Domain 3 Reading

Physical Facilities:

  • Data Centers: Secure facilities containing all servers, storage, and other computing resources needed to run a business

  • Server Rooms: Smaller rooms of servers and that often lack strong security controls

  • Media Storage Facilities: Other remote facilities storing data or backups of data that must have security standards at least as strong as the main data center

  • Evidence Storage Rooms: Rooms that hold evidence from digital forensic investigations that must not be tampered with before it can be used in court

  • Wiring Closets: Hold wiring and network devices that, if not secured, can offer an intruder access to eavesdrop on the network.

Ways to Design for Security of Physical Facilities

  • Place facilities in areas where there are lots of people or vehicles

  • Use signs warning people about monitoring

  • Use gates to limit the number of entrances

  • Use bollards to prevent vehicles from entering an area

  • Crime prevention through environmental design

    • Natural surveillance

    • Natural access control

    • Natural territorial reinforcement

  • Visitor Management

    • Visit logs

    • Visitor badges

  • Security Personnel

    • Two-person integrity: Two people needed to approve access to physical facilities

    • Two-person control: Two people needed to carry out some function


Logical Access Control

  • Authorization: Determines the privileges that someone has when they successfully authenticate

    • Least Privilege: Individuals should only have the minimum set of permissions needed to accomplish job duties. Minimizes damage from an insider attack and limits ability to quickly gain privileged access

    • Segregation of Duties: No single person should possess two permissions that in combination allow a sensitive operation

    • Models of Authorization

      • Mandatory Access Controls: Operating systems restrict permissions that can be granted to users and processes on system resources by instead granting them based on labels on users and objects.

      • Discretionary Access Control: Flexible approach to authorization where users can assign access permissions to other users

      • Role-based Access Control: Job based roles with permissions assigned to the roles.

    • Accounts

      • User Accounts: Most accounts; assigned to an individual user and grant routine access to resources

      • Administrator Accounts: Highly sensitive accounts with extensive privileges to modify system configurations

      • Guest Accounts: Provide users with temporary access to resources

      • Shared or Generic Accounts: More than one individual has access to the account; bad because you can’t trace an action to a specific person

      • Service Accounts: Special type of account used internally to run a process or perform other actions

    • Non-Repudiation: Security goal that prevents someone from falsely denying something is true