Information Systems Security Physical Security Domain #4

Physical Security Areas  Threat Types  Threat Sources  Vulnerabilities  Physical Organization  Current Measures  Physical Security Procedures  Environmental Controls  Physical Barriers

Threat Types  Environmental  Malicious  Accidental

Layered Defense  Site Location  Physical and Procedural Methods  Physical Controls –Guard Post –Visitor Security –Delivery Security –Fire Control

Fire Detection Systems  Ionization – Reacts to charged particles in smoke  Photoelectric – Reacts to changes in or blockage of light caused by smoke  Heat – Significant changes in ????

Physical Controls  Fencing  Lighting  Locks  Mantraps  Dogs  Guards

Location Consideration  Natural Disasters  Local Crime  Highway/airport access  Customer access  Joint tenants  Proximity to emergency services  Visibility????

Construction Issues  Building Codes  Levels of fire resistance  Data Center Location –No basements or top floors –Controlled access –Do not use partitions

Physical Controls  Locks –Conventional –Pick-resistant –Electronic key systems –Electronic combination lock

Facility Access  Photo ID viewed by a guard  Biometric devices  Card badge reader  Proximity devices –User activated –System sensing  AVOID PIGGYBACKING –Use mantraps

Fencing  3-4 Feet – deters casual trespassers  6-7 Feet – hard to climb easily  8 Feet with 3 strands of barbed wire BEST  Powered Fences  PIDAS Fences –Perimeter Intrusion Detection and Assessment System

Lighting  Required in critical areas  Ensure there are no dead zones  Two candle feet of power at eight feet high

Guards  Best deterrent, but most expensive  Provides discriminating judgment  Watches for piggybacking and suspicious activity  Enforce regulations

Types of Physical IDS  Electro-mechanical –Magnetic switches –Metallic foil in windows –Pressure mats  Volumetric –Vibration –Photoelectric –Ultrasonic and passive infrared

Mobile Devices  Locking cable to anchor  Tracing software  Encryption  Biometric controls

HVAC  Positive air pressure –Air goes out when doors are opened  Protect vent  Dedicated power lines  Emergency switch-off valves  Same rules for water supply

Electrical Power  Dependable primary power source  Alternative power source –Generator –UPS (online and standby)  Additional feeder from substation  Power not always clean and constant  Voltage fluctuations

Power Terms  Fault – momentary loss of power  Blackout – complete loss of power  Sag – momentary low voltage  Spike – momentary high voltage  Surge – prolonged high voltage  Noise – steady interfering disturbance  Transient – short noise disturbance

Electrical Consideration  High Humidity –Can cause corrosion  Low Humidity –Can cause static electricity  Also use antistatic flooring in server areas  Wear antistatic bands when working on internal computer systems

Recommendation  Computer room Fahrenheit  Humidity 40% - 60%  17,000 volts damages circuits

Fire Prevention  Four legs of fire –Heat (Reduce Temperature) –Fuel (Remove fuel) –Oxygen (Remove oxygen) –Chemical Reaction (Disrupt chemical combustion)

Fire Detection Systems  Configured to call fire station  Shuts down HVAC  On and above suspended ceilings  Below raised floors  In air ducts

Fire Types CLASSTYPEELEMENTMETHOD Class A Common Wood, paper, cloth Water & Soda Class B Liquid Gas, oil, alcohol CO2, FM-200 Class C Electrical Circuits & Wires Halon or CO2 Class D Metals Sodium, Potassium Dry Chemicals

Extinguishers  Halogenated –Used in place of water  FM-200 –Replacement for Halon  Carbon Dioxide –Does not damage sensitive devices  Dry Chemicals –Not effective against electrical fires

Water Pipes  Wet Pipe –Always contains water –Can freeze in cold weather –Most commonly used  Dry Pipe –Water not in pipe –Released after delay –Allows system shut down before water release

Water Pipes (contd)  Pre-action systems –Water released after a sprinkler head is melted  Deluge system –Sprinkler head is open –Releases a lot of water fast

Extinguishers  Placed within 50 feet of electrical equipment  Inspected four times a year  Clearly marked  Easily reached  Filled with appropriate reagents

Combustion Elements Suppression Methods How Method Works Fuel Soda acid Removes fuel OxygenCO2 Removes oxygen TemperatureWater Reduces temperature Chemical Halon or FM200 Stops chemical reaction

Physical Intrusion Detection  Electrical Circuits  Light Beams  Passive IR  Ultrasonic

Management Issues  Physical Security Audits  Drills  Internal Testing  Pen Testing  Maintenance Issues  Education and Training