Physical security is a critical aspect of cybersecurity that often gets overlooked, especially in home environments. The principle every security model rests on is simple: if an attacker has physical access to a device, they can bypass software controls. This means that with hands-on access, an attacker can boot from USB, remove drives, reset passwords, or add hardware. Even the most robust firewall rules are useless if someone can simply take your server home.
The "Evil Maid" Attack
The "evil maid" attack is a classic scenario where an unattended device, such as a laptop in a hotel room, is compromised by an attacker who has physical access. In this thought experiment, the "maid" boots the laptop from USB, modifies the boot chain without leaving traces, and you unknowingly type your disk password into a tampered bootloader upon returning to the machine. This attack generalizes to any unattended device: UNATTENDED + UNENCRYPTED = COMPROMISED UNTIL PROVEN OTHERWISE.
Protecting Data at Rest
Data protection at rest is crucial for maintaining security. Here are some methods, ranked by cost-effectiveness:
Full Disk Encryption: This should be enabled by default on all devices where possible. On Windows, use BitLocker; on macOS, FileVault; and on Linux, LUKS. Full disk encryption ensures that a stolen laptop or drive becomes useless to an attacker. This is the single highest-value action you can take in this area, and it costs nothing.
Firmware Passwords + Disabled USB Boot: Setting up firmware passwords and disabling USB boot adds another layer of security. It makes it more difficult for an attacker to tamper with the boot process, but still not impossible.
TPM + Secure Boot: Trusted Platform Module (TPM) and secure boot tie decryption keys to the hardware state of the machine. This prevents attackers from modifying the boot chain without being detected. This is a systemic fix for protecting against boot-chain tampering.
Homelab Server Considerations
Homelab servers often need to reboot unattended, which can conflict with full disk encryption. Here are some practical considerations:
- Encrypt Laptops and Offsite Backups Fully: Ensure that laptops and offsite backups are fully encrypted.
- Encrypt NAS Data Volumes: Encrypt the data volumes on network-attached storage (NAS) devices.
- Accept Risks for Onsite Servers: For servers in your physical lab, acknowledge that someone stealing the entire rack is a significant threat. However, you should be aware of this risk and have chosen to accept it.
Additional Security Measures
Here are some practical tips to enhance physical security:
- Locked Doors: Keep all devices locked away when not in use.
- Labeling Drives: Avoid labeling drives with sensitive information.
- Wiping or Destroying Drives: Properly erase or physically destroy drives before selling or disposing of them. Use tools like
blkdiscardorddfor HDDs, and physical destruction for highly sensitive data. - USB Ports on Kiosk Machines: Disable or cover USB ports on machines that are used as kiosks to prevent unauthorized access.
- Offsite Backups: Regularly back up data offsite to protect against theft.
By addressing these aspects of physical security, you can significantly reduce the risk of data breaches and ensure your devices remain secure.