Module 5.1: Physical Security

Finals Topic

Physical Security

• Involves the protection of physical items, objects, or areas from unauthorized access and misuse; Most technology-based controls can be circumvented if an attacker gains physical access.

Secure Facility

• Physical location with controls implemented to minimize the risk of attacks from physical threas

• Can take advantage of natural terrain, local traffic flow, and surrounding development and can complement these protection mechanisms (fences, gates, walls, guards, alarms)

Walls, Fencing, and Gates

(Physical Security Controls)

• Some of the oldest and most reliable elements of physical security; the essential starting point for perimeter control

Guards

(Physical Security Controls)

• Can evaluate each situation as it arises to make reasoned responses; most have standard operating procedures

Dogs

(Physical Security Controls)

• Keen sense of smell and hearing can detect intrusions that human guards cannot

ID Cards and Badges

(Physical Security Controls)

• ID card is typically concealed and name badge is visible

• Serve as a simple form of biometrics (facial recognition)

• Should not be the only means of controls as cards can be easily duplicated, stolen, and modified

• Tailgating occurs when authorized individual opens a door and other people also enter

Locks and Keys

(Physical Security Controls)

• Locks can sometimes fail and alternative procedures for controlling access must be put in place

Mantraps

(Physical Security Controls)

• Small enclosure that has an entry point and a different exit point

• Individual enters this, requests access, and, if verified, is allowed to exit mantrap into facility

• Individual denied entry is not allowed to exit until the security official overrides automatic locks of the enclosure

Electronic Monitoring

(Physical Security Controls)

• Equipment can record events in areas where other types of physical controls are impractical

• May use cameras with video recorders; includes CCT system

• Drawbacks:
  - Passive: does not prevent access or prohibited activity
  - Recordings often are not monitored in real time; must be reviewed to have any value

Alarms and alarm systems

(Physical Security Controls)

• Alarm systems notify people/systems when an event occurs.

• Detect fire, intrusion, environmental disturbance, or an interruption in services

• Rely on sensors that detect an event, for example, motion detectors, thermal detectors, glass breakage detectors, weight sensors, and contact sensors

Computer rooms and wiring closets

(Physical Security Controls)

• Require special attention to ensure confidentiality, integrity, and availability of information

• Logical access controls are easily defeated if attacker gains physical access to computing equipment

• Custodial staff, often the least scrutinized people who have access to offices, are given greatest degree of unsupervised access

Interior walls and doors

(Physical Security Controls)

• Information asset security is sometimes compromised by improper construction of facility walls and doors.

• Facility walls are typically either standard interior or firewall

• High-security areas must have firewall-grade walls to provide physical security against potential intruders and fires

• Doors allowing access to high-security rooms should be evaluated

• To secure doors, install push or crash bars on computer rooms and closets

Fire Detection and Response

• Fire suppression systems: devices installed and maintained to detect and respond to a fire, potential fire, or combustion danger

• It is imperative that physical security plans implement strong measures to detect and respond to fires and fire hazards.

Fire detection

(Fire Detection and Response)

• Fall into 2 general categories: manual and automatic

• To prevent an attacker slipping into offices during an evacuation, programs often designate a person from each office area to serve as a floor monitor

• 3 basic types of fire detection system: thermal, smoke, and flame detection

Fire Suppression

(Fire Detection and Response)

• Systems can consist of portable, manual, or automatic apparatus

• Installed systems apply suppressive agents, usually either sprinkler or gaseous systems

Gaseous Emission systems

(Fire Detection and Response)

• 2 types of this system: carbon dioxide and halon

• Carbon dioxide removes fire’s oxygen supply

• Halon is clean but has been classified as an ozone-depleting substance; new installations are prohibited

Ventilation Shafts

(Heating, Ventilation, and Air Conditioning)

• While ductwork is small in residential buildings, in large commercial buildings it can be large enough for an individual to climb through

• If ducts are large, security can install wire mesh grids at various points to compartmentalize the runs

Power management and conditioning

(Heating, Ventilation, and Air Conditioning)

• Power systems used by information-processing equipment must be properly installed and correctly grounded

• Noise that interferes with the normal 60 Hertz cycle can result in inaccurate time clocks or unreliable internal clocks inside CPU

Grounding and amperage

(Heating, Ventilation, and Air Conditioning)

• Grounding ensures that returning flow of current is properly discharged to ground

• Overloading a circuit can create a load exceeding electrical cable’s rating, increasing the risk of overheating and fire

Uninterruptible Power Supply (UPS)

(Heating, Ventilation, and Air Conditioning)

• In case of power outage, UPS is the backup power source for major computing systems

Emergency Shutoff

(Heating, Ventilation, and Air Conditioning)

• Important aspect of power management is the ability to stop power immediately if the current represents a risk to human or machine safety

• Most computer rooms and wiring closets are equipped with an emergency power shutoff

Water Problems

• Lack of water poses problem to systems, including fire suppression and air-conditioning systems

• Surplus of water, or water pressure, poses a real threat (flooding, leaks)

• Very important to integrate water detection systems into alarm systems that regulate overall facility operations

Structural Collapse

• Unavoidable environmental factors/forces can cause failures in structures that house an organization

• Structures are designed and constructed with specific load limits; overloading these limits results in structural failure and potential injury or loss of life

• Periodic inspections by qualified civil engineers assist in identifying potentially dangerous structural conditions

Maintenance of Facility Systems

• Physical security must be constantly documented, evaluated, and tested

• Documentation of facility’s configuration, operation, and function should be integrated into disaster recovery plans and standard operating procedures

• Testing helps improve the facility’s physical security and identify weak points

Securing Mobile and Portable Systems

• Mobile computing requires more security than typical computing infrastructures on the organization’s premises

• Many mobile computing systems
  - Have corporate information within them
  - Some are configured to facilitate user’s access into organization’s secure computing facilities

• Controls support security and retrieval of lost or stolen laptops