Page 597 - StudyBook.pdf

Public Key Infrastructure • Chapter 10 581

the new directory you created, and wants to see what is in there. Joe can restore the
directory to another location, view the contents within the directory, and obtain a
copy of the private keys.As the security administrator, you can handle this problem
two different ways. First, you can enable auditing for the network OS.Auditing file
access, additions, deletions, and modifications, can track this type of activity within
the network. Likewise, permissions for the backup operator can be limited to
backup only, and require another party (such as the network administrator) to per-
form recoveries.
That’s why most software key storage schemes encrypt the private keys, using
some form of password or key prior to granting access.The password protecting
the private key is prompted for when the key is needed. Or the key is encrypted
using a key derived from the user’s logon password, such that a user’s keys all
become available when he or she is logged on, and are unavailable when he or she
is logged off, or to another person who is logged on. If the key is needed for a
background process (e.g., a service or a daemon), the key can be encrypted using a
machine-based secret. In Windows, this secret can be further protected by using the
SYSKEY utility.
There is another risk involved with the software storage of private keys.You
granted access to yourself and the company CIO, Phil. Phil has a bad habit of
leaving his computer without logging out or locking the screen via a screen saver.
Dave, the mail clerk, can easily walk into Phil’s office and look at all of the files and
directories that Phil has access to, thereby accessing the directory where the private
keys are stored.This type of attack is known as a lunchtime attack.The best fix for
lunchtime attacks is user education.Teaching users to properly secure their work-
station when not in use prevents many types of security breaches, including
lunchtime attacks.

Lunchtime Attacks
Damage & Defense… initiated by employees of an organization. But, they are also one of the
Lunchtime attacks are one of the most common types of internal attacks

easiest attacks to defend against. Most OSes (Windows, Linux, and so
forth) offer the ability to automatically lock desktops through screen-
savers that activate after a brief period of inactivity. For those companies
with “Phils” who constantly leave their computers unlocked, this is an
easy way to reduce the amount of lunchtime attacks. (Other types of
attacks are covered in detail in Chapter 2.)
There are other appropriate technological protections against this
type of attack, such as the use of locking screensavers and short timeouts;

Continued

www.syngress.com