Article courtesy of “Security”, the e-newsletter of Security Magazine.
Physical security is often defined as the protection of personnel, hardware, software, networks and data from physical actions and events that could cause serious loss or damage to an organisation. Physical security is a vitally important business practice with many goals: to prevent unauthorised persons from entering a business and causing harm; to protect intellectual property from corporate espionage; and to mitigate workplace violence, among other concerns.
Today, organisations must consider physical security as a primary pillar of its cybersecurity strategy. The success of an organisation’s physical security program can often be attributed to how well each component is implemented, improved and maintained.
Consider the following tips for enterprise security leaders to improve organisational physical security:
Establish physical security perimeters
Walls that act as barriers, card-controlled entry doors and staffed reception desks should be used to protect an organisation’s facilities. This is especially important for areas that contain sensitive information or the information systems used to process or manage that type of information. Access to data centres or other high-risk areas should require an additional layer of physical access requests and approvals prior to access being granted. Information systems should be located in rooms with doors and windows that are locked when left unattended. External protective measures should also be considered, particularly for offices or other locations at ground level.
Ensure physical entry controls are in place
Secure areas should be protected by appropriate entry controls to ensure that only authorised personnel are permitted access. Physical access to facilities where information systems reside should be monitored using physical intrusion alarms and surveillance equipment to detect potential physical security incidents. Physical access logs should be reviewed at least quarterly. Reviews should also be performed when potential events are identified. If a physical security incident is identified, incident response reports should include all response actions taken. Video cameras or other access control mechanisms should be implemented and secured in order to monitor individual physical access to sensitive areas.
Implement external and environmental threat protection
Physical protection against the damage from fires, floods, earthquakes, explosions, civil unrest and other forms of environmental or human-made disasters should be implemented to protect the organisation. Once defined, these controls can be used to protect information systems and personnel. Security leaders should install smoke- or heat-activated fire detectors and alarms, and appropriate fire suppression systems, such as sprinklers, should be implemented throughout facilities and within secure areas containing information systems. Water or moisture detection devices should be located in dropped ceilings and within raised floors to detect water leaks or possible flooding. Information systems should be protected from damage resulting from water leaks by ensuring that master shutoff valves are installed, accessible and working properly.
Provide for safe equipment placement and protection
Information systems and devices should be located in secure areas. Equipment needs to be protected to reduce risks from environmental threats and hazards and secured to reduce opportunities for unauthorized access. Adding new infrastructure devices, servers or other systems and tools can impact the performance capabilities of supporting utilities. Enterprise security professionals should perform an assessment prior to installation to ensure the supporting tools and utilities are capable of supporting the new infrastructure or other hardware devices. Physical access should be restricted to wireless access points, gateways, network hardware, communications hardware and telecommunication lines.
Manage supporting utilities
All supporting utilities, such as electricity, natural gas, water supplies, sewage and heating ventilation and air conditioning (HVAC), should be adequate for the systems and personnel they support. These utilities necessitate a suitable electrical supply that meets power requirements defined by equipment manufacturers. An uninterruptible power supply (UPS) should be implemented to support the orderly shutdown for equipment that supports critical business operations. Emergency lighting should be installed and regularly tested to ensure it is operating correctly in case of a power failure. Emergency power-off switches should be located near emergency exits in data centres and equipment rooms to facilitate a rapid power down in case of an emergency.
Provide security for power and telecommunications cabling
Power and telecommunications cabling that is in place to support information systems or transfer data should be protected from interception, interference or damage. Enterprise security teams should use clearly identifiable cable markings to minimise potential handling errors, such as the accidental unplugging or movement of incorrect patching or network cables. Physical access to information system distribution and transmission lines should be controlled within an organisation’s facilities. Spend the time that is necessary to ensure cables are labelled and neatly organised to prevent unintentional errors. A short-term project to address cabling today will help prevent countless issues tomorrow.
Secure information assets while off-premises
Computers, peripherals, paperwork, reports, software or other information assets belonging to an organisation should not be taken offsite without prior authorization. Security professionals should deploy full-disk encryption on all laptops. Information assets remain the property of an organisation even when they are off-premises. Personnel should be trained that these assets should not be used by family members or friends. This unauthorised use may introduce not only technical risks, but also potential risks to the confidentiality of data contained on devices due to improper viewing of information by unauthorised audiences. All personnel need to be responsible, and held accountable, for all actions performed on or with the information assets that are assigned to them.
Protect physical media in transit
Media containing information needs to be protected against unauthorised access, misuse and corruption during transportation beyond the organisation’s physical boundaries. Media should be encrypted prior to being moved offsite. A complete inventory of all physical media that is transferred outside of the organisation should be maintained. If an organisation uses an offsite archiving or long-term storage provider, the business should require the provider to submit an inventory of organisational media on a recurring basis. Additionally, the security controls in place at the provider’s facility should be tested at least annually.
Security leaders should ensure that a comprehensive physical security program is developed and implemented consistently across the organisation. Organisations that do not could potentially overlook a pivotal security function or leave a physical security vulnerability unaddressed. By developing a comprehensive physical security program supported by all organisational stakeholders, organisations can avoid key physical control pitfalls for effective overall security.
Need to assess your organisation’s security strategy? Improve your access control on-site?