RiskUKOctober2017

Cyber Security: Visual Hacking Risk Management
Of course, laptops and other mobile devices
are not just used in public spaces – many of us
access them at the office as well. Indeed, with
the advent of ‘mobile first’ this development is
only going to increase, because that’s the
concept of having one handset that transfers
seamlessly from internal voice and data
networks to cellular networks.
Global Visual Hacking
The potential risk of visual hacking in open plan
offices was highlighted by the Global Visual
Hacking Experiment conducted by The
Ponemon Institute and sponsored by 3M.
Covering eight countries, among them the
UK, the Global Visual Hacking Experiment
involved a total of 157 ‘trials’ encompasing the
offices of a variety of organisations harbouring
from 25 to 100 employees. In all cases,
designated people at the participating
companies were given two days’ notice before
each trial, which involved a White Hat hacker
(complete with a valid and visible security
badge) impersonating a temporary office
worker. The total estimated time for each trial
was two hours.
The trials involved trying to obtain sensitive
or confidential information in several ways:
walking through the office looking for
information left in full view on desks,
monitoring screens and other locations such as
printers and copiers, taking a stack of business
documents labelled ‘Confidential’ from a desk
and putting them in a briefcase and using a
smart phone to take images of confidential
information displayed on computer screens. All
tasks were carried out in full view of other
office workers.
Information obtained was varied and
included personal identification information,
customer and employee details, general
business correspondence, access and log-in
credentials, confidential or classified
documents and attorney-client privileged
documents in addition to financial, accounting
and budgeting information.
While the UK’s results were often better
when compared to other countries, the
numbers are still alarmingly high, with 87% of
visual hacks successful, over half taking place
in 15 minutes or less and 44% of sensitive
information gained by viewing people’s
screens. An average of 3.1 pieces of confidential
or sensitive data were obtained per experiment,
while the visual hacker was only confronted in
39% of attempts.
Globally, where visual security practices were
in place – such as clean desk policies,
workplace monitoring and surveillance,
“Unlike more sophisticated forms of security breaches,
visual hacking doesn’t require any computer expertise.
With mobile devices now incorporating increasingly clever
cameras, it’s becoming simpler to ‘snap’ sensitive details”
bespoke training and awareness programmes
and standardised document shredding
processes – there was an average 26%
reduction in successful visual hacks.
Compared to some types of security
management, visual hacking is relatively easy,
cost-effective and quick to mitigate if the right
processes are implemented, not just on
screens, but also for paper-based information.
To reduce the paper risk, encourage staff to
clear their desks at the end of the day and lock
away any document deemed sensitive or
confidential. Check the Post Room and printer
trays to make absolutely sure documents are
not being left in full view. If not already in
place, instigate the routine shredding of key
documents and discourage any unnecessary
printing and copying of them.
Adopt the mantra of ‘Close It Down’.
Screensavers and log-in prompts after a few
minutes’ inactivity are effective and simple
ways in which to reduce the time a screen is
exposed to prying eyes.
Cultural attitude is important, too. Visual
privacy policies are more likely to be followed if
they’re mandated at the management level and
staff are educated about their personal
responsibility to improve visual privacy.
Employing privacy filters
Make screens hard to view. A very simple step
is to ensure that a given screen’s angled such
that it cannot be viewed, for instance facing a
café wall, rather than in full view of the coffee
counter queue.
Last, but not least, use privacy filters. These
can be easily slipped on and off screens of all
kinds and prevent on-screen data from being
viewable except straight on and at close range.
Someone taking a sideways glance or who may
be several feet behind the screen will witness
only a blank image.
Given that these are all very achievable
preventative steps to take, and that visual
hacking is potentially a very real risk for UK
organisations in this day and age, it makes
perfect sense for companies to include them
within overall security practices.
While visual hacking might only be one of
many tools in the hackers’ current armoury, it’s
also one that can be practically locked down
more easily than others. Worth bearing in mind.
Peter Barker: EMEA Market
Development Manager
(Display Materials and
Systems Division) at 3M
69
www.risk-uk.com