In this lesson, we're going to explore
the physical security control measures known as door locks.
Now, all of your perimeter physical security defenses
that you're going to be using to protect
your organization's facilities
are going to become useless at some point.
Do you know when that point is?
Well, it's the moment
that somebody has entered your building.
That's right.
We can install a large electrified fence
with barbed wire across the top.
We can install large steel or cement bollards
outside our offices to keep cars
from getting too close to the building.
We can install surveillance cameras
around the perimeter and throughout our parking lots.
We can have roving security guards
with guns walking around the perimeter of the building.
We can install access control vestibules
at the entry point of our buildings.
And we can even place armed security guards in our lobby.
But once that person crosses through our lobby
and is able to access our secure spaces,
they're now roaming freely through our halls
and looking for areas that they can exploit
inside of our organizations to access our sensitive data.
So how do we keep people out of those offices
that can contain sensitive information?
Well, quite simply,
we use door locks.
Now, door locks are physical security controls
that are designed to secure entryways by restricting
and regulating access to a particular space or property.
These door locks can act as a primary barrier
against unauthorized intrusions to ensure
that only individuals with the appropriate key, code,
or access method can open the lock and gain entry.
These door locks really do play a foundational role
in safeguarding your digital assets,
information, and individuals
from potential threats or unauthorized access.
Now, these door locks are often placed
on the outside of the building's main entrance
as well as inside the building
on different server room doors, network closets,
and other areas we want to remain safe and secure.
Unfortunately though, not all door locks are created equal,
and some are going to offer us higher levels
of protection than others.
For example, I've seen many people who use
a simple padlock to try to secure their network closet
that contains sensitive equipment,
like routers and switches,
or to secure a filing cabinet that contains classified
or proprietary information.
The problem is that a skilled attacker can defeat a padlock
in about 15 seconds or less.
Don't believe me.
Let me prove it to you right now.
So to do this demonstration, we're going to use four things.
I have a standard padlock.
I have the keys for that padlock.
I have a lock pick.
In this case, it is a single lock pick
that will have one single tooth
that will try to move the pins up and down.
And I have a tension wrench.
So first I'll show you that the standard padlock,
and you can see this is see-through
so you can actually see inside of it
we're going to put the key in just like we normally would,
we will open it, and you can see it's just a standard lock,
it opens to the right.
And if we take the key out, we can lock it again.
So now what we're going to do is we're going to take
the tension wrench and we're going to place it
into the keyhole at the bottom.
Now when we go to open the lock,
we want to be able to turn it to the right.
So I'm going to constantly apply just a little bit of pressure
with my pinky to hold that in place.
And then I'm going to use the lock pick
and I'm going to pick each of those six pins
to find the right place for them.
And once we get them right, the lock will open.
You can see just how quickly
and easily it is to be able to pick a lock in this manner.
All right, so as you can probably guess by now,
I'm not a big fan of padlocks
because they are not very good for our security.
These padlocks use a basic pin and tumbler system
that is really easy to defeat if you know what you're doing.
But many door locks simply aren't much better.
Because most door locks,
like the one on your bedroom or bathroom door,
you can simply defeat that by sticking
a long and slender rod or needle into that hole,
and it'll simply pop open.
If you have a lock with a flat slot on it
then you can actually use a flathead screwdriver
or a coin from your pocket to unlock
those simple door locks.
But most of us are going to use a more complicated door lock,
like the one on the front of your house.
And if you look at that one,
it uses a traditional key to lock and unlock the door.
Well, these are a little bit more complicated
than a standard padlock,
but they can still be defeated using the same techniques
in about 30 to 60 seconds by most skilled attackers.
Thankfully though, more complex types of door locks
are also available to us.
And many of the door locks on the markets these days
use electronic mechanisms to provide better protection,
such as using an identification number, a wireless signal,
or some kind of biometric to unlock or lock that door.
Now, one of the most commonly used
electronic door locks you're going to find is ones
that rely on an identification number.
For example, at my recording studio
we have an electronic door lock that uses
an eight digit personal identification number
to allow our instructors to go into or out of our studios.
Since it uses an eight digit number
there's a 1 in 100 million chance
that somebody could randomly guess my identification number.
Also, these locks can also be configured
so that each person is using
their own unique identification number to access our studio.
This way, we can actually log all of that access
into our entry log as a form of auditing
and accounting so we know who is in the studio
and at what time.
Another commonly used technology
with door locks is wireless signals.
For example, at my home
I can open my front door using my smartphone
by tapping it to the front door to unlock it
and sending out a NFC, or Near Field Communication signal,
and the door will then unlock,
based on the fact that I have my smartphone.
Alternatively, I also have seen locks that use wifi,
Bluetooth, and RFID to be able to lock or unlock your doors.
Another commonly used form of authentication
with modern door locks is the use of biometrics,
like facial recognition scans
or fingerprint identification scans.
In fact, my server room door here at the offices
actually uses a biometric lock that allows me to lock
or unlock that door simply using my index finger.
Similarly to a personal identification number,
we can also configure this lock
to use each person's own fingerprint,
and then each entry or exit is logged for accounting
and auditing purposes based on that fingerprint.
Now, biometrics relies on your physical characteristics
to identify a person properly,
and this is most commonly done using
something like a fingerprint,
scanning the retina inside of your eye,
or by measuring the distance between different parts
of your face when conducting a facial recognition scan.
All these are considered to be an inherence factor
or something you are in terms
of the five factors of authentication.
Now, when we talk about biometrics
what we're really focusing on here is
that something you are, because this is a part of you,
it's your eye, it's your fingerprint,
it's your voice, it's something that is innately
a part of your ability and part of you as a person.
Now, when we talk about fingerprints,
fingerprints have become
a really common identification system.
And at this point it's gone beyond door locks
and now it's integrated into most of our smartphones,
tablets, and laptops as well
for us to be able to log into our devices.
For example, if you have an iPhone
that's between a 5s model all the way up through
the 8 series, those used a thumbprint login called Touch ID.
Whenever you press your index finger
or your thumb to the sensor, it's going to be able to read that
and then identify you and log you in.
Now in newer iPhones though,
they've done away with touch ID
and instead they're now using face ID.
So if you have an iPhone 10 or newer
they actually have a front facing camera
that will scan your face and measure the distance between
different areas of your face to uniquely identify you.
This allows you to just hold up
the phone in front of you
and then log you in automatically by identifying
that it is you who's holding that particular phone.
Now, these types of devices are also being integrated
into our door locks and physical access control systems too,
like our access control vestibules.
I used to work in one high security area where every day
I had to use a retinal scanner
to gain access to that facility.
I've also worked in places that simply used
a fingerprint or a PIN that allowed me
to get through that access control vestibule.
It really does depend on how your system wants
to be set up and how much security your organization needs
based on the information it's trying to protect.
Now, when it comes to biometrics,
we do have a couple of challenges that we need to focus on,
and namely this comes down
to the acceptance and rejection rates.
Obviously, since we're using biometrics
as a form of authentication,
we should be worried about its False Acceptance Rate.
The False Acceptance Rate, also known as the FAR,
is the rate that the system authenticates a user as valid,
even though that person should not have been granted access
to the system.
For example, if you walked up to the fingerprint reader,
placed your finger on it,
and it accepts you because the system thought you were me,
that would be considered a false acceptance.
To prevent unauthorized people
from entering the building or using our systems,
we want to ideally get that False Acceptance Rate
down to zero by increasing the sensitivity of our scanners.
Now, on the other side of the spectrum
we also have a false rejection.
Now, a lot of people think
that a false rejection is not a problem,
but this is actually just as big of a problem for us
as a false acceptance.
Let's go back to that last example.
Let's say I increase the sensitivity
of the fingerprint scanner to attempt to eliminate
all of the False Acceptance Rates, or FAR,
that we were getting so that way
I can make sure nobody's getting in the system
except those who are authorized to do it.
The problem with this is that I may inadvertently
also increase my False Rejection Rate, or FRR,
because the scanner is now too sensitive.
A false rejection is going to occur
anytime the biometric system denies a user
who should have been allowed access to the system.
So using the login with the finger as an example,
let's assume you're able to log in as me
using your fingerprint.
Now I increase the sensitivity up to the highest level.
Now when you try to log in, it's going to reject you
and there are no more false acceptances happening.
But about half the time when I try to log in
I'm also being rejected,
even though I'm supposed to be authorized.
Now, this is the idea of a false rejection
and why it's also considered to be a big problem for us,
because it's failing to allow me
to authenticate half of the time,
which means half of the time I can't get into the building
to do my job.
So how can I perfectly tune the system
to eliminate the false acceptance and the false rejections?
Well, we try to achieve a good balance
between these by where we find the False Acceptance Rate
and the False Rejection Rate becoming equal.
This equal point is known as the Equal Error Rate,
or EER, but most commonly you'll hear people
call this the Crossover Error Rate,
or CER, out in the cybersecurity industry.
This is because your False Acceptance Rate
and your False Rejection Rate are intersecting
at that specific point where they're equal,
which is the Crossover Error Rate.
This Crossover Error Rate is really important
because it's used as a measure
as the effectiveness of a given biometric system.
So if you're going out there looking
to purchase a fingerprint enabled lock,
you want to make sure you're checking
what is the Crossover Error Rate,
and you can use this as a factor in your decision making.
The lower the Crossover Error Rate
the better that lock is going to be.
You don't want one that has a huge error
to the positive side or the negative side.
Instead, we want to have a good Crossover Error Rate
so that we are letting the people in
that are supposed to be authenticated
and rejecting those who should not be allowed
into our system.
Now, many of these modern electronic door locks
will also combine multiple authentication factors
to give you additional security to be able
to protect that area.
For example, my server room door can be configured
to use an eight digit personal identification number
and your fingerprint together
as a multi-factor authentication system
before you're allowed into that room.
For more complex setups,
such as trying to gain entry to your office building
through an access control vestibule
that uses an electronic access system.
You'll also find that some of these are going to
be fully automated using an electronic badge
and PIN system to validate the person's authorization
to go into that building.
So you may find that as you enter into an office building
there's an open lobby that anybody can access,
but then there's a set of turnstiles
and you'll have to scan your badge
and input your PIN number to be able
to go past those turnstiles.
That area between the front door and the turnstiles,
well, that's considered an access control vestibule,
under the design of that particular lobby.
Once you get past those turnstiles
you're now in the secure area because you've now
been authenticated using multifactor authentication
by having a token, your identification badge,
and a PIN that you entered in,
which is something you have and something you know.
Now, the final type of door lock you should aware of
is an older type of lock known as a cipher lock.
A cipher lock provides excellent protection
using a mechanical locking mechanism
with push buttons that are numbered
and require a person to enter the correct combination
in order to open that door.
These are often used on server rooms, network closets,
and other high security locations.
They do tend to cost a little bit more
than a traditional office lock,
but they do have the ability to give you
a higher level of protection too.
In fact, the Dion Training offices
uses a mechanical cipher lock on our front door
to our building and requires that you enter
an eight eight digit identification number
in order to unlock our door.
Now remember, door locks are
an important physical security control measure
that you're going to be able to use to protect
your sensitive data and systems out in the real world.
While organizations invest heavily
in external security measures, such as electrified fences,
surveillance cameras, and security personnel,
the actual moment of vulnerability arises
when unauthorized individuals gain access
to the building's interior.
Door locks can serve as a primary defense mechanism
to restrict unauthorized access
to your most sensitive of spaces.
However, not all door locks offer
the same protection levels.
Traditional padlocks
and basic door locks can easily be defeated
in about 60 seconds or less.
Whereas modern electronic door locks,
which rely on identification numbers, wireless signals,
or biometrics, can offer more robust forms of security.
The effectiveness of the biometric systems is measured
by their False Acceptance Rate and the False Rejection Rate,
and you should aim
for a balanced Crossover Error Rate to achieve the best mix
of security and convenience for your organization
when using a biometric powered lock.
The combination of multiple authentication factors,
such as using a fingerprint and a PIN
or an access card and a PIN,
can also increase your physical security posture.
We also talked about various types of door locks
including mechanical cipher locks,
sophisticated vestibule systems,
and other forms of electronic door locks
that authenticate individuals before granting them access
to your secure areas to better protect your data.