Page 577 - (ISC)² CISSP Certified Information Systems Security Professional Official Study Guide

hard disks, data can often be protected through a combination of
operating system access controls. Removable media pose a greater

challenge, so securing them often requires encryption technologies.

As availability is also part of the security triad, it is essential to
choose media that will retain data for the length of the time
required. For instance, a backup tape might degrade before the
retention period of the data terminates. Also, the technology used
for secondary storage might become obsolete, making it difficult to

restore/read the data.

Input and Output Devices

Input and output devices are often seen as basic, primitive peripherals
and usually don’t receive much attention until they stop working
properly. However, even these basic devices can present security risks
to a system. Security professionals should be aware of these risks and
ensure that appropriate controls are in place to mitigate them. The
next four sections examine some of the risks posed by specific input

and output devices.

Monitors

Monitors seem fairly innocuous. After all, they simply display the data
presented by the operating system. When you turn them off, the data
disappears from the screen and can’t be recovered. However,
technology from a program known as TEMPEST can compromise the
security of data displayed on a monitor. Generally, cathode ray tube
(CRT) monitors are more prone to radiate significantly, whereas liquid

crystal display (LCD) monitors leak much less (some claim not enough
to reveal critical data).

TEMPEST is a technology that allows the electronic emanations that
every monitor produces (known as Van Eck radiation) to be read from
a distance (this process is known as Van Eck phreaking) and even
from another location. The technology is also used to protect against

such activity. Various demonstrations have shown that you can easily
read the screens of monitors inside an office building using gear
housed in a van parked outside on the street. Unfortunately, the
protective controls required to prevent Van Eck radiation (lots and lots