PHYSICAL SECURITY

CH 14 InfoSec Handbook

Intro

• Very often easy to forget / overlook physical environments which house our tech & data.

​

• Yet is so essential as it can impact significantly all of CIA

​

​

Common Security CIA Threats

Physical Security

Much different set of Threats, Vulnerabilities and Controls than Information Security

​

Natural Environmental Threats:

• Floods, earthquakes, storms, tornadoes, fires, Artic Vortexes, “Storms of the Century” which happen every few years�

Supply System Threats:

• Power / Communications / Water / Gas / Travel outages�

Manmade Threats:

• Unauthorized access, disgruntled employees, accidents, vandalism, fraud, theft�

Politically Motivated Threats:

• Strikes, riots, civil disobedience, terrorist attacks, bombings

Example of Physical Security Program

Should address 🡪

​

Crime & disruption prevention through deterrence

• Fences, security guards, signs�

Reduction of damage through delaying mechanisms

• Layers of defenses like barriers, locks, personnel�

Crime / Disruption Detection

• Alarms & Detectors, CCTV�

Incident assessment

• Response time, damage level�

Response procedures

• Fire suppression, emergency processes, law enforcement, SME consultants

​

Measuring the Metrics

• Number of successful & unsuccessful crimes
• Number of successful & unsuccessful disruptions
• Time between detection, assessment & recovery
• Number of false positives & false negative alerts
• Time to defeat a control
• Business impact & Financial Loss $$

​

​

Physical Security

Crime Prevention Through Environmental Design (CPTED)

• Creates environment to manipulate behavioral effects to reduce crime�

Examples 🡪

• Low hedges that shouldn’t block window visibility
• Windows that look onto parking lots
• Outdoor furniture encouraging folks to look around
• Encourages clear lines of sight

​

• Different from Target hardening:
• Meant to deny access through barriers

​

Physical Security

Crime Prevention Through Environmental Design (CPTED)

​

3 main strategies:

• Natural Access Control
• Security Zones
• Natural Surveillance
• Natural Territorial Reinforcement

​

Facility Construction

• Walls
• Doors
• Ceilings
• Windows
• Floors
• HVAC
• Electric Power
• Water – Gas
• Fire Detection & Suppression

​

Walls

Combustibility of material

• Light frame vs. Heavy construction
• Incombustible (steel) vs. fire-resistant (rebar in concrete)
• Block and/or absorb sound & electric emissions

Doors

• Hollow vs. Solid-core

​

• Hinges & strike plates
• Location matters!

​

• Mantrap

​

• Fail-safe vs. fail-secure

​

Windows

Materials

• Standard vs. Tempered
• Acrylic
• Glass-Clad Polycarbonate = strongest
• Embedded wires
• Laminated

​

Data Center

• Place as central in building as possible … why?�
• Fewest doors as possible … why?�
• Not on top or bottom of building … why?�
• Away from H2O pipes!�
• HVAC vents locked, with positive air pressure�
• Emergency Button / “Kill Switch”�
• Proper Temperature & Humidity�
• Redundant power supplies & Universal Power Supplies (UPS)

Electric Power - UPS

Types of UPS’s – �

• Online: constantly charges and uses batteries 24x7
• Quicker than Standby�
• Standby: charges batteries, but they are not used until power outage

​

Electric Power: Quick Terms

Ground�

Noise�

Clean Power: use voltage regulators & line conditioners��EMI 🡪 motors, cable placement, elevators, fluorescent lights

​

Power Fluctuations

• Power Excess
• Spike vs. Surge

​

• Power Loss
• Fault vs. Blackout

​

• Degradation
• Sag/dip
• Brownout

​

​

Let’s Get Fired Up?

Prevent

• Non-combustible materials, training, design

​

Detect

• Smoke Activated Alarm (Photoelectric)
• Heat Activated Alarm
• Pre-Defined Temperature Sensors: more sensitive == more false positives

​

​

Let’s Get Fired Up? (cont.)

Suppress

• Fires need fuel, oxygen & high temperatures�
• Types of Fires & their suppression methods:
• A: Common
• B: Liquid (fuels)
• C: Electrical
• D: Metals & Minerals
• K: Commercial Kitchen

​

• Halon Gas == bad ; FM-200 Gas == good

​

​

Water Sprinklers

4 types�

• Wet pipe = pipes always contain H₂0�
• Dry pipe = pipes air-pressurized & does not contain H₂0 until air-pressure reduced�
• Pre-action = Similar to Dry
• H₂0 not released immediately; uses a thermal-fusible link which melts with heat�
• Deluge = wide open heads to release large volumes of H₂0

​

Put A Lock On It

• Locks are delaying devices�
• Mechanical
• Warded: Basic padlock which uses wards to open spring; easiest to pick
• Tumbler: More parts than Warded
• Pin: uses cylinders, pins & springs ; most common
• Wafer: uses flat wafers instead of pins ; i.e. file cabinets�
• Combination Lock�
• Programmable Lock
• Delay
• Override
• Master Keying
• Hostage alarm

​

Put A Lock On It (cont.)

Administrative Responsibilities

• Manage & log key ownership
• Especially Master & sub-master keys!

​

Circumventing Locks:

• Tension Wrench: provides tension to cylinder, & a lock pick to ‘pick’ pins�
• Raking: Lock pick pushed in back of lock & quickly slid out w/ upward pressure
• Lock Bumping: Uses a bump key to force pins into open position

Personnel Access Controls

Common types:

• ID Badge
• Smart Cards
• Wireless proximity readers via RFID chips in card.
• Biometric
• Password & PINs

​

• Prevent piggybacking / tailgating!

​

Personnel Access Controls (cont.)

More about biometrics:

• Voice recognition
• Signature patterns
• Body Scans:
• Fingerprint
• Facial
• Hand
• Iris
• Retina
• Vascular Pattern

Personnel Access Controls (cont.)

A Good biometric system:

• Unique
• Repeatable
• Accessible
• Universal
• Acceptable

​

Recall those True Positive & True Negative, False Positive & False Negative terms?

• Same issues applies to biometric systems as well

Good Fences make Good Neighbors

Height Matters

• 3-4 foot: deters casual trespasser
• 6-7 foot: too high to climb easily
• 8+ foot: deters most folks

�Fence tops tilted in vs. out

�4 types of gates:

• Class I: Residential
• Class II: Commercial usage; general public access is expected
• Class III: Industrial; limited access is expected
• Class IV: Restricted access

​

Let’s Shed Some Light

• Brighter == better�
• Use Overlapping Light Zones�
• Direct towards areas from security guards towards target areas –> glare protection

​

Surveillance - Recording

Close-circuit television 🡪 CCTV

�Cameras use Charged-Coupled Devices (CCD) which converts light into electric signal used for screens & recording devices

�Depth of Field: portion of area in focus on monitor

• Size of lens + size of lens opening + object distance

�CCTV Irises: controls amount of light

• Manual vs. Auto

�CCTV Cameras

• Fixed Mount vs. (Pan-Tilt-Zoom) PTZ

​

Intrusion Detection System (IDS)

Detects changes in light, sound, vibrations, motion, temperature, RF

​

Electro-mechanical Systems: Change or break in a circuit

• Windows, pressure mats

​

Volumetric Systems: More sensitive become of environmental changes

• Photometric: changes in light beams; used only in windowless rooms
• Passive IR: heat waves
• Acoustical: sound; very sensitive
• Vibration
• Wave-Pattern: microwave, ultrasonic, low frequency
• Proximity: magnetic fields (i.e. around paintings)

​

When you need that extra security …

Hmmm … So, Question:

• How do you get into secure locations, or obtain sensitive info?

​

​

​

SOCIAL ENGINEERING

CH 15 InfoSec Handbook

Intro to Social Engineering (SE)

• Obtaining information
• Just not from computers, but you! #FacebookTooSoon?

​

​

• Why so effective?
• Humans are low-hanging fruit
• Cost effective
• Ease of use

​

• Org’s largest asset is also largest threat target
• Employees

SE Based upon Common Premises

• People are helpful by nature, and especially in times of distress or difficulty

​

• People by instinct trust others

​

• People tend to obey orders from superiors / persons of authority

​

• People afraid of consequences of not following rules/orders

​

Let’s synthesizing those items further:

• Helping Nature

​

• Trusting Nature

​

• Obeying authority

​

• Fear