Physical Security Assessment
Download as PPTX, PDF13 likes6,480 views
This document provides an agenda and overview for conducting a comprehensive physical security risk assessment. It includes definitions of physical security, outlines roles and responsibilities, and provides sample tools and checklists to guide the assessment. When to conduct an assessment, why it's important, and how to develop a risk appetite and project plan are also covered. The goal is to identify vulnerabilities and risks in order to create an effective corrective action plan to improve security.
Physical Security Assessment
- 2. Agenda Physical Security – Baseline Definitions and Convergence DriversWhat is a Risk Assessment; When Should You Do One; and Why?Determining Your Company’s/Organization’s Unique/Individual Risk AppetiteGetting Started – The Project PlanSample Risk Assessment ToolsYour Corrective Action Plan – Basics to Consider
- 3. Physical Security Baseline DefinitionsPhysical security involves measures undertaken to protect personnel, equipment and property against anticipated threats. Passive measures include the effective use of architecture, landscaping and lighting to achieve improved security by deterring, disrupting or mitigating potential threats.
- 4. Active measures include the use of proven systems and technologies designed to deter, detect, report and react against threats.ISO 27001 role of physical security – Protect the organization’s assets by properly choosing a facility location, maintaining a security perimeter, implementing access control and protecting equipment.The physical security office is usually responsible for developing and enforcing appropriate physical security controls, in consultation with the computer security management, program and functional managers, and others, as appropriate. Physical security should address not only central computer installations, but also backup facilities and office environments. In the government, this office is often responsible for the processing of personnel background checks and security clearances.What is the impact of convergence (merging IT security and physical security) on this role and how does it play into the responsibilities for physical security risk assessments and action plans?
- 5. Security Roles and ResponsibilitiesOperational SecurityThe process of creating policies and procedures and establishing controls to preserve privileged information regarding organizational capabilities and vulnerabilities. This is done by identifying, controlling and protecting those interests associated with the integrity and the unimpeded performance of a facility. Includes, training, policies and procedures, facilities access, tenant space.Facilities ManagementThis role is almost exclusively planted in the world of physical security management. Key skills are the ability to run and maintain crucial environmental systems, mechanical processes, HVAC, fire alarms, etc. Facility Managers can extend their knowledge through teaming with other security professionals to understand risk management and technical security advances that will enhance the overall security posture of their organization.Information SecurityThe process of protecting the confidentiality, integrity and availability of data from accidental or intentional misuse by people inside or outside the organization or facility. Key elements, limiting/managing access to informational and Information Technology resources, ensuring data is protected in transmission, developing and enforcing policies, audit and compliance, incident management. What is a Risk Assessment? Prior to embarking on the risk assessment, ensure that policies and procedures are in place and have been updated recently and ensure that an effective security program is in place.
- 6. The purpose of the risk assessment is to assess the system’s use of resources and controls (implemented and planned) to eliminate and/or manage vulnerabilities that are exploitable by threats to the organization. It will also identify any of the following vulnerabilities:Risks associated with the system operational configurationSystem’s safeguards, threats and vulnerabilitiesNew threats and risks that might exist and, therefore, will need to be addressed in the corrective action planView the system relative to its conformance with corporate policies and procedures and all applicable legal and regulatory requirements
- 7. The risk assessment should:Provide a clear definition of the scope of the assessment such as present configuration, physical, environmental, personnel, telecommunications, and administrative security services providedIdentify which assets need to be protected and assign a value to each asset, identify owners and label its business criticality.Identify any and all threats.Identified threats can be incorporated into a dynamic threat model/digital dashboard and integrated to other threat and vulnerability models, data, etc.
- 8. Once identified, prioritize threats along with means to counter and respond to themA typical weakness to most security programs/plans is the lack of a comprehensive risk and vulnerability assessment and most only address security from an electronics systems perspective
- 9. When Should You do a Risk Assessment?Your Company has a policy to conduct a periodic or annual enterprise risk assessmentYou are opening a new facility or movingYou have had an audit findingYou have had a breach / other identified vulnerabilityCompliance to legal and regulatory requirementsMergers, acquisitions, divestituresOutsourcingPartnerships and alliancesYou are implementing a new technologyOther?
- 10. Why Should You Do a Risk Assessment?A comprehensive integrated risk and vulnerability assessment will assist management in critical financial decisions as well as budgeting
- 11. Since 911 everyone is increasingly concerned with safety of tenants and employees
- 12. If you don’t have an integrated risk assessment, how do you know what your security program should be, what to do first, second, etc.?
- 13. How do you justify costs, resources, schedules, etc. without the output of a risk assessment?
- 14. How do you know if you are compliant to legal and regulatory requirements?
- 15. How do you know what an acceptable level of risk is for your organization and how do you communicate that and implement policies and procedures around that?
- 16. Through the process of the risk, threat and vulnerability assessment you will learn and discover things about your environment that were previously unknown.
- 17. Depending on time and available resources, quantitative and qualitative assessments both have value. There are pros and cons to each.Determining Your Unique/Individual Risk AppetiteTo define your organization’s risk appetite and determine the acceptable level of risk, you should answer the following questions:Where do we feel we should allocate our limited time and resources to minimize risk exposures? Why?
- 18. What level of risk exposure requires immediate action? Why?
- 19. What level of risk requires a formal response strategy to mitigate the potentially material impact? Why?
- 20. What events have occurred in the past, and at what level were they managed? Why?Each question is followed by a “why” because the organization should be able to articulate the quantitative and/or qualitative basis for the appetite, or it will come off as backwards-looking (based only on historical events) or even arbitrary.Develop a risk appetite table.
- 21. Getting StartedDevelop a project plan and schedule (follow traditional project management discipline and methodology)Identify policies and guidelines to follow models and methodologiesIdentify areas to be reviewed, measurement criteria and resourcesDecide on scoring methodology (quantitative or qualitative analysis)Identify other existing resources/inputs and how that information will factor in Scorecards, metrics, audit findings, compliance assessments, incidents, vulnerability assessments, etc.Define end state and all output (documents, reports, presentations, action plan, etc.)
- 22. Security Risk Assessment OutlineBackgroundPurposeScopeAssumptionsDescription of SystemSystem AttributesSystem SensitivitySystems SecurityAdministrative SecurityPhysical SecurityTechnical SecuritySoftware SecurityTelecommunications SecurityPersonnel SecuritySystem VulnerabilitiesTechnical VulnerabilityPersonnel VulnerabilityTelecommunications VulnerabilityEnvironmental VulnerabilityPhysical VulnerabilityGlossary of TermsAcronyms
- 23. Simple Assessment ChecklistFacilities and PhysicalWhat preventative measures do you currently have in place? (Yes, No, N/A)Access to secured areas limited to necessary personnel.Monitor and review the distribution of keys and/or access codes.When employee terminates, keys are collected and/or access codes are terminated.Physically secure equipment that is portable and located in open access areas.Use of security cameras in areas where equipment cannot be easily secured or monitored (for example in computer labs and classrooms).Use the 'STOP' Program to track property and equipment.Require employees to attend vehicle safety training offered by Environmental Heath & Safety.Reported previous losses to Public Safety at the time they were discovered.Implement specific preventative measures in direct response to a loss.
- 24. Another Assessment / C heck list I T Facilities or Computer RoomSecurity is the most important part of maintaining the security of a computer system, and is often overlooked by careless system administrators who assume their occasional proximity to a system is enough protection. This may be sufficient for some systems, but in most cases, there are more factors to be considered before a system can be called physically safe and secure.Is the system located on a sturdy, stable surface as close to the ground as possible?
- 25. Is the system safe from excessive sunlight, wind, dust, water, or extreme hot/cold temperatures?
- 26. Is this system located in a monitored, isolated area that sees little human traffic?
- 27. Is the room/building in which the system is located secured by lock and alarm system to which only a few trusted / identified personnel have access? Are these locks and alarms locked and armed during off hours?
- 28. Is the console of the system secured to prevent someone from casually walking up to the system and using it (even if just for a few seconds)? Are all users logged out from the console?
- 29. Is the power and reset switches protected or disabled?
- 30. Are any input devices to the system secured/turned off: are all removable disk drives locked/secured? Are the parallel/serial/infrared/Bluetooth/USB/SCSI ports secured or removed? Are any attached hard drives physically locked down to the systems?
- 31. Is your physical network secured with no danger of unauthorized wiring?Secure Assess – GSA (Software Tool)General Security Assessment (GSA)General Facility Information
- 32. Physical Security Protections – Facility
- 33. Information System(s) Network – Physical Security
- 37. Organizational SecurityAdditional if missed in your reviewLock up the Server RoomSet up surveillanceMake sure the most vulnerable devices are in that locked roomUse rack mount serversDon’t forget the workstationsKeep intruders from opening the caseProtect the portables and remote access devicesPack up the backupsDisable decommissioned drivesProtect your Printers and FAX machines
- 38. Use These Tools to Remediate WeaknessesSecurity systems with features such as access control and CCTV were designed and installed to help deter criminal activity, record entry and exit, and protect employees while on the job. In addition to providing employee protection, these security tactics serve the dual purpose of protecting the company against fraudulent lawsuits filed by employees or visitors.Badging (access cards, picture badges, color code non-employees, temporary visitor badges/process)
- 39. Card Readers (integration of physical and logical access)
- 40. Integration of physical and electronic security (IBM and CISCO)If three people try to enter a door with only one security card recorded upon entry, the image from the security camera can alert the guards to investigate a possible intrusion.Surveillance Systems / Digital Cameras
- 41. Receptionist desk at main entry point
- 42. Security Guards Policies and ProceduresSimple and effective changes to a company’s policies and procedures can often have just as great an impact on risk reduction as capital improvements or installation of security devices.Policy and procedure changes are generally quick to implement and low in cost, making them an extremely effective way to improve security. The key to the success of any change is to make sure that the staff understands and accepts the new policies and procedures. It is imperative that the staff is well informed of the policies and procedures and the reason that these are important. Policies and procedures can only be effective when they are consistently implemented. Some general policy and procedural recommendations provided below.Track keys issued to personnel. Retrieve keys when no longer needed, including those instances when personnel are reassigned. Replace locks on an as-needed basis to reduce the likelihood of security breaches due to lost keys, unauthorized duplicate keys, keys held by former employees, etc. Replace of the traditional key systems with a card reader system for better control options. Implement random, but frequent, inspections of the security perimeter at critical facilities identified in the vulnerability assessment and designating appropriate review intervals for inspections of security equipment at other facilities. Establish a minimum number of personnel in the inspection crew in procedures, safety plans, etc. Implement a formal annual review of the adequacy of security plans, procedures, and equipment.
- 43. Policies and Procedures (continued)Involve and cooperate with other organizations that can affect the utility’s security. For example, contact chlorine and other chemical suppliers to discuss the need for adequate security during transport as well as to develop protocols to respond to missing or delayed shipments. Maintain replacement parts and emergency repair kits for critical assets, such as generators, that are important during emergencies. Maintain redundant equipment, critical replacement parts, etc. in a separate or isolated location. It can be on site or nearby, but not within the same building or room. Develop a utility vehicle use policy (including locking vehicles and tool bins, securing tools, etc). Establish procedures for night shift workers, including regular check-ins with supervisors. Establishing published guidelines so that all future procurements and designs address security issues and incorporate solutions. All requests for proposals should include a security portion so that responding consultants are reminded that security must be addressed in their work and in their own operational practices. Continuing to monitor the visitor entrance. Establish a policy for facility tours delineating who is authorized to approve access, areas that can be accessed, and the times that tours are allowed.
- 44. Impact of Information Security Legislation
- 45. Thorny Solutions – Landscape SecurityReinforced planters, light posts and benches are often used to enhance site security, making it impossible for a bomb-laden car to get close to a building. What landscape options are available for companies that are concerned about individual trespassers accessing high-security areas?Some trees and scrubs can be useful in this case.HawthorneHardy OrangeBlack LocustPyracanthaBarberryRoses