Whitman_Ch09.pdf information security slide

Principles of Information Security
Sixth Edition
Chapter 9
Physical Security
Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.

for classroom use.
Learning Objectives
• Upon completion of this material, you should be able to:
– Discuss the relationship between information security and
physical security
– Describe key physical security considerations, including
fire control and surveillance systems
– Identify critical physical environment considerations for
computing facilities, including uninterruptible power
supplies

for classroom use.
Introduction (1 of 3)
• Physical security involves the protection of physical
items, objects, or areas from unauthorized access and
misuse.
• Most technology-based controls can be circumvented if
an attacker gains physical access.
• Physical security is as important as logical security.

for classroom use.
• Donn B. Parker’s seven major sources of physical loss:
– Extreme temperature: heat, cold
– Gases: war gases, commercial vapors, humid or dry air,
suspended particles
– Liquids: water, chemicals
– Living organisms: viruses, bacteria, people, animals,
insects
– Projectiles: tangible objects in motion, powered objects
– Movement: collapse, shearing, shaking, vibration,
liquefaction, flow waves, separation, slide

for classroom use.
– Energy anomalies: electrical surge or failure, magnetism,
static electricity, aging circuitry; radiation: sound, light,
radio, microwave, electromagnetic, atomic
• Community roles:
– General management: responsible for facility security
– IT management and professionals: responsible for
environmental and access security
– Information security management and professionals:
perform risk assessments and implementation reviews

for classroom use.
Physical Access Controls
• Secure facility: physical location with controls
implemented to minimize the risk of attacks from
physical threats.
• Secure facility can take advantage of natural terrain,
local traffic flow, and surrounding development and can
complement these with protection mechanisms (fences,
gates, walls, guards, alarms).

for classroom use.
Physical Security Controls (1 of 9)
• Walls, fencing, and gates
• Guards
• Dogs
• ID cards and badges
• Locks and keys
• Mantraps
• Electronic monitoring
• Alarms and alarm systems
• Computer rooms and wiring closets
• Interior walls and doors

for classroom use.
• Walls, fencing, and gates
– Some of the oldest and most reliable elements of physical
security; the essential starting point for perimeter control
• Guards
– Can evaluate each situation as it arises to make reasoned
responses; most have standard operating procedures
• Dogs
– Keen sense of smell and hearing can detect intrusions
that human guards cannot

for classroom use.
• ID cards and badges
– ID card is typically concealed and name badge is visible
– Serve as a simple form of biometrics (facial recognition)
– Should not be the only means of control as cards can be
easily duplicated, stolen, and modified
– Tailgating occurs when an authorized individual opens a
door and other people also enter

for classroom use.
• Locks and keys
– Two types of locks: mechanical and electromechanical
– Locks can also be divided into four categories: manual,
programmable, electronic, biometric
– Locks fail and alternative procedures for controlling
access must be put in place
– Locks fail in one of two ways:
 Fail-safe lock
 Fail-secure lock

for classroom use.
• Mantraps
– Small enclosure that has an entry point and a different
exit point.
– Individual enters mantrap, requests access, and, if
verified, is allowed to exit mantrap into facility.
– Individual denied entry is not allowed to exit until the
security official overrides automatic locks of the
enclosure.

for classroom use.
• Electronic monitoring
– Equipment can record events in areas where other types
of physical controls are impractical
– May use cameras with video recorders; includes closed-
circuit television (CCT) systems
– Drawbacks
 Passive; does not prevent access or prohibited activity
 Recordings often are not monitored in real time; must be
reviewed to have any value

for classroom use.
• Alarms and alarm systems
– Alarm systems notify people/systems when an event
occurs
– Detect fire, intrusion, environmental disturbance, or an
interruption in services
– Rely on sensors that detect an event, for example, motion
detectors, thermal detectors, glass breakage detectors,
weight sensors, and contact sensors

for classroom use.
• Computer rooms and wiring closets
– Require special attention to ensure confidentiality,
integrity, and availability of information.
– Logical access controls are easily defeated if attacker
gains physical access to computing equipment.
– Custodial staff, often the least scrutinized people who
have access to offices, are given greatest degree of
unsupervised access.

for classroom use.
• Interior walls and doors
– Information asset security is sometimes compromised by
improper construction of facility walls and doors.
– Facility walls are typically either standard interior or
firewall.
– High-security areas must have firewall-grade walls to
provide physical security against potential intruders and
fires.
– Doors allowing access to high-security rooms should be
evaluated.
– To secure doors, install push or crash bars on computer
rooms and closets.

for classroom use.
Figure 9-1 Tailgating

for classroom use.
Figure 9-2 Locks

for classroom use.
Figure 9-3 Mantraps

for classroom use.
Fire Security and Safety
• Most serious threat to safety of people who work in an
organization is fire.
• Fires account for more property damage, personal
injury, and death than any other threat.
• It is imperative that physical security plans implement
strong measures to detect and respond to fires and fire
hazards.

for classroom use.
Fire Detection and Response (1 of 4)
• Fire suppression systems: devices installed and
maintained to detect and respond to a fire, potential fire,
or combustion danger.
• Flame point: temperature of ignition.
• Deny an environment of temperature, fuel, or oxygen
– Water and water mist systems
– Carbon dioxide systems
– Soda acid systems
– Gas-based systems

for classroom use.
• Fire detection
– Fire detection systems fall into two general categories:
manual and automatic
– To prevent an attacker slipping into offices during an
evacuation, programs often designate a person from each
office area to serve as a floor monitor
– There are three basic types of fire detection systems:
thermal detection, smoke detection, flame detection

for classroom use.
• Fire suppression
– Systems can consist of portable, manual, or automatic
apparatus
– Portable extinguishers are rated by the type of fire: Class
A, Class B, Class C, Class D, Class K
– Installed systems apply suppressive agents, usually either
sprinkler or gaseous systems

for classroom use.
• Gaseous emission systems
– Until recently, two types of systems: carbon dioxide and
Halon
– Carbon dioxide removes fire’s oxygen supply
– Halon is clean but has been classified as an ozone-
depleting substance; new installations are prohibited
– Alternative clean agents presented in Table 9-1 (found on
page 521 in the text) are reported to be less effective than
Halon

for classroom use.
Figure 9-4 Water sprinkler system
• When the ambient temperature reaches 140-150°F,
the liquid- filled glass tube trigger breaks, releasing the
stopper and allowing water to hit the diffuser, spaying
water throughout the area

for classroom use.
Figure 9-5 Gaseous fire suppression system
(1 of 2)
• System Components:
1. Discharge nozzles
2. Piping
3. Control panel
4. Discharge or warning alarms (s)
5. Hazard warning or caution signs
6. Automatic fire detection devices (s)
7. Manual discharge station (s)
8. Storage container (s) and extinguishing agent

for classroom use.
Figure 9-5 Gaseous fire suppression
system (2 of 2)

for classroom use.
Failure of Supporting Utilities and
Structural Collapse
• Supporting utilities (heating, ventilation, and air
conditioning; power; water) have significant impact on
continued safe operation of a facility.
• Each utility must be properly managed to prevent
potential damage to information and information
systems.

for classroom use.
Heating, Ventilation, and Air Conditioning (1
of 5)
• Areas within heating, ventilation, and air conditioning
(HVAC) systems that can cause damage to information
systems include:
– Temperature
– Filtration
– Humidity
– Static electricity

for classroom use.
Heating, Ventilation, and Air Conditioning
(2 of 5)
• Ventilation shafts
– While ductwork is small in residential buildings, in large
commercial buildings, it can be large enough for an
individual to climb through
– If ducts are large, security can install wire mesh grids at
various points to compartmentalize the runs
• Power management and conditioning
– Power systems used by information-processing
equipment must be properly installed and correctly
grounded

for classroom use.
(3 of 5)
– Noise that interferes with the normal 60-Hertz cycle can
result in inaccurate time clocks or unreliable internal
clocks inside the CPU
• Grounding and amperage
– Grounding ensures that the returning flow of current is
properly discharged to ground
– Ground fault circuit interruption (GFIC) capable of quickly
identifying and interrupting a ground fault
– Overloading a circuit can create a load exceeding
electrical cable’s rating, increasing the risk of overheating
and fire

for classroom use.
Heating, Ventilation, and Air
Conditioning (4 of 5)
• Uninterruptible power supply (UPS)
– In case of power outage, UPS is the backup power
source for major computing systems
– Basic UPS configurations:
 Standby
 Line-interactive
 Standby online hybrid
 Standby ferroresonant
 Double conversion online
 Data conversion online

for classroom use.
(5 of 5)
• Emergency shutoff
– Important aspect of power management is the ability to
stop power immediately if the current represents a risk to
human or machine safety
– Most computer rooms and wiring closets are equipped
with an emergency power shutoff

for classroom use.
Table 9-1 Static Charge Damage in
Computers
Voltage Possible Damage
40
High probability of damage to sensitive
circuits and transistors
1.000 Scrambles monitor display
1,500 Can cause disk drive data loss
2,000 High probability of system shutdown
4000 May jam printers
17,000
Causes certain and permanent damage
to almost all microcircuitry

for classroom use.
Figure 9-6 Types of uninterruptible power
supplies

for classroom use.
Water Problems
• Lack of water poses problem to systems, including fire
suppression and air-conditioning systems.
• Surplus of water, or water pressure, poses a real threat
(flooding, leaks).
• Very important to integrate water detection systems into
alarm systems that regulate overall facility operations.

for classroom use.
Structural Collapse
• Unavoidable environmental factors/forces can cause
failures in structures that house an organization.
• Structures are designed and constructed with specific
load limits; overloading these limits results in structural
failure and potential injury or loss of life.
• Periodic inspections by qualified civil engineers assist in
identifying potentially dangerous structural conditions.

for classroom use.
Maintenance of Facility Systems
• Physical security must be constantly documented,
evaluated, and tested.
• Documentation of facility’s configuration, operation, and
function should be integrated into disaster recovery
plans and standard operating procedures.
• Testing helps improve the facility’s physical security and
identify weak points.

for classroom use.
Interception of Data
• Three methods of data interception:
– Direct observation
– Interception of data transmission
– Electromagnetic interception
• U.S. government developed TEMPEST program to
reduce the risk of electromagnetic radiation (EMR)
monitoring.

for classroom use.
Securing Mobile and Portable
Systems (1 of 2)
• Mobile computing requires more security than typical
computing infrastructures on the organization’s
premises.
• Many mobile computing systems
– Have corporate information stored within them.
– Are configured to facilitate user’s access into
organization’s secure computing facilities.

for classroom use.
Securing Mobile and Portable Systems
(2 of 2)
• Controls support security and retrieval of lost or stolen
laptops
– CompuTrace software, stored on laptop; reports to a
central monitoring center
– Burglar alarms are made up of a PC card that contains a
motion detector

for classroom use.
Figure 9-7 Laptop recovery

for classroom use.
Remote Computing Security
• Remote site computing involves variety of computing
sites outside the organization’s main facility.
• Telecommuting: off-site computing using Internet, dial-
up, or leased point-to-point links.
• Employees may need to access networks on business
trips; telecommuters need access from home systems
or satellite offices.
• Telecommuter’s computers must be made more secure
than organization’s systems.

for classroom use.
Special Considerations for Physical
Security Threats
• Develop physical security in-house or outsource?
– Many qualified and professional agencies
– Benefit of outsourcing includes gaining experience
and knowledge of agencies
– Downside includes high expense, loss of control over
individual components, and level of trust that must be
placed in another company
• Social engineering: use of people skills to obtain
information from employees that should not be released

for classroom use.
Inventory Management
• Computing equipment should be inventoried and
inspected on a regular basis.
• Classified information should also be inventoried and
managed.
• Physical security of computing equipment, data storage
media, and classified documents varies for each
organization.

for classroom use.
Summary
• Threats to information security that are unique to
physical security
• Key physical security considerations in a facility site
• Physical security monitoring components
• Essential elements of access control
• Fire safety, fire detection, and response
• Importance of supporting utilities, especially use of
uninterruptible power supplies
• Countermeasures to physical theft of computing devices

Whitman_Ch09.pdf information security slide

More Related Content

Similar to Whitman_Ch09.pdf information security slide (20)

Recently uploaded (20)

Whitman_Ch09.pdf information security slide