Unsupervised physical access to the computer

The most basic security requirement is to prevent unsupervised physical access to the system itself. Although it is often necessary for users to access the console to operate the floppy disk or tape drives, it is dangerous to leave the computer hardware open to unsupervised access after hours. A knowledgeable user might be capable of disabling the system and penetrating the root account. This is the most serious breach of security.

When no users are on the system, such an occurrence can go unnoticed. This kind of tampering can only be detected by looking for:

• login reports for the root account.

• suspicious superuser actions in the audit trail.

• unexplained system reboots in the audit trail.