Physical Security

Physical Security Overview

  • Physical Security Importance: Protects physical resources of an organization; essential alongside logical security.

  • Physical Access Threats: Controls can be circumvented if an attacker gains physical access.

Learning Objectives

  • Discuss the relationship between physical and information security.

  • Identify key physical security considerations, including fire control and surveillance systems.

  • Highlight critical considerations for computing facilities, such as uninterruptible power supplies (UPS).

Major Sources of Physical Loss

  • Extreme Temperature: Risks of overheating or freezing.

  • Gases and Liquids: Hazard from chemical leaks or spills.

  • Living Organisms: Biological threats including infestations.

  • Projectiles: Risks from debris or vandalism.

  • Movement: Risk of equipment misalignment or loss.

  • Energy Anomalies: Issues related to power outages or surges.

Community Roles

  • General Management: Responsible for overall facility security.

  • IT Management: Focuses on environmental and access security.

  • Information Security Management: Conducts risk assessments and reviews.

Physical Access Controls

  • Secure Facilities: Design and engineering to minimize risks from threats.

  • Protection Mechanisms: Fences, gates, walls, guards, and alarms to enhance security.

Physical Security Controls Techniques

Physical Barriers

  • Walls, Fencing, and Gates: Essential for restricting unauthorized access.

  • Personnel Security: Use of guards and dogs.

  • Access Authentication: Implementation of ID cards, badges, locks, and mantraps.

  • Electronic Monitoring: Deployment of CCTV and alarms to monitor access points.

ID Cards and Badges

  • Serve as a biometric form of control (facial recognition).

  • Vulnerabilities include duplication, theft and tailgating risks.

Locks and Keys

  • Types of Locks: Mechanical, electromechanical, manual, programmable, electronic, biometric.

  • Lock Failure Modes:

    • Fail-Safe: Unlocks when failure occurs.

    • Fail-Secure: Remains locked in case of failure.

Mantraps

  • Functionality: Enclosure for security verification before entry.

Electronic Monitoring

  • Purpose: Records activity; useful when physical controls are inadequate.

  • Limitations: Reactive nature and reliance on post-incident review.

Alarms and Alarm Systems

  • Functionality: Detects fire, intrusion, or environmental disturbances using various sensors.

Secure Areas

  • Computer Rooms and Wiring Closets: Need stringent access controls to protect sensitive data.

  • Interior Walls and Doors: Ensure high-security areas are protected with appropriate firewalls.

Fire Security and Safety

  • Fire Risks: Major threat to personnel, causes significant property damage.

  • Fire Detection and Response Systems: Include both manual and automatic systems.

    • Categories: Thermal, smoke, and flame detection.

  • Fire Suppression Systems: Use water mist, carbon dioxide, and gas-based systems for firefighting.

Failure of Supporting Utilities

  • Impact of Utilities: Heating, ventilation, power management must be safeguarded to avoid damage.

  • HVAC Risks: Temperature, humidity, and static electricity must be monitored.

Power Management

  • Uninterruptible Power Supply (UPS): Provides backup during outages with different configurations (standby, true online).

  • Grounding and Amperage: Essential to prevent electrical failures and ensure safety.

Maintenance and Inventory Management

  • Regular Inspections: Ensure physical security integrity and identify weaknesses.

  • Inventory Management: Regular checks on computing equipment, data storage, and classified documents.

Interception of Data

  • Methods of Interception: Direct observation, captured data transmissions, electromagnetic interception.

  • TEMPEST Program: Aimed at reducing the risk of data interception via electromagnetic emissions.

Mobile Security Considerations

  • Importance: Increased risks associated with laptops and mobile devices require enhanced security measures.

Summary of Physical Security Considerations

  • Understand the unique threats facing physical security.

  • Implement essential elements: access control, fire safety, and effective utility management.

  • Invest in countermeasures against physical theft of computing devices.