Welcome back to our series on Security Insights.
I'm Quentyn Taylor and this is the 2nd of our videos covering all things
information security.
Today we're going to talk about RFID, another one of those casually used acronyms,
but what is it? And what does it mean for you?
RFID stands for Radio Frequency Identification.
Infact you probably have several RFID tokens on you right now.
Your car keys, your credit card, your building access pass.
All of these things are using radio frequencies to make your life easier.
No pressing buttons, entering your pin, or turning keys.
The technology has been around for years, and because it's so ingrained in your everyday
life, you don't realise it's everywhere.
It's the past, present, and future of security.
However the potential danger comes when you attach the technology of the past
to the desires of the future.
Reusing old technology for a higher security purpose than what it was intended,
without any thought as to the risk.
Take your building access pass for example.
Have you thought about how it works, or how long that technology setup has been there?
In many office buildings the access cards work by interacting with the reader on the
door to allow that particular card to open the door.
The security depends upon the card being unique and uncopyable.
But imagine if there was a way to copy someones card.
Some access badge technologies can be hacked.
What may have been OK years ago, when the knowledge was hidden,
is now only a search engine away.
Now many types of RFID card can be easily copied and modified.
And it's as easy as that.
And it's not just doors.
Often people's access badges can be used to pay for lunch, unlock a printer,
and get into gated parking areas. Your options are endless.
The technology is not chosen for each purpose,
but re-used from whatever was installed in the building.
Can you imagine using electronics manufactured in the 1980s to control access to both your
electronic and physical worlds today?
Well you may very well be if your system has not been updated in the meantime.
So what can you do?
Firstly understand what cards you have and what the risks are associated with them.
If you don't have the technology to analyse RFID cards, you'll need to ask your card provider
or security company what cards you have.
You also need to understand the risk, and then balance that with what it's protecting.
Just because the card is of an older generation and can be copied or modified doesn't mean
it's unsuitable for what you want to use it for.
Can you accept the risk?
It's all about balancing the risk with what you're trying to protect.
For example, you wouldn't install an expensive, advanced lock on an old, empty shed.
But another aspect to consider is that as technology and time moves on, it will be broken.
Your security model of today will not be your security model of tomorrow.
Assume that technology may be perfectly secure today, but will not be in the future.
So how do you counter this?
We cannot predict the precise future of what technology will be broken,
but we know that almost all will.
If humans create it, humans will break it.
Therefore plan now for how you will replace or change what you've got.
You wouldn't permanently attach your lock to your front door
as you may need to upgrade it in the future.
The same is true of RFID access controls.
RFID, as a spectrum of technologies, is far more complicated that can be explained in
a simple video. However the complexity is where the risk lies.
There are so many types of card, reader, and implementations,
it's amazing that any of them are secure.
Whilst it is not only possible to secure this technology, it can be straight forward.
Understanding what you have, and what you want it to do, is crucial.
Many of the security issues with RFID are down to people not understanding,
not only what they have, but the limitations.
If you understand the technology, you'll have a better chance of understanding the risks.
There is too much to go into in this video, but if I can make you aware of the risks,
and arm you with the right questions for your vendor, you'll be able to make better use
of this technology and secure yourself, and your company.