Question

A security consultant is improving the physical security of a sensitive site and takes pictures of the unbranded building to include in the report. Two weeks later, the security consultant misplaces the phone, which only has one hour of charge left on it. The person who finds the phone removes the MicroSD card in an attempt to discover the owner to return it.

The person extracts the following data from the phone and EXIF data from some files:

DCIM Images folder -
Audio books folder -
Torrentz -My TAX.xls -
Consultancy HR Manual.doc -
Camera: SM-G950F -
Exposure time: 1/60s -
Location: 3500 Lacey Road USA -

Which of the following BEST describes the security problem?

A. MicroSD in not encrypted and also contains personal data.
B. MicroSD contains a mixture of personal and work data.
C. MicroSD in not encrypted and contains geotagging information.
D. MicroSD contains pirated software and is not encrypted.

Answer 1

The security problem is that the MicroSD card is not encrypted and contains geotagging information, which could reveal the location of a sensitive site. This poses a risk to the site's security and could also lead to additional privacy violations due to the mix of personal and work-related data stored unencrypted on the card.

Step-by-step explanation:

The incident described points to a significant security problem regarding the handling of sensitive data on removable storage devices such as MicroSD cards. The key issues identified from the extracted data and EXIF information are as follows:

• The MicroSD card is not encrypted, which means that the data is easily accessible to anyone who finds or steals the card.
• The MicroSD card contains geotagging information that could potentially reveal the location of a sensitive site, posing a risk to the physical security of the site.
• There is a mix of personal and work-related data on the card, which could lead to privacy violations and corporate data leaks.

In this scenario, the best description of the security problem is that the MicroSD card is not encrypted and contains geotagging information. While the presence of personal data and possibly pirated software also represent security concerns, the immediate risk to the sensitive site due to the location being compromised is of paramount importance.