Chapter 5: Physical and Environmental Security - Proximity Protection

Proximity protection is put into place to provide four main services. First, it is used to control flow of vehicles and pedestrians. Different places on the property require different levels of protection as well. Buffers and delaying mechanisms are used in case of intrusion. The last service proximity protection is used for is control the entry points. These services can be provided using the various means describes below.

Access control - access systems, locks and keys. Also, educating personnel to be aware of their surroundings.

Physical barriers - walls, doors, fences, etc.

Intrusion detection - alarms, sensors that detect motion

Assessment - Cameras or security guards

Response - The ability to quickly get in touch with law enforcement

Deterrents - smart environmental design of an area

Chapter 5: Physical and Environmental Security - Locks

From a physical security standpoint, locks are used to delay intruders. They should never be the only method used for physical protection. There are many different kinds of locks, and they can be used for various things. However, the right type of lock should be used for each purpose. For example, you would not want to use a simple tumbler lock for the main door of your facility because it can be easily picked. In this post, I want to focus on ways a particular device can be physically locked. Switch controls cover up on/off switches so that important hardware is not powered off by accident or when it not supposed to be off. Slot locks are used to make sure that pieces of hardware stay in the same physical location. Port controls are used to prevent the unauthorized use of disk drives or other ports such as a USB port. Peripheral switch controls are used to make sure that items such as keyboards as mouse are not taken away from where they are supposed to be. Another method to do this is called cable traps, which lock up the device's cable so that it cannot be removed from its station.

Chapter 5: Physical and Environmental Security - Protecting Assets

To protect against potential power issues, there are a few best practices that all organizations should use to prevent fires, blackouts, or data loss. Surge protectors prevent excessive current and should be used whenever possible. When shutting down equipment, a process should be in place to ensure that machines are powered off properly and orderly. This is essential for devices to be protected from voltage changes that disorderly shut down can cause. Voltage and amplitude should always be monitored, and unauthorized access to breakers and transformers should always be prevented. When it comes to potential water damage, positive drains should be implemented. This term means that the flow of water should always be directed outside. To add to this, fire protection and proper ventilation should also be used to successfully protect a company's computerized assets.

Chapter 5: Physical and Environmental Security - Designing a Physical Security Program

To design a proper physical security program, all aspects of your physical surroundings should be surveyed and assessed. This goes for everything; an obvious example would be the construction material of walls. A more obscure or less obvious example would be the vehicle activity outside of the building. It is also very important to understand how a certain facility is used, identify potential vulnerabilities, and decide what the best ways are to protect against these vulnerabilities. For example, if you have a building that houses some of your company's servers in an area that has high burglary rates, it might be a good idea to have security systems within the actual building as well as security guards within the actual building. The person that is in charge of making sure an organization's physical assets are protected is known as the facility safety officer. A person in this position should understand what physical components make up a facility and discover the best ways to protect it while staying in compliance with regulations.

Chapter 5: Physical and Environmental Security - Developing A Plan

When developing a physical security plan, there are five goals that an organization to look to achieve. First off, crime prevention should be addressed by having physical deterrents in place. Some examples of these are fences, guards, and waring signs. Second, delaying mechanisms should be implemented if the perpetrator gets past your primary line of defense. Some examples here would be having locks, inside security personnel, or other barriers. Next, you must include detectors inside the buildings if your organization such as detectors that can sense motion and others that detect physical disasters such as fires and floods. Fourth, if an incident does occur, certain personnel should be responsible for assessing the damage that has been done. Lastly, a proper response plan should be in place to assist in the mitigation process of the infiltration.

Chapter 5: Physical and Environmental Security - Overview

Physical security is just as important as all of the other types of security that has been previously discussed. There are various physical threats that companies face when it come to protecting the hardware on which companies' systems run. Proper countermeasures to physical threats should be in place in order to keep an organization's assets safe. Without physical security, there would be no need for all of the other types of information security. The threats to physical security are as follows:

Natural environmental threats: Any natural disaster including fires. (Tornadoes, floods, etc.)

Supply system threats: Anything that could disrupt the system such as lack of power and water and gas leaks.

Manmade threats: Employee errors, physical theft of hardware, vandalism.

Politically motivated threats: terrorist attacks, strikes, riots.

When it comes to physical security, protecting human life is the first priority above anything else. Referred to as life safety.

Chapter 4: Security Architecture and Design - Final Notes

I want to hit a few key concepts near the end of chapter 4 here. Fist of all, the difference between certification and accreditation. Certification is a technical evaluation that can lead to accreditation. Accreditation is a formal acceptance of system security. Next, the difference between an open system and a closed system. Open systems follow standards and published specs. Closed, on the other hand, do not follow specific, industry standards. In other words, it is proprietary, and there might be room for more advanced security. Systems will always have flaws, bugs, and "open doors". Hackers are always trying to identify these imperfections and exploit them. The book puts it a good way. No matter how many laws and improvements society makes, there are always going to be cops and robbers. In the same sense, there are always going to be hackers that will try to get into systems.