Home | | Information Security | Information Physical Security

Chapter: Information Security : Physical Design

Information Physical Security

Physical security addresses design, implementation, and maintenance of countermeasures that protect physical resources of an organization.

PHYSICAL SECURITY

 

Introduction

 

Physical security addresses design, implementation, and maintenance of countermeasures that protect physical resources of an organization.

 

Most controls can be circumvented if attacker gains physical access

 

Physical security is as important as logical security

 

Seven major sources of physical loss

 

Extreme temperature

 

Gases

 

Liquids

 

Living organisms

 

Projectiles

 

Movement

 

Energy anomalies

 

Community roles

 

 

General management: responsible for facility security

 

IT management and professionals: responsible for environmental and access security

 

Information security management and professionals: perform risk assessments and implementation reviews

 

 

Physical Access Controls


Secure facility: physical location engineered with controls designed to minimize risk of attacks from physical threats

 

Secure facility can take advantage of natural terrain, traffic flow, and degree of urban development; can complement these with protection mechanisms (fences, gates, walls, guards, alarms)

 

1 Controls for Protecting the Secure Facility

 

Walls, fencing, and gates

 

Guards

 

Dogs

 

ID Cards and badges

 

Locks and keys

 

Mantraps

 

Electronic monitoring

 

Alarms and alarm systems

 

Computer rooms and wiring closets

 

Interior walls and doors

 

2 ID Cards and Badges

 Ties physical security with information access control

 

ID card is typically concealed

 

Name badge is visible

 

Serve as simple form of biometrics (facial recognition)

 

Should not be only means of control as cards can be easily duplicated, stolen, and modified

 

Tailgating occurs when unauthorized individual follows authorized user through the control

 

3 Locks and Keys

 

Two types of locks: mechanical and electromechanical

 

Locks can also be divided into four categories: manual, programmable, electronic, biometric

 

Locks fail and alternative procedures for controlling access must be put in place

 

Locks fail in one of two ways

 

Fail-safe lock

 

Fail-secure lock

 

4 Mantraps

 

Small enclosure that has entry point and different exit point

 

Individual enters mantrap, requests access, and if verified, is allowed to exit mantrap into facility

 

Individual denied entry is not allowed to exit until security official overrides automatic locks of the enclosure 

 


 

5 Electronic Monitoring

 

Records events where oth er types of physical controls are impractical or incomplete

 

May use cameras with vi deo recorders; includes closed-circuit television (CCT) systems

 

Drawbacks

 

Reactive; do not p revent access or prohibited activity

 

Recordings often not monitored in real time; must be reviewed to have any value

 

Alarms and Alarm Syste ms

 

Alarm systems notify when an event occurs

 

Detect fire, intrusion, env ironmental disturbance, or an interruption in se rvices

 

Rely on sensors that d etect event; e.g., motion detectors, smoke d etectors, thermal detectors, glass breakage detectors, weight sensors, contact sensors, vibr ation sensors

 

6 Computer Rooms and  Wiring Closets

 

ü Require special attenti on to ensure confidentiality, integrity, and availability of information

 

ü Logical controls easily d efeated if attacker gains physical access to comp uting equipment

 

 

Custodial staff often the least scrutinized persons who have access to offices; are given greatest degree of unsupervised access

 

 

7 Interior Walls and Doors

 

Information asset security sometimes compromised by construction of facility walls and doors

 

Facility walls typically either standard interior or firewall

 

High-security areas must have firewall-grade walls to provide physical security from potential intruders and improve resistance to fires

 

Doors allowing access to high security rooms should be evaluated

 

Recommended that push or crash bars be installed on computer rooms and closets

 

8 Fire Security and Safety

Most serious threat to safety of people who work in an organization is possibility of fire

 

Fires account for more property damage, personal injury, and death than any other threat

 

Imperative that physical security plans examine and implement strong measures to detect and respond to fires

 

9 Fire Detection and Response

 

Fire suppression systems: devices installed and maintained to detect and respond to a fire

 

Deny an environment of heat, fuel, or oxygen

 

Water and water mist systems

 

Carbon dioxide systems

 

Soda acid systems

 

Gas-based systems

 

10 Fire Detection

 

Fire detection systems fall into two general categories: manual and automatic

 

Part of a complete fire safety program includes individuals that monitor chaos of fire evacuation to prevent an attacker accessing offices

 

There are three basic types of fire detection systems: thermal detection, smoke detection, flame detection

 

11 Fire Suppression

 

Systems consist of portable, manual, or automatic apparatus

 

Portable extinguishers are rated by the type of fire: Class A, Class B, Class C, Class D

 

Installed systems apply suppressive agents; usually either sprinkler or gaseous systems

 

Power Management and Conditioning

 

Electrical quantity (voltage level; amperage rating) is a concern, as is quality of power (cleanliness; proper installation)

 

Noise that interferes with the normal 60 Hertz cycle can result in inaccurate time clocks or unreliable internal clocks inside CPU

 

Grounding ensures that returning flow of current is properly discharged to ground

 

Overloading a circuit causes problems with circuit tripping and can overload electrical cable, increasing risk of fire

 

Inventory Management

 

Computing equipment should be inventoried and inspected on a regular basis

 

Classified information should also be inventoried and managed

 

Physical security of computing equipment, data storage media and classified documents varies for each organization

 

Study Material, Lecturing Notes, Assignment, Reference, Wiki description explanation, brief detail
Information Security : Physical Design : Information Physical Security |


Privacy Policy, Terms and Conditions, DMCA Policy and Compliant

Copyright © 2018-2024 BrainKart.com; All Rights Reserved. Developed by Therithal info, Chennai.