UW Computer Security Research and Course Blog

Summary:

The physical system I am reviewing is the prototypical home security system. These systems are used to provide an increased sense of security (compared to only door and window locks), and provide a guarantee against more professional break-in attempts. By professional, I am mean to define the skill with which an adversary would enter and exit without leaving evidence behind. A professional would be able to enter and exit undetected. Such a system would have window and door sensors, as well as disaster monitoring and reporting to a central office. Each sensor is attached to a door or window, and is able to detect if it has been opened. If the system is armed and the sensors or disaster systems are activated, a siren will sound and the central monitoring office would be notified.

Assets and Goals:

– The goal of this system is to protect the assets by deterring unauthorized entry into the house.

– The assets of this system are the safety of the family, their belongings, and the house itself.

Adversaries and Threats:

– An adversary of this system would be a criminal interested in stealing or attacking the family. The threat presented by this adversary is personal safety and loss of material possessions.

– Another adversary is someone inside trying to get out; potentially a teenager with a curfew. The threat here is that the safety of the teenager cannot be ensured if his or her parents are unaware. It would also leave an opening for the first type of adversary to enter.

– Nature may also be considered an adversary because of fire, flood, and wind.

Potential Weaknesses:

– Security could be compromised from the inside by an escaping teenager or careless parent that doesn’t arm the system.

– These systems tend to only include a few sensors, so it may not be possible to protect every door and window.

– Home security systems may entice criminals as it signals a belief that what you have to protect is valuable.

– These systems lack a means of identifying who or what entered, as well as what was taken.

– The signal cable (phone line?) between the system and central office could be removed or intercepted to render the system useless.

Potential Defenses:

– Better child-parent communication and a scheduled activation time would fix weakness 1.

– Buying more sensors or placing them on the most vulnerable doors to maximize their effectiveness would help solve weakness 2.

– Make an effort to keep easily portable, expensive items out of sight to weaken the determination of a potential criminal. If they can’t see it, they won’t know they can get it.

– Adding sound and motion activated cameras to the system would provide both a means of identification and of tracking what was taken.

– An encrypted “active” signal with a rotating key could be sent to the office during all modes of operation.

Evaluation:

Regarding asset protection, this product will only deter casual criminals. These are criminals that will commit crime as opportunities present themselves. They would be interested in an open window or laptop lying in the open, but would not take the risk without guaranteed reward. As long as the family is conscious of their actions, as well as using the controls at their disposal correctly, they should be fine.

The inside adversary – someone trying to get out – could compromise the system by deactivating it, and would be risking his or her safety by exiting the home.

The professional criminal – someone who knows specifically what they want from breaking into the home, as well as how to do so without tripping the alarm system – presents the greatest threat to the home, though it’s not too probable that they would target a home without cause.

This system may evolve with home electronic technology so that it is integrated with all doors, windows, sensors and appliances. This would at least improve the deterrence effect of the system.

Conclusion:

While this system should be improved to be more effective at crime prevention, its base purposes are deterrence and notification. These purposes are achieved adequately by standard home security systems while they are active. There is still a risk that someone could social engineer their way into the home. With that said, I believe the greatest risk comes from casual criminals with a known target (like that laptop), or insiders trying to get out of the house. This risk can be reduced simply by hiding that laptop and talking with the kids.