our organization's physical security 4 00:00:04,920 --> 00:00:07,470 using something known as brute force. 5 00:00:07,470 --> 00:00:09,630 When discussing the security of our organizations, 6 00:00:09,630 --> 00:00:12,000 you'll often hear people use the term brute force 7 00:00:12,000 --> 00:00:14,160 as a commonly used attack method. 8 00:00:14,160 --> 00:00:15,210 Now, whether we're talking 9 00:00:15,210 --> 00:00:17,370 about physical security or cybersecurity, 10 00:00:17,370 --> 00:00:19,650 the term brute force really does refer to a type 11 00:00:19,650 --> 00:00:22,110 of attack where access to a system is gained simply 12 00:00:22,110 --> 00:00:25,410 by trying all the possibilities until you break through. 13 00:00:25,410 --> 00:00:26,760 For example, if you're trying 14 00:00:26,760 --> 00:00:29,100 to guess a person's four-digit bank card PIN, 15 00:00:29,100 --> 00:00:31,590 you could begin by trying 0000. 16 00:00:31,590 --> 00:00:34,320 If that didn't work, try 0001. 17 00:00:34,320 --> 00:00:36,750 If that doesn't work, try 0002. 18 00:00:36,750 --> 00:00:39,120 And you keep incrementing your guess one digit each time 19 00:00:39,120 --> 00:00:40,860 until you finally figure out their PIN, 20 00:00:40,860 --> 00:00:43,770 which could have been something like 1423. 21 00:00:43,770 --> 00:00:46,350 Now, in this case, it could take you a lot of time 22 00:00:46,350 --> 00:00:48,630 because you would try over 1,400 combinations 23 00:00:48,630 --> 00:00:50,820 to finally get to 1423. 24 00:00:50,820 --> 00:00:52,650 But the point here is that eventually, 25 00:00:52,650 --> 00:00:54,690 you'll be able to guess that four-digit PIN 26 00:00:54,690 --> 00:00:57,660 because there are only 10,000 possible combinations ranging 27 00:00:57,660 --> 00:01:01,290 from 0000 to 9999. 28 00:01:01,290 --> 00:01:03,150 Now, in the realm of physical security, 29 00:01:03,150 --> 00:01:05,250 we often have a more specific meaning though 30 00:01:05,250 --> 00:01:07,230 when we talk about a brute force attack 31 00:01:07,230 --> 00:01:08,910 and is much more of a violent method 32 00:01:08,910 --> 00:01:11,070 than you may have initially been guessing about. 33 00:01:11,070 --> 00:01:12,540 Now, when we talk about brute force 34 00:01:12,540 --> 00:01:13,980 in terms of physical security, 35 00:01:13,980 --> 00:01:15,930 we are focused on forcible entry, 36 00:01:15,930 --> 00:01:17,340 tampering with security devices, 37 00:01:17,340 --> 00:01:18,810 confronting security personnel 38 00:01:18,810 --> 00:01:21,210 and ramming a barrier with a vehicle. 39 00:01:21,210 --> 00:01:23,190 First, we have forcible entry. 40 00:01:23,190 --> 00:01:25,080 Now, forcible entry refers to the act 41 00:01:25,080 --> 00:01:27,090 of getting unauthorized access to a space 42 00:01:27,090 --> 00:01:29,640 by physically breaking or bypassing its barriers, 43 00:01:29,640 --> 00:01:32,040 such as a window, a door, or a fence. 44 00:01:32,040 --> 00:01:34,950 If an attacker is targeting a window, they might use a rock 45 00:01:34,950 --> 00:01:37,200 or some heavy tools to shatter the glass. 46 00:01:37,200 --> 00:01:39,870 Some more advanced attackers may even use a technique known 47 00:01:39,870 --> 00:01:42,090 as glass cutting to create an entry point 48 00:01:42,090 --> 00:01:44,790 by cutting a large hole into a large plane of glass 49 00:01:44,790 --> 00:01:46,800 and then walking through that hole. 50 00:01:46,800 --> 00:01:48,450 To prevent this type of brute force attack 51 00:01:48,450 --> 00:01:50,730 against your windows, you should select reinforced 52 00:01:50,730 --> 00:01:53,070 or laminated windows to provide better resistance 53 00:01:53,070 --> 00:01:55,590 against these types of brute force attacks. 54 00:01:55,590 --> 00:01:58,770 Another common barrier that brute force is used on is doors. 55 00:01:58,770 --> 00:02:01,800 If your facility uses older or poorly constructed doors, 56 00:02:01,800 --> 00:02:04,050 like those interior bedroom doors in your house, 57 00:02:04,050 --> 00:02:06,120 they can actually be kicked in or broken down 58 00:02:06,120 --> 00:02:08,699 with enough force by simply kicking it or punching it 59 00:02:08,699 --> 00:02:11,190 or using a blunt tool like a battering ram. 60 00:02:11,190 --> 00:02:12,450 Now, when it comes to doors, 61 00:02:12,450 --> 00:02:14,820 the weakest point of a door is actually its lock. 62 00:02:14,820 --> 00:02:16,950 So many brute force attacks simply focus 63 00:02:16,950 --> 00:02:18,540 on breaking the lock off the door 64 00:02:18,540 --> 00:02:21,660 and then they can simply open the door and walk through it. 65 00:02:21,660 --> 00:02:23,520 To prevent this type of brute force attack, 66 00:02:23,520 --> 00:02:26,310 you should select high strength doors with deadbolt locks, 67 00:02:26,310 --> 00:02:28,320 metal frames, and a solid core. 68 00:02:28,320 --> 00:02:30,780 Fences are another common physical security barrier, 69 00:02:30,780 --> 00:02:32,310 but they can also be climbed, cut, 70 00:02:32,310 --> 00:02:33,990 or even rammed down if they're not built 71 00:02:33,990 --> 00:02:35,460 with robust materials. 72 00:02:35,460 --> 00:02:38,340 Also, you can use electric or barbed wire in your fences 73 00:02:38,340 --> 00:02:41,220 to provide some more protection, but a determined intruder 74 00:02:41,220 --> 00:02:44,490 will still find ways to neutralize or bypass those things, 75 00:02:44,490 --> 00:02:47,070 such as placing a rug over the top of a barbed wire fence 76 00:02:47,070 --> 00:02:48,450 to be able to climb over the top of it 77 00:02:48,450 --> 00:02:50,220 without cutting themself. 78 00:02:50,220 --> 00:02:53,010 Second, we have tampering with security devices. 79 00:02:53,010 --> 00:02:55,560 Now, brute force attacks aren't always about destruction 80 00:02:55,560 --> 00:02:56,760 and instead, they sometimes 81 00:02:56,760 --> 00:02:58,680 involve manipulating security devices 82 00:02:58,680 --> 00:03:01,320 to create new vulnerabilities that could be exploited. 83 00:03:01,320 --> 00:03:04,170 For example, a security gate is designed to control access 84 00:03:04,170 --> 00:03:06,930 into your facility, but if an attacker can force them 85 00:03:06,930 --> 00:03:09,120 to remain open using an object or tool, 86 00:03:09,120 --> 00:03:12,390 this provides an easier way to bypass the security gate. 87 00:03:12,390 --> 00:03:15,180 Similarly, security cameras and sensors can be blinded 88 00:03:15,180 --> 00:03:17,130 with paint, lights or by using mirrors 89 00:03:17,130 --> 00:03:20,160 to create a physical redirection of their line of sight. 90 00:03:20,160 --> 00:03:23,400 Also, your sensors or alarms can be smashed or disabled, 91 00:03:23,400 --> 00:03:25,110 which can render them useless. 92 00:03:25,110 --> 00:03:26,940 To protect against these kinds of attacks, 93 00:03:26,940 --> 00:03:28,200 the key is having redundancy 94 00:03:28,200 --> 00:03:29,970 in your physical security measures. 95 00:03:29,970 --> 00:03:30,990 By having multiple layers 96 00:03:30,990 --> 00:03:33,270 or backups of your security measures, you can ensure 97 00:03:33,270 --> 00:03:35,760 that if one line of defense is compromised by an attacker, 98 00:03:35,760 --> 00:03:36,690 that your other defenses 99 00:03:36,690 --> 00:03:39,630 are still going to remain operational and online. 100 00:03:39,630 --> 00:03:42,450 Third, we have confronting security personnel. 101 00:03:42,450 --> 00:03:43,950 Now, one of the most aggressive forms 102 00:03:43,950 --> 00:03:46,680 of a brute force attack involves a direct confrontation 103 00:03:46,680 --> 00:03:49,530 or attack of your organization's security personnel. 104 00:03:49,530 --> 00:03:51,660 This is by far one of the most egregious attacks 105 00:03:51,660 --> 00:03:52,530 that you're going to find 106 00:03:52,530 --> 00:03:54,030 because it's not only a criminal act, 107 00:03:54,030 --> 00:03:55,770 but can also be a life-threatening act 108 00:03:55,770 --> 00:03:57,540 towards your security personnel. 109 00:03:57,540 --> 00:04:00,240 Often, your attackers will employ distraction techniques, 110 00:04:00,240 --> 00:04:02,670 physically assault your security guards, or even use weapons 111 00:04:02,670 --> 00:04:04,830 to overpower your facility security guards 112 00:04:04,830 --> 00:04:06,060 or other security staff 113 00:04:06,060 --> 00:04:08,070 in order to gain access to a building. 114 00:04:08,070 --> 00:04:09,480 To mitigate against this risk, 115 00:04:09,480 --> 00:04:11,820 security personnel often undergo rigorous training 116 00:04:11,820 --> 00:04:14,490 in both conflict resolution and self-defense. 117 00:04:14,490 --> 00:04:15,840 Additionally, security staff 118 00:04:15,840 --> 00:04:17,100 should always have a quick means 119 00:04:17,100 --> 00:04:18,810 of communication to call for backup 120 00:04:18,810 --> 00:04:22,140 or alert others of a potential security breach or attack. 121 00:04:22,140 --> 00:04:25,470 Fourth and finally, we have ramming barriers with vehicles. 122 00:04:25,470 --> 00:04:27,690 Now, this is another dramatic and destructive form 123 00:04:27,690 --> 00:04:30,330 of brute force attack that's going to use a car, truck 124 00:04:30,330 --> 00:04:32,280 or other motorized vehicle to ram 125 00:04:32,280 --> 00:04:34,650 into the organization's physical security barriers, 126 00:04:34,650 --> 00:04:37,620 like their fences, gates, or even the side of the building. 127 00:04:37,620 --> 00:04:39,540 Most of our organizations aren't going to be subject 128 00:04:39,540 --> 00:04:40,590 to this kind of attack 129 00:04:40,590 --> 00:04:42,540 unless you work for the government, the military 130 00:04:42,540 --> 00:04:45,000 or a particularly interesting target for an attacker, 131 00:04:45,000 --> 00:04:46,770 something like a bank that has lots of money 132 00:04:46,770 --> 00:04:48,330 or valuables on site. 133 00:04:48,330 --> 00:04:50,580 Now, to help defend against this kind of an attack, 134 00:04:50,580 --> 00:04:51,720 you should install bollards 135 00:04:51,720 --> 00:04:53,760 or reinforce barriers to prevent vehicles 136 00:04:53,760 --> 00:04:56,130 from being able to drive into your facilities. 137 00:04:56,130 --> 00:04:58,320 These bollards are specifically designed to absorb 138 00:04:58,320 --> 00:04:59,460 and dissipate the energy 139 00:04:59,460 --> 00:05:01,470 of a fast moving vehicle that is crashing 140 00:05:01,470 --> 00:05:03,420 into them in order to prevent the vehicle 141 00:05:03,420 --> 00:05:04,830 from reaching its intended target, 142 00:05:04,830 --> 00:05:07,080 like the inside of your facility. 143 00:05:07,080 --> 00:05:08,910 So remember, brute force attacks 144 00:05:08,910 --> 00:05:10,470 and physical security are a direct, 145 00:05:10,470 --> 00:05:13,890 often violent approach to bypassing your security measures. 146 00:05:13,890 --> 00:05:16,170 Brute force attacks exploit the physical vulnerabilities 147 00:05:16,170 --> 00:05:18,570 of a system, whether it's through a window, a gate 148 00:05:18,570 --> 00:05:21,720 or even a security guard to gain access to your facilities. 149 00:05:21,720 --> 00:05:23,400 By understanding the different kinds of tactics 150 00:05:23,400 --> 00:05:25,890 that an attacker could use to conduct a brute force attack, 151 00:05:25,890 --> 00:05:27,930 you're going to be better prepared to develop a robust, 152 00:05:27,930 --> 00:05:29,940 multi-layered physical security plan 153 00:05:29,940 --> 00:05:31,110 to protect your data centers 154 00:05:31,110 --> 00:05:33,180 and other organizational facilities. 155 00:05:33,180 --> 00:05:35,160 Always remember, while brute force attacks 156 00:05:35,160 --> 00:05:37,410 are considered to be a pretty direct and brute method, 157 00:05:37,410 --> 00:05:39,900 their simplicity can often make them highly effective 158 00:05:39,900 --> 00:05:42,753 as an attack method against poorly defended facilities.