Security versus Accessibility, The endless tradeoff Options

[Drraagh]

I would like to apologize in advance if thoughts seem disorganized somewhat here. I've been writing this while doing other things, so I come back to it from time to time.

A friend of mine has said that if corporations followed all the security options in the books, there would be no way for runners to successfully do runs against their buildings. And, I agree it would be much harder, but not to the point of being impossible. The reason I say that is there are two main parts to a security system; The technological element and the human element. (I suppose in Shadowrun you could add a magical element, but I would lump it with techological to make it the 'security element' or something perhaps.) And the easiest part to violate is the human element.

I /know/ there are people here who follow things like Defcon, H.O.P.E. (Hackers on Planet Earth) and the other different conferences. Some of the ones I've been catching up on lately have been stuff on Penetration Testing, where to quote the movie Sneakers:

Bank Secretary: So, people hire you to break into their places... to make sure no one can break into their places?
Martin Bishop: It's a living.
Bank Secretary: Not a very good one.

Shadowrunners are in a unique position to be able to offer themselves out for that position, and some people can use that as legwork for future runs in the area. but what I am looking at is the opposite side of the coin, which has been discussed here a bit, such as in http://forums.dumpshock.com/index.php?showtopic=26993, How do buildings handle security?

Security has to be developed to be non-disruptive to the work being done. At the enterances, the security will be there to let the good people in and keep the bad ones out. But the more invasive the procedures are, the more it delays people, the less productive these people are, and thus the more your business suffers. But make security too easy and you'll let too much slip past.

I don't remember the exact quote off the top of my head, but Burn Notice had an saying in one episode something like "Proceed far enough into a high security building and you'll notice the security will disappear", I believe it was specifically referring to cameras and the like if I remember the quote, because the idea was not so much about monitoring, since they know you belong, but more on securing the stuff that's there. You stop using cameras in the internal areas and instead rely on security doors, for example.

The presence of magic can make monitoring and detection easier, though. Not to mention wards, watchers and the like, there is astral perception. I don't know if it's been duplicated in SR4, but in SR3, if you see an aura even on a 1 in Astral Perception, you can recognize it again when you see it. No memory check, just 'Yeah, I know that aura'. I don't know if you immediately know its Bob in Accounting, but you know you've seen it before. Which leaves mundanes in trouble since they can't change their auras. But with that in mind (and the fact aura reading can also pick up emotional states), why not have a couple magic types watching the enterances, scanning everyone who walks in, seeing if they know their aura and checking the emotional states. Anyone who doesn't match a known aura or has a problematic emotional state will be watched, maybe approached for help as if they were a customer (and could be subject to spells like 'Mind Probe' depending on your take on 'Does the subject experience the memories of a mind probe that the caster receives?', or maybe simpler spells to find out what they are doing here). This approach also lets you weed out disgruntled employees for your Corporate Brainwashing Sessions, whether its Paranoia-like 'Respect the Computer, The Computer is Your Friend' or something simpler like 'Workplace Safe Interactions' or 'Anger Management And You'. Especially if you make these on Simsense, lovely things psychotropes can do to people. Heck, you could have an odorless gas in the air, or chemicals in the food at the cafeteria and restaurants and the like (and the people putting it in the food could be programmed not to remember, so that they'll eat the same food without worry); imagine the run potentials there, too.

And where do tricks like this come from? From corporations using their own Penetration Testing teams, or basically, Shadowrun teams on their payroll. They live the 'good' life, brainwashed the same way to respect the company but given a bit more lateral thinking options than corpers would, so they can think outside the box. Now, your penetration testers find a lot of things your shadowrun team would think of. If you can find it, the show 'Tiger Team' had two episodes based on that, one against a Car Dealer and the other against a Diamond dealership. The movie Foolproof showas examples of how normal people can do flaw finding for a 'living' after all (and, please, can someone tell me what they meant by 'lancing a safe'? I have ideas based on the scene's context and props, but I am curious).

Your Penetration Testers would look at the system and act like Shadowrunners would. They would find technological shortcomings like the fact that the position of your security cameras creates blindspots or the motion sensors are not properly calibrated or that your security guards are too lazy or whatever.

So, looking at building security and possibility as a valid shadowrun target, I think it depends on the style of your team, skills available, and the level of the corp.
A low level store, like mom and pop's corner store may have one camera over the door facing the register and a safe below the counter using a combination lock.
The lowest tier of corporate building would be like a modern day office building I would think. Maybe add a few more cameras and the like for security, but it is laid back more of a friendly atmosphere, with a 'We're too small to bother with' sort of attitude when it comes to security.
Then you get into tier two corporate buildings, where there are security guards with some powerful guns, employees with badges and keycards and the like rather than just doors, a single group on matrix server.
Tier three, more keycards and keypads, maybe some biometrics, Different groups on the matrix servers, patroling guards, maybe some magic, etc.
And just keep building up from there until you get to the point of megacorps that have every piece of hardware in there, all sorts of magical security, everything. It's to the point you can't take a piss without it being drug tested, labelled and tracked until it is recycled into water because they want to make it a purely closed system to prevent outside tampering.

Basically, once you get to the high end, standard runners who go in guns blazing or stealth sneaking are likely going to be facing their worst nightmares and need to come up with stuff that will be completely brand new to try and find ways in. After all, when you have more money than God and the human resources to back it up, why would you leave any flaws in there if you could prevent it?

[Draco18s]

Reminds me that by Fluff and by RAW, corps use wireless devices for their security (cameras, sensors, etc) which are inherently hackable, and not only that, but provide direct access to the data mainframe (because it's connected to a device that's connected to a device that's broadcasting a wireless signal that the snack machine can pick up that the water fountain can relay to that camera there which is part of the security network which I can hack from this electronic door lock).

And I asked "WHY?"

[Chrysalis]

Because Shadowrun is designed as a gaming world, meaning that security is Hollywood secure. Only secure enough to make the plot continue to move.

With Shadowrun logic, nothing is completely secure, you don't have layered approaches to security, you don't have a central system which responds to things. You don't have security guards with access to only general areas. You don't have offline security systems. You don't have bean counters who calculate that it would take this amount of money to break into this facility and steal this amount of stuff, meaning you spend more money breaking into it than getting out of it. You also don't have budgetary concerns meaning that security of one area is dependent on the department in question, meaning that yes you can walk through an area which does have cameras.

This is a world where you can play urban horror, 80s hair movies, and every other type of hollywood movie between. The gaming world is not designed or meant to be near reality or even take on its form.

[otakusensei]

Why? Cost. A wired connection isn't much safer, just means that a hacker has to get physical access to a system to break it.

As the OP mentioned, layers are the key. The comera on the outside is tiny, wireless and hackable. But it's slaved to a much more secure system which acts as the first layer of defence. From there thee's a network choke point that can be used to keep traffic out a more robust internal security network. This network physically ties into the cameras and system on the interior of the building. Then each section of the building under that has it's own dedicated security system with choke points leading in from the internal system. Each one relies heavily on slaved connection to protect peripheral nodes and varying levels of security. Say a facilaty has three major departments. Each department has a staffed area and a security spider. They are all enclosed in the larger facilaty which has some decent IC and relies on the spiders for overwatch. Then there is the perimeter security system which relies on the IC connecting remotely and the spiders keeping an eye on.

As the matrix security gets tougher when you get in, the physical security does the opposite. The perimeter has the attack drones and the alarms. The inner system has the sentry guns and armed guards. The departmental security systems have cameras and a guard or two. Thsi is because you put the greater focus of security in the points where it does the most good. You want your spider in the data stores and your guards in the hallways. Magical security follows step with physical security.

Passive protections on each layer vital. Wifi blocking paint and living material in the walls or high powered jammers and wards or aspected domains in the exclusion zones.

It helps to think of the three aspects of security (Physical, Matrix, Astral) being part of a whole, and then you break any facility into layers. Protections are like walls, the space between being the batteground, the test, for whatever countermeasures you've put in place. Your tricks and traps are set at the choke points. Every system should have lots of choke points.

[otakusensei]

Because Shadowrun is designed as a gaming world, meaning that security is Hollywood secure. Only secure enough to make the plot continue to move.

With Shadowrun logic, nothing is completely secure, you don't have layered approaches to security, you don't have a central system which responds to things. You don't have security guards with access to only general areas. You don't have offline security systems. You don't have bean counters who calculate that it would take this amount of money to break into this facility and steal this amount of stuff, meaning you spend more money breaking into it than getting out of it. You also don't have budgetary concerns meaning that security of one area is dependent on the department in question, meaning that yes you can walk through an area which does have cameras.

This is a world where you can play urban horror, 80s hair movies, and every other type of hollywood movie between. The gaming world is not designed or meant to be near reality or even take on its form.

Not how I run it. I expect my players to at least comb back the pink mohawk, only letting their freak flag fly in those moments when things do go off the wall and they reach under the seat for the LAW rocket. Everyone has their preference though, and you're welcome to yours. I reward my players for clever ways of beating simple precautions. For bringing the knowledge and skill to crack the shell I put around whatever they need to get to. I normally give a good bonus for clean runs. If they manage to get out without making a mess, the employer likes it and so does the GM. It takes much more thought than rolling to hit.

I don't make unbreakable systems, because they don't exist. Entropy alone excludes them. Even if they did exist, it would be pointless to use them. By nature you can't do business in a perfectly secured system. Every allowance for operation is an avenue for exploitation. The more complicated the system, the easier it is the break it. Works in real life, works in game.

[CanadianWolverin...]

I have to admit, the security in my up coming games is going to be pretty lax. Well, at first anyways, any alarms go off and you have X amount of time till the calvary arrives. Unless of course the target has enough priority and/or value assigned to it that it is considered to need a very quick response time, but in that case I would think the ERT practically lives on site.

Like I am at the library right now, staring at a single over weight private security guard for the whole place, a few employees, a bunch of patrons, scanners/detectors? at the front door probably to detect if someone hasn't checked out a book first, and alarms on the emergency fire exits. Many office buildings and warehouses I have been in don't even have security this good. Basicly, it all seems to run on if it looks like it belongs, leave it alone, if not, call the cops aka RCMP.

Based off that, unless they are hitting a priority military grade target, and even then, security will seem pretty lax until alarms.

[otakusensei]

I have to admit, the security in my up coming games is going to be pretty lax. Well, at first anyways, any alarms go off and you have X amount of time till the calvary arrives. Unless of course the target has enough priority and/or value assigned to it that it is considered to need a very quick response time, but in that case I would think the ERT practically lives on site.

Like I am at the library right now, staring at a single over weight private security guard for the whole place, a few employees, a bunch of patrons, scanners/detectors? at the front door probably to detect if someone hasn't checked out a book first, and alarms on the emergency fire exits. Many office buildings and warehouses I have been in don't even have security this good. Basicly, it all seems to run on if it looks like it belongs, leave it alone, if not, call the cops aka RCMP.

Based off that, unless they are hitting a priority military grade target, and even then, security will seem pretty lax until alarms.

Massive storage of offline publicly available information with a reasonable level of insurance? That security seems about right. In 2072 you can get rid of the guard and have a handful of drones do the legwork. Maybe a college intern security spider on call to look into vandalism and reload anything from backup. Now for the more well known and upscale libraries, where they have a name to live up to, those would be a trip to get into.

[The Jake]

I work in this space and FWIW, nothing is 100% secure - ever. Even the most robust application is secure, there are ways to exploit processes, clients machines, people, trusted infrastructure or weaker adjoining applications, etc. It just comes down to time, motivation, skill. How much of all three do you want to throw at the problem to crack that nut?

Also penetration testers are also typically constrained by playing by the rules as it were - they won't usually conduct hostile tests that could potentially down a service (usually at least). I've ran and conducted pentest teams for nearly 3 years and never seen a truly "hostile" test yet. Also you are going to be limited to your test scope. Shadowrunner teams have none of those constraints. They are free to use any mean/methods at their disposal to ensure success.

I also disagree with the rule about security disappearing the deeper you go. It should be done in layers and appear seemless. Just because you don't see the cameras doesn't mean they aren't there. (IMG:style_emoticons/default/wink.gif)

- J.

[otakusensei]

Absolutely. Security doesn't disappear, it just gets out of the way. The deeper you go, the more you can be use that your other protections have filtered out the restricted elements. However you can never be completely sure, and should at the very least maintain surveillance systems at all levels (cameras, other sensors), if not less than lethal restraint systems (gas, foam, Stick-n-Shock guns).

[Drraagh]

Now that I'm not at work, I had a chance to doublecheck the quote, and I was right, it was just on cameras.

Past a certain point in a clearance facility, you stop seeing security cameras. Lowly security guards don't have the clearance to see what's on the cameras, so there's no one to monitor them. Usually, in the top security areas of a high-tech facility, it's less about monitoring and more about fortification.

.....

In a high-security situation,most people try to create the smallest disturbance they can. The thing is, high security is built to deal with small disturbances. Trip one sensor, and you're toast. Trip 100 sensors, though, and nobody knows what to do.


So, those two quotes there talk about how security is still around, just more about keeping things safe that's there than who is there. You figure you know who's in there, so why bother seeing them when you could be stopping them. It becomes the Chinese Finger Trap of the facility.

I suppose it was a tl;dr for some, but I'm surprised no one commented on my mages watching the door idea. (IMG:style_emoticons/default/wink.gif)

[otakusensei]

When designing security for the sixth age, it's important to remember that the price of security has gone down tremendously.

I just watched a few thousand dollar camera system go into a facility that by SR4 standards would have cost a few hundred and setup in hours instead of days.

[kzt]

Also penetration testers are also typically constrained by playing by the rules as it were - they won't usually conduct hostile tests that could potentially down a service (usually at least). I've ran and conducted pentest teams for nearly 3 years and never seen a truly "hostile" test yet. Also you are going to be limited to your test scope.

Then I guess Flexible Linear Shaped Charges on the walls and security doors are right out?

[kzt]

Most runs won't be on super-hard sites. If you take a job to break into the national military command center, shoot up the Knight Errant Fire Watch convention or bug Damien Knight's personal conference room you should have an idea that this isn't going to be very easy to do successfully. And paid commensurately.

There are a couple of military design guides for physical security that are pretty interesting. The primary thing that physical security measures is how long does it take for someone to get in, get/do something and out using a certain threat model.

[Draco18s]

Then I guess Flexible Linear Shaped Charges on the walls and security doors are right out?

You can simulate it. Small firecracker and a guy on the other side who's job it is to open the door when it goes off.

Of course, busting through walls is harder, but that just takes some coordination of "Ok, they blew a hole in the wall. Everyone* stop what you're doing and wait for the team to get to the other side."

*The security guards, of course.

[Drraagh]

You can simulate it. Small firecracker and a guy on the other side who's job it is to open the door when it goes off.

Of course, busting through walls is harder, but that just takes some coordination of "Ok, they blew a hole in the wall. Everyone* stop what you're doing and wait for the team to get to the other side."

*The security guards, of course.

Pretty much one way I can see that it could work. Also, if you've got the money, you could do it as a sim. I don't know how well, it's written, but one of the Netforce books is apparently about that sort of idea which I think was kinda a cool idea.
"An army base is attacked and NetForce is called in to track down the culprits. It turns out that the bad guys are using a massive online VR game to have people test ways of getting into the bases"

Given the popularity of Metal Gear, Splinter Cell and other games, I don't see why that wouldn't work as a penetration testing idea. Go hog wild, go in there guns blazing, and we'll just reset it like pins in a bowling alley.

And as for runs done against high level targets, I've seen people creating the run against various megacorp X, and basically making it a shooting gallery sort of run because that's how movies and video games do it. My comment to that is it makes a great idea, and can be fun but there are conflicts other than just being shot at to make runs fun. What about social tests? What about a dramatic bomb? Things like that. They can slow you down just as much as combat, thus making it an obstacle to get your goal, but it doesn't show as well on a movie so people push the envelope with shooters, and video games don't always do as well with different tests, which is why shooters is such a market, and RPGs and Action/Adventure games can sometimes be niche markets.

[Crusher Bob]

The movie Foolproof showas examples of how normal people can do flaw finding for a 'living' after all (and, please, can someone tell me what they meant by 'lancing a safe'? I have ideas based on the scene's context and props, but I am curious).

I would assume it would be using a Thermal Lance to cut through the wall, door, or lock of the safe.

[Kumo]

Reminds me that by Fluff and by RAW, corps use wireless devices for their security (cameras, sensors, etc) which are inherently hackable, and not only that, but provide direct access to the data mainframe (because it's connected to a device that's connected to a device that's broadcasting a wireless signal that the snack machine can pick up that the water fountain can relay to that camera there which is part of the security network which I can hack from this electronic door lock).

That's why a whole "Matrix Topology" part from "Unwired" should be in corebook.
If the node - security camera, for example - is slaved to another node, it accept connection only from the "master". So your fellow hacker can't hack the camera "just like that". He has to use wired connection (with higher treshold); or hack the master node; or spoof the access ID of the master node to give slave node spoofed commands.

And not everything has to be connected to everything else. For example, a public area of the corp's facility can have a chokepoint: only one node connected to another node in more secure area - isolated from rest of Matrix by jammers, wi-fi inhabiting paint/wallpaper, Faraday cage, or something else.

BTW: I'm new on Dumpshock, so hello to all!

[Zaranthan]

I would assume it would be using a Thermal Lance to cut through the wall, door, or lock of the safe.

For the record, Mythbusters busted that one wide open. The slag drips into the safe and destroys the contents.

[BishopMcQ]

Zaranthan--As I recall, the Mythbusters episode worked with a standing safe. A full bank vault may be more viable--like using a powersaw on your armoire versus a walk in closet. Of course, the cutting would take longer as well.

OP--Generally when designing security as a GM, I look at funding and security level. Higher funding generally means higher ratings of devices. A more secure location will have more layers and redundant systems. This obviously means that a highly secure, well-funded lab will have several layers of high rating gear. From my experience, after you cross a certain threshold--it becomes a matter of "when" security finds out rather than "if" security finds out. In these cases, my runners generally utilize stalling tactics to give them a larger window to get in and out before getting caught.

[kzt]

Once you go from inch of steel to meters of concrete composite your oxygen and pipe requirements start getting pretty crazy. Plus the heat & smoke sensors in the vault will probably go off.

[nezumi]

+1 to The Jake.

The battle between security and 'the bad guys' is just one of spending resources (in time, cost, employees, convenience, perception, legal ramifications, etc.) Shadowrunners can do their work not (necessarily) because Shadowrun is based on 'movie security', but because Shadowrunners are a group of dedicated professionals who have dedicated the time and resources to do their job, and who feel they operate under fewer (or at least different) limitations from the opposition.

Remember also, you can broadly divide security controls into three categories; Technical, Operational and Management. Technical is 'how much are you spending and is it properly configured' (with the less common addendum, 'does it work as it should?' Bugs in software are the best example of this.) Operational is 'are people doing what they are supposed to be doing. Are the guards awake? Are they properly staffed? Do employees report odd situations and follow security requirements, like they're supposed to?

And of course, once you through not only magic in the mix, but the place where magic, matrix and physical interlink, everything just goes to hell. I can say, in most places, the electronic systems and the physical controls are managed by different people, in completely opposite sides of the building, who rarely meet, and don't even speak the same (technical) language. Expect the line between magic and the other two areas to be similarly difficult. (I still remember when our physical security group tried to ban all cell phones in the building to eliminate picture-taking devices. Needless to say, OIT was not amused.)

[kzt]

I can say, in most places, the electronic systems and the physical controls are managed by different people, in completely opposite sides of the building, who rarely meet, and don't even speak the same (technical) language. Expect the line between magic and the other two areas to be similarly difficult. (I still remember when our physical security group tried to ban all cell phones in the building to eliminate picture-taking devices. Needless to say, OIT was not amused.)

In our complex the locksmith works for the guy who manages the access-control and video system. Not perfect, but ok.

I know people who work in places where they aggressively prohibit cell phones or other devices with camera features. Heck, Sandia bans all call phones unless they are issued by the USG and approved by Sandia. They have little Plexiglas lockers to store them in if you get to the security entrance with one. And I'm told that, deeper inside the complex, there are areas that will detect that you have a cell phone or other electronic device on you. This tends to have a bad outcome.