5 ms·

Amazing story, once again security fails due to a lot of human error. Spoilers below if you haven't read the article: 1. The key shouldn't be kept in the clos

Amazing story, once again security fails due to a lot of human error. Spoilers below if you haven't read the article: 1. The key shouldn't be kept in the closet outside the safe 2. Opening the door should force the magnetic sensor to be triped, the door must be in the way of the sensor. Additionally, why was the sensor on the outside of the door? 3. The combination lock should have a viewing angle that requires the user to block any cameras. 4. You need human patrols. 5. Sensors should be independent; the heat/motion sensor shouldn't both need to be tripped. 6. They needed sensors that could not be easily seen or detected by someone in the safe (hidden cameras, sensors embedded in another object). 7. The needed multiple sensors instead of one each. 8. The sensors should adjust the current flowing through them so that the wires can't be bridged, and the wires shouldn't be exposed. 9. There needs to be a random factor inserted such as random patrols, a sensor that moves in a random way, the combination is changed randomly. 10. They should have a time control on the safe that only allows it to be opened during certain times. There could be an override, but it'd be it should be difficult and rarely used (hard to copy). Just a few off the top of my head, more cameras would also be good -- what else did they do wrong?

dantheman 18y ago
11. Video cameras -- keep the lights on everywhere.
nazgulnarsil 18y ago
There needs to be a random factor inserted thiis the #1 thing that would prevent a lot of crime. people dont do it because it makes logistics harder. people like routines.
ErrantX 18y ago
DOnt forget this was several years ago - some of the technology was not a minature as it might be now :)
thaumaturgy 18y ago
On #8, I was surprised that this hack worked at all, especially in what must have been a terribly expensive alarm system. It should have been monitoring for changes in both voltage and resistance, and tripping the alarm if the circuit fluctuated. If nothing else, it would help detect a failing component.
nkurz 18y ago
Upvote for raising clear points, but at heart I think I disagree with your premises. Your thesis seems to be that by throwing more resources at the problem the vault could be made more secure. Likely true, but at what cost, both in hassle and money? You seem to be arguing for overengineering without considering the costs. Should the failsafes also have failsafes, should the backups have their own backups? And what if the additional security measures add additional risks? Take #4, "human patrols". Unless implemented very carefully, greater access for security personnel could well add more risk than benefit. I'm not even sure that one should argue that the vault failed from the point of view of the owners. It was designed well enough for them to do their daily business and such that they were able to obtain insurance on the contents. A vault doesn't have to be impregnable, only visibly difficult to steal from.
- gdee 18y ago
  Allegedly, the robbers walked with 100M euros without cleaning the vault. Price would have to be really steep for those additional security measures for their cost to be an issue I think. > A vault doesn't have to be impregnable, only visibly difficult to steal from. I'm pretty sure a vault in this situation has to be really impenetrable and definitely not just visibly difficult to steal from. What you're proposing is the exact situation they had. The result didn't look good.
  - nkurz 18y ago
    I'm not quite proposing the exact situation that they had, but I am suggesting that adding more layers of physical security might not be the solution. And if indeed this was really a case of insurance fraud rather than a straight theft, perhaps the outcome was good for everyone except for the insurance company. To the extent that the vault was good enough for them to obtain insurance, the vault was good enough. To obtain better security, the motivation of the participants needs to be analyzed. Perhaps this is a problem best solved through obscurity, with two competing security teams installing two totally separate alarms systems, each standing to lose if their alarm is defeated. Or perhaps skip the alarms, and rely on threats of deadly force. But although any new insurer will properly demand the technological improvements illustrated here, it would be foolish to believe that technology alone will keep out a dedicated team of insiders with full access to the system. Real world security is not equivalent to public key encryption where security can be established by 'proof'.
wallflower 18y ago
> 1. The key shouldn't be kept in the closet outside the safe How do you lock up the 'impossible to duplicate key' - by definition you would need a lower-level security key to secure it?
deleted 18y ago
[deleted]

dantheman 18y ago

11. Video cameras -- keep the lights on everywhere.

nazgulnarsil 18y ago

There needs to be a random factor inserted thiis the #1 thing that would prevent a lot of crime. people dont do it because it makes logistics harder. people like routines.

ErrantX 18y ago

DOnt forget this was several years ago - some of the technology was not a minature as it might be now :)

thaumaturgy 18y ago

On #8, I was surprised that this hack worked at all, especially in what must have been a terribly expensive alarm system. It should have been monitoring for changes in both voltage and resistance, and tripping the alarm if the circuit fluctuated. If nothing else, it would help detect a failing component.

nkurz 18y ago

Upvote for raising clear points, but at heart I think I disagree with your premises. Your thesis seems to be that by throwing more resources at the problem the vault could be made more secure. Likely true, but at what cost, both in hassle and money? You seem to be arguing for overengineering without considering the costs. Should the failsafes also have failsafes, should the backups have their own backups? And what if the additional security measures add additional risks? Take #4, "human patrols". Unless implemented very carefully, greater access for security personnel could well add more risk than benefit. I'm not even sure that one should argue that the vault failed from the point of view of the owners. It was designed well enough for them to do their daily business and such that they were able to obtain insurance on the contents. A vault doesn't have to be impregnable, only visibly difficult to steal from.

gdee 18y ago
Allegedly, the robbers walked with 100M euros without cleaning the vault. Price would have to be really steep for those additional security measures for their cost to be an issue I think. > A vault doesn't have to be impregnable, only visibly difficult to steal from. I'm pretty sure a vault in this situation has to be really impenetrable and definitely not just visibly difficult to steal from. What you're proposing is the exact situation they had. The result didn't look good.
- nkurz 18y ago
  I'm not quite proposing the exact situation that they had, but I am suggesting that adding more layers of physical security might not be the solution. And if indeed this was really a case of insurance fraud rather than a straight theft, perhaps the outcome was good for everyone except for the insurance company. To the extent that the vault was good enough for them to obtain insurance, the vault was good enough. To obtain better security, the motivation of the participants needs to be analyzed. Perhaps this is a problem best solved through obscurity, with two competing security teams installing two totally separate alarms systems, each standing to lose if their alarm is defeated. Or perhaps skip the alarms, and rely on threats of deadly force. But although any new insurer will properly demand the technological improvements illustrated here, it would be foolish to believe that technology alone will keep out a dedicated team of insiders with full access to the system. Real world security is not equivalent to public key encryption where security can be established by 'proof'.

wallflower 18y ago

> 1. The key shouldn't be kept in the closet outside the safe How do you lock up the 'impossible to duplicate key' - by definition you would need a lower-level security key to secure it?

deleted 18y ago

[deleted]