Physical information security is concerned with physically protecting data and means to access that data (apart from protecting it electronically). Many individuals and companies place importance in protecting their information from a software and/or network perspective, but fewer devote resources to protecting data physically. However, physical attacks to acquire sensitive information do frequently occur. Sometimes these attacks are considered a type of social engineering

Social engineering (security)

Social engineering is commonly understood to mean the art of manipulating people into performing actions or divulging confidential information...

.

Background

Many individuals and companies consider it important to protect their information for a variety of reasons, including financial, competitive, and privacy-related purposes. People who wish to obtain this information may be computer crackers, corporate spies

Industrial espionage

Industrial espionage, economic espionage or corporate espionage is a form of espionage conducted for commercial purposes instead of purely national security purposes...

, or other malicious individuals. This information may be directly beneficial to them, such as industrial secrets or credit card numbers. It may also be indirectly beneficial to them. For example, computer passwords do not have inherent value. However, they provide computer system access that may be used to get other information or to disable a person/company electronically. Sometimes these malicious individuals use electronic means or social engineering

Social engineering (security)

Social engineering is commonly understood to mean the art of manipulating people into performing actions or divulging confidential information...

 to gain information. However, sometimes they use direct physical attacks.

Examples of physical attacks to obtain information

There are several ways to obtain information through physical attacks or exploitations. A few examples are described below.

Dumpster diving

Dumpster diving

Dumpster diving

Dumpster diving is the practice of sifting through commercial or residential trash to find items that have been discarded by their owners, but that may be useful to the dumpster diver.-Etymology and alternate names:...

 is the practice of searching through the trash of an individual or business in attempt to obtain something useful. In the realm of information security

Information security

Information security means protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, perusal, inspection, recording or destruction....

, this frequently means looking for documents containing sensitive information. However, as more and more information is being stored electronically, it is becoming increasingly useful to those seeking information through this means to search for computer disks or other computer hardware which may contain data. Sometimes this data can be restored to provide a wealth of information.

Overt document stealing

Sometimes attackers will simply go into a building and take the information they need. Frequently when using this strategy, an attacker will masquerade as someone who belongs in the situation. The thief may pose as a copy room employee, remove a document from someone's desk, copy the document, replace the original, and leave with the copied document. Alternatively, the individual may pose as a janitor, systematically collecting information and "throwing it away." The individual may then be able to walk right out of the building with a trash bag containing documents that were left out in the open or a sticky note which had been left in a partially open desk drawer on which a user had written his/her passwords.

Common Physical Information Security Practices

There are many practices commonly used to decrease the possibility of success for these kind of attacks. Document shredding has become common, and the practice is still growing. Also electronic storage media are often prepared for disposal by purging

Data remanence

Data remanence is the residual representation of data that remains even after attempts have been made to remove or erase the data. This residue may result from data being left intact by a nominal file deletion operation, by reformatting of storage media that does not remove data previously written...

, which erases files which may have been "deleted" by an operating system but never overwritten with other data.

Many choose to restrict access to areas where information is kept to those possessing a proper identification badge and/or other form of authorization. This attempts both to decrease the ease with which someone could access documents and to decrease the possibility of someone physically tampering with computer equipment. Along the same lines, many companies train their employees to physically protect documents and other sources of sensitive information on an individual level by locking the information in a file cabinet or by some other means. Also, companies request that employees memorize their passwords rather than writing them down as the paper with the password could be seen or stolen.