2 cissp ® Official Study Guide Eighth Edition

Input and Output Devices
Input and output devices are often seen as basic, primitive peripherals and usually don’t 
receive much attention until they stop working properly. However, even these basic devices 
can present security risks to a system. Security professionals should be aware of these risks 
and ensure that appropriate controls are in place to mitigate them. The next four sections 
examine some of the risks posed by specific input and output devices.
Monitors
Monitors seem fairly innocuous. After all, they simply display the data presented by the 
operating system. When you turn them off, the data disappears from the screen and can’t 
be recovered. However, technology from a program known as 
TEMPEST
can compromise 
the security of data displayed on a monitor. Generally, cathode ray tube (CRT) monitors 
are more prone to radiate significantly, whereas liquid crystal display (LCD) monitors leak 
much less (some claim not enough to reveal critical data).
TEMPEST is a technology that allows the electronic emanations that every monitor 
produces (known as 
Van Eck radiation
) to be read from a distance (this process is known 
as 
Van Eck phreaking
) and even from another location. The technology is also used to pro-
tect against such activity. Various demonstrations have shown that you can easily read the 
screens of monitors inside an office building using gear housed in a van parked outside on 
the street. Unfortunately, the protective controls required to prevent Van Eck radiation (lots 
and lots of copper!) are expensive to implement and cumbersome to use. It is arguable that 
the biggest risk with any monitor is still shoulder surfing or telephoto lenses on cameras. 
The concept that someone can see what is on your screen with their eyes or a video camera 
is known as 
shoulder surfing
. Don’t forget shoulder surfing is a concern for desktop dis-
plays, notebook displays, tablets, and mobile phones.