Threat Level: green Handler on Duty: Didier Stevens

SANS ISC: Cyber Security Awareness Month - Day 14 - Securing a public computer - SANS Internet Storm Center SANS ISC InfoSec Forums


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Cyber Security Awareness Month - Day 14 - Securing a public computer

Today, we will talk about the challenges in securing a publicly accessible computer, or "Kiosk". I will organize this in checklist form in part because I expect to add to this list based on user feedback. If you do have something to add, please contact us or leave a comment below.

First of all, a lot of this depends on the scope of access required. In most cases, the kiosk will access some form of network resource. Worst case: Generic internet browser (e.g. a shared break room computer). This is very hard to control and secure. It is a bit simpler if you are able to establish a list of specific resources (think about an airline check in kiosk).

I am only talking here about protecting the system, not about how to protect yourself while using a public system.

So lets start with the checklist:

  1. Location: The system should be located in an easy to view location. This will make it easier to supervise what people are doing.
  2. Policy: In particular if you allow access from the public, prominently post the usage policy. Maybe add it to the wallpaper, make the user click on it. Keep it simple so it can be understood in the 5-10 seconds a user will spend looking at it.
  3. Physical Security: Of course, there is always a change that the computer will "walk away". Keeping it in an open location will help with monitoring users and preventing them from removing parts. Lock down cables and alarms that sound when covers are removed may help (similar system like you find in retail stores). But be careful about enclosing desktops in desks. Provide sufficient ventilation to avoid fire hazards.
  4. In most cases, individual users and passwords are not practical. But whatever "default" user you use, should have minimal privileges.This will also make it easier to "reset" the computer between sessions
  5. The web browser will likely be the most important tool on a system like this. Make sure it is hardened. Disable any "persistent" features (cookies, safe passwords, cache...)
  6. Look into "Kiosk Software". There are various systems around for Windows, Linux and OS X to help you manage a kiosk
  7. Re-image daily. For a system like this, it should be possible to re-image the drive once a day. This will make sure no remnants are left over from prior uses. Parts of the system, like the users home directory, can be cleared on each log in. Automatic re-imaging can work from a DVD that is locked in the DVD drive or a second hard disk that is configured as read only. There are also hardware devices (usually used in computer forensics) that will allow you to connect drives and physically block write access.
  8. Enable an auto-logout on inactivity. This will help with cleaning up the system if a user just walks away and doesn't log out or close the browser
  9. Separate the system from the rest of your network. This kiosk should only be used as a kiosk and nothing else. It should not have access to your corporate network (unless this is why you need it) and no confidential data should be stored on the system.
  10. Limit what a user can do with the system. This can be tricky as you have to balance security with the need of the user actually use the system. For example, if this is a "break room" computer or a public computer in a hotel lobby, you probably want people to use a wide variety of web sites (Facebook? ). The usual parental guidance software can help establish limits. This software can also be used to establish time limits if needed.
  11. Keep logs. At the very least, you want to know what your users did with the system. Keep good audit logs as far as your local laws and company policy allows. Many desktop monitors now include cameras. It may be a bit too intrusive, but what about taking a picture of the person in front of the screen every 5 minutes?
  12. Limit physical access to ports. This can be tricky, as people for example may want to e-mail photos they have on a USB stick. At least apply standard precautions about disabling auto-run. But for example access to a firewire port is usually not required.

I am sure I missed something, so this will be updated throughout the day.

 

------
Johannes B. Ullrich, Ph.D.
SANS Technology Institute
Twitter

I will be teaching next: Defending Web Applications Security Essentials - SANS San Jose 2019

Johannes

3579 Posts
ISC Handler
To your 6th point, I've found the KDE Kiosk Admin tool (http://extragear.kde.org/apps/kiosktool/) and Opera's Kiosk Mode (http://www.opera.com/support/mastering/kiosk/) to be quite useful in locking down kiosk PCs. I was quite disappointed when Microsoft dropped support for SteadyState in Windows 7, but at least it still works with XP and Vista (http://www.microsoft.com/downloads/en/details.aspx?familyid=d077a52d-93e9-4b02-bd95-9d770ccdb431). I'd be very interested in other app / OS suggestions for these types of machines.
Anonymous
I've been exploring the use of virtual machines as a means to present kiosk-style environments, particularly where thin client (browser) presentations aren't rich enough, or don't provide the support needed for the applications in use. I'm waiting to see whether Oracle's commercial licensing for VirtualBox ends up being viable. Another alternative is to use client presentation devices (if you have a back-end server scenario) such as nComputing's 300 series. Again, they can be supported by a VM image that is simply replaced either for each new use, or on a periodic basis.
TonyH

8 Posts
Virtual machines should work quite well. I believe VMWare's ACE product is built to do this. I haven't administered it yet, but seen it use in class rooms to load different images for each class and to reset the systems after use.
Johannes

3579 Posts
ISC Handler
We use Slax Linux, create a customized ISO image with all of the modifications required (security, applications, changes to preferences (desktop, appearance), permission settings, device drivers, etc)

Then we just copy this ISO to the local computer, use isolinux to boot the ISO and schedule a reboot. Disable USB ports at the BIOS (PS2 keyboard), BIOS password, lock the case, etc

The boot process is fast and it's restored on every reboot.

Making updates is relatively easy with Slax in case we want to make changes, apply updates, etc
jesse

1 Posts

Sign Up for Free or Log In to start participating in the conversation!