CertiGuide to Security+  9  Chapter 3:  Infrastructure Security (Domain 3.0; 20%)       9  3.2  Media            9  3.2.4  Removable Media

3.2.4.5  Flashcards 1 2 3 3.3  Security Topologies

A smartcard is “a small device, about the size of a credit card, which contains electronic memory and possibly an embedded integrated circuit (IC), which allows them to do a small amount of processing. Smartcards containing an IC (a.k.a. microprocessor) can cost 3-6 times more than non-IC cards, and are sometimes called Integrated Circuit Cards (ICC’s).”³¹⁷ Much like flash memory, to access the data on a smartcard, you insert the card into a device known as a smart card reader.

Smartcards can be used for a variety of purposes, including storage of personal data like medical records, newer cell phone configuration information, management of passwords and digital certificate data, electronic “cash” (school dining credits, department store gift cards, etc), access control (the widely used “card key”) and generating network authentication information (using a one-time password instead of a fixed password every time you login).

It is estimated that as of the end of 1999, more than 1.5 billion smartcards were in use worldwide. They are managed by smartcard life cycle management software, which is generally obtained from a different source than the smart cards themselves, such as Bellid³¹⁸ or Litronic³¹⁹. Because the capabilities of smartcards differ so substantially, you need to look at a variety of areas when evaluating smart cards, including security features, supported applications, storage capacity, and standards supported, data access controls, processor support, programming methods and algorithms supported.

Security features on smartcards, in addition to the embedded memory and possible IC, may include pictures, biometric data storage, bar codes, a magnetic stripe (as in credit cards) and even a very small antenna (for wireless communication that doesn’t require the card surface actually contact the reader).

Additionally, the chip, by virtue of being embedded in the card, is tamper-resistant. Typically each card has its own serial number³²⁰.

3.2.4.5  Flashcards 1 2 3 3.3  Security Topologies