Copyright © Center for Systems Security and Information Assurance Lesson Seven Physical Security

Copyright © Center for Systems Security and Information Assurance Lesson Objectives Describe the need for physical security Identify unique threats to information security Relate key considerations to selecting a facility site Understand fire safety programs and describe the components of fire detection and response Understand the significant impact of supporting utilities and structure on physical security Recognize the three methods of data interception Be aware of the risks posed by mobile and portable systems.

Copyright © Center for Systems Security and Information Assurance Physical Security Addresses the design, implementation, and maintenance of steps taken to protect the physical resources of an organization. The people, hardware and transmission, storage, and processing of information.

Copyright © Center for Systems Security and Information Assurance Seven Sources of Physical Loss Extreme Temperature Gases Liquids Living Organisms Projectiles Movement Energy anomalies

Copyright © Center for Systems Security and Information Assurance Who is Responsible for Physical Security? General Management IT Management and Professionals Information Security Management and Professionals

Copyright © Center for Systems Security and Information Assurance Ten Commandments - Laptop Security 1.Never leave a laptop in an unlocked vehicle or in plain site. 2.Never leave laptops in areas with extreme temperatures 3.Never leave your laptop in a meeting or conference room during breaks 4.Lock the laptop in your office during off-hours 5.Record the manufacture, model and serial number in case of thief.

Copyright © Center for Systems Security and Information Assurance Ten Commandments - Laptop Security 6.Back up your information from your laptop regularly at home or in the office. 7.Never lend your laptop to strangers or acquaintances. 8.Apply distinctive paint markings or company non-removable stickers to make your laptop unique and easily identifiable. 9.Use encryption software to protect confidential or sensitive data on the laptop. 10.Purchase special locks and a theft alarm system specifically made for laptops.

Copyright © Center for Systems Security and Information Assurance Access Controls Walls, fencing, and gates Guards Dogs ID cards and badges Locks and keys Mantraps (physical and virtual) Electronic monitoring Alarms and alarm systems Computer rooms and wiring closets Interior walls and doors

Copyright © Center for Systems Security and Information Assurance Fire Safety Fires account for more property damage, personal injury, and death than any other physical security threat. Fire suppression systems work to deny an environment of one of three requirements for a fire to burn: temperature, fuel, and oxygen. Every building must have clearly marked fire exits and maps posted throughout the facility. Fire drills ensure that there is a plan to evacuate everyone safely from the building.

Copyright © Center for Systems Security and Information Assurance Fire Detection Properly identify the incident, raise the occupant alarm, and notify emergency response professionals. Fire detection and alarm systems depend on the specific characteristics of the protected space. Manual fire detection systems  Calling the fire department  Activating manual fire alarms

Copyright © Center for Systems Security and Information Assurance Automatic Fire Detection Systems Thermal detection  Fixed temperature  Rate-of-rise Smoke detection  Photoelectric sensors  Ionization sensor  Air-aspiring detectors Flame detector

Copyright © Center for Systems Security and Information Assurance Fire Detection

Copyright © Center for Systems Security and Information Assurance Fire Suppression Portable fire extinguishers are the first line of defense Consider the following:  What is burning?  Do you have the right type of extinguisher to fight the fire  Is the fire small enough for a portable fire extinguisher to be effective  Do you know how to use a portable extinguisher?  Is there a route of egress should your attempts to fight the fire be unsuccessful?

Copyright © Center for Systems Security and Information Assurance Fire Suppression Class A ordinary combustible fuels that require water and multipurpose, dry chemicals Class B combustible liquids or gases that require CO 2, multipurpose dry chemical, and halon fire extinguishers to remove oxygen from the fire Class C energized electrical equipment that require nonconducting CO 2, multipurpose, dry chemical, and halon fire extinguishers Class D fueled by combustible metals that require special extinguishing agents and techniques

Copyright © Center for Systems Security and Information Assurance Fire Suppression

Copyright © Center for Systems Security and Information Assurance Using Fire Extinguishers Know the types and locations of portable fire extinguishers in your work area and the instructions on the extinguisher. Learning to use an extinguisher is as simple as learning to P A S S:  Pull the pin on the extinguisher. A twisting and pulling motion works best  Aim the nozzle, horn or hose at the base of the fire  Squeeze or compress the handle to release the extinguishing agent, and  Sweep the nozzle, horn or hose from side to side at the base of the fire until it is extinguished.

Copyright © Center for Systems Security and Information Assurance Automatic Fire Extinguishers Sprinkler systems  Wet-pipe – pressurized water in all pipes triggered by the opening of a valve (inappropriate for computer rooms, wiring closets, or near electrical equipment)  Dry-pipe – pressurized air provides a buffer between the water. The air escapes, water fills the pipes, and comes through the sprinkler heads (designed to work in areas where electrical equipment is used)  Pre-action – nothing is initially in the delivery pipes until an alarm sound and the space can be evacuated. When a fire is detected, valves allow water to enter the system, but the water is not sprinkled until individual sprinkler heads are triggered by a person

Copyright © Center for Systems Security and Information Assurance Sprinkler Systems

Copyright © Center for Systems Security and Information Assurance Automatic Fire Extinguishers Gaseous systems  Carbon dioxide – robs a fire of oxygen (not used in residential or office environments)  Halon – a clean agent (no reside when dry) that produces a chemical reaction with the flame to extinguish it (preferred solution for computer rooms and wiring closets).

Copyright © Center for Systems Security and Information Assurance Heating, Ventilation, and Air Conditioning (HVAC)

Copyright © Center for Systems Security and Information Assurance Heating, Ventilation, and Air Conditioning (HVAC) HVAC concerns include the following: Temperature Filtration Humidity Static electricity Tamper detection devices Air intakes

Copyright © Center for Systems Security and Information Assurance Power and Water Systems

Copyright © Center for Systems Security and Information Assurance Power and Water Systems Electrical quality Electrical quantity Quality of the power Grounding Uninterruptible Power Supplies  Standby power supply  Offline UPS  Ferroresonant standby UPS  Line-interactive UPS  True online UPS Emergency Shutoff

Copyright © Center for Systems Security and Information Assurance Methods of Data Interception Direct observation Interception of data transmission Electromagnetic interception TEMPEST ensures that computers are placed as far as possible from outside perimeters, installing special shielding inside the CPU case, and implementing a number of other restrictions