10 ways to address KVM switch vulnerabilities
Connecting state and local government leaders
Best practices are emerging that allow government security pros to address desktop security through secure KVM switch solutions.
Last September, police arrested criminals for plotting to steal millions of dollars from Barclays Bank and Santander Bank. The hackers were planning to use the banks’ KVM (keyboard video mouse) switches to record the bank staff’s key presses and screen activity and steal their passwords.
While these particular attacks were targeted at the financial industry, federal, state and local government agencies are just as vulnerable. Maliciously altered peripherals can gain control, intercept and/or access resources beyond a single government PCs and crawl into any computer network that the PC is attached to.
One of the most under--used measures for thwarting cyberattacks is the use of KVM switching devices, which allow government employees to securely switch between networks with various security levels from one desktop.
While many government IT security administrators have started deploying KVMs to address inefficiencies of non-switched secured desktops, not all KVMs are highly secure, making them vulnerable to malicious use through:
USB peripheral vulnerabilities. While all USB ports feature high-speed, bidirectional flow of data, this benefit is also a potential threat, since data is shared along the entire USB bus.
Video vulnerabilities. LCD monitors store and communicate display parameter data in the standard EDID signal, which could be exploited.
Microphone vulnerabilities. Microphones are susceptible to sniffing, capture and redirection.
Memory buffer leaks. Some KVM switches use buffering onboard and can leak data from channel to channel.
Inadequate CAC implementation. KVM systems that provide reader support for Common Access Cards don’t fully isolate the CAC reader, making the keyboard and mouse vulnerable to attacks.
Poor casing and design. The internal and external components of the switch may be vulnerable to tampering.
Best practices for boosting security
In light of these vulnerabilities, best practices are emerging that allow government security professionals to address the increasing concern for desktop security through secure KVM switch solutions:
1. Avoid non-secure KVM switches. Non-secure KVM switches should be used only in situations where users have access to virtually no sensitive data and are on isolated networks.
2. Understand system features. Purchasers of KVM switching technology should thoroughly investigate capabilities before trusting a system within multi-security-level environments.
3. Isolate data. To achieve true data path isolation, a KVM switch must be purposefully engineered to completely isolate each data path connection in the switch.
4. Monitor USB ports. Only authorized devices should be allowed to connect to a secure computer’s USB port.
5. Protect video vulnerabilities. Rather than rely on the PC’s built-in plug-and-play interface, the KVM switch itself should handle the video data path through isolated emulators.
6. Avoid microphones. The use of microphone input introduces too many opportunities for malicious hacking or voice capture.
7. Avoid data buffering. No buffering of data should be allowed anywhere on the data path or within the KVM switch.
8. Isolate the CAC reader. Isolating the CAC port helps to keep the keyboard and mouse from becoming vulnerable to attacks.
9. Examine casing and design. It is important that the external housing of the switch is tamper-proof and cannot be opened or modified at any time.
10. Buy from reputable firms. Purchasers of secure technology should ensure that only trusted, domestic vendors have designed and manufactured the devices their end users will be using.
Cyber threats are on the rise for government institutions, with confidential data and federal computer systems serving as prime targets for cyber criminals. With this in mind, using a secure KVM switch solution that offers true data path isolation can help protect government agencies at all levels from cyberattacks.