LOCKS AND HIGH INSECURITY: PROTECTING CRITICAL INFRASTRUCTURE SECURITY VULNERABILITIES FOR MECHANICAL AND ELECTRONIC LOCKING SYSTEMS THAT ARE USED FOR PROTECTING CRITICAL ASSETS CRITICAL FACILITIES ♦ TRANSPORTATION –  AIRPORTS AND AIRPLANES ♦ FINANCIAL AND BANKING ♦ COMPUTRE SERVER CENTERS ♦ POWER GENERATION ♦ COMMUNICATIONS ♦ DEFENSE ♦ PUBLIC SAFETY HIGH SECURITY FACILITIES: HIGHER THREAT LEVEL ♦ INTRUSION ♦ SABOTAGE and VANDALISM ♦ THEFT OF CRITICAL AND HIGH- VALUE ASSETS ♦ TERRORISM ♦ ACCESS TO INFORMATION ♦ IDENTITY THEFT ♦ INTERRUPTION OF CRITICAL ESSENTIAL SERVICES LEGAL REQUIREMENTS: STATE, FEDERAL, REGULATORY ♦ FEDERAL STATUTES AND REGULATIONS ♦ STANDARDS COMPLIANCE ♦ COMMERCIAL AND INSURANCE ♦ DEFENSE DEPARTMENT ♦ DEPARTMENT OF ENERGY ♦ BANKING AND TREASURY LOCKS: FIRST LINE OF DEFENSE CONVENTIONAL AND HIGH SECURITY ♦  LOCKING SYSTEM: CATEGORIES –  MECHANICAL –  ELECTRO-MECHANICAL –  ELECTRONIC ♦  TREND: PHYSICAL SECURITY + I-T ♦  RELIANCE ON STANDARDS BY MOST FACILITIES TO SELECT WHICH LOCKS ARE SECURE ENOJUGH STANDARDS: THE PROBLEM ♦ WHAT DO THEY MEASURE? ♦ WHY WE NEED STANDARDS ♦ NOT “REAL WORLD” ♦ LIMITED PROTOCOL, FEW TESTS ♦ MECHANICAL BYPASS ♦ SPECIAL ATTACK TECHNIQUES FOR CERTIFIED LOCKS ♦ LOCK BUMPING ♦ KNOWLEDGEABLE ATTACKS LOCKS: SECURITY CRITERIA ♦ STANDARDS DEFINE CONVENTIONAL AND HIGH SECURITY ♦ THREAT CRITERIA –  FORCED ENTRY –  COVERT ENTRY –  KEY CONTROL ♦ STANDARDS ARE BASED UPON: –  TIME, TOOLS, TRAINING FORCED ENTRY PROTECTION: UL 437 and BHMA 156.30 Standards ♦ LOCKS ARE SECURE AGAINST FORCED METHODS OF ATTACK ♦ MINIMUM TIMES SPECIFIED IN UL 437 and BHMA/ANSI 156.30 –  ATTACK RESISTANCE: 5 MINUTES ♦ DOES NOT INCLUDE MANY METHODS OF ATTACK COVERT ENTRY PROTECTION: The Theory ♦ MINIMUM SECURITY CRITERIA IN UL 437 and BHMA/ANSI 156.30 ♦ PROTECT AGAINST CERTAIN FORMS OF COVERT ENTRY ♦ ASSURE MINIMUM RESISTANCE TIMES TO OPEN: 10-15 Minutes –  Picking, Decoding –  Bumping (not covered) –  Decoding and Master Key attacks STANDARDS: KEY CONTROL v. KEY SECURITY ♦ STANDARDS = LIMITED SECURITY ♦ ORGANIZATIONAL PROTECTION –  DUPLICATION OF KEYS –  KEYS BY CODE ON ORDER ♦ LEGAL PROTECTION –  AVAILABILITY OF BLANKS ♦ NOT ADDRESS TECHNICAL SECURITY OF KEYS