Physical Security-Computer And System Security-Lecture Slides, Slides of Cryptography and System Security

Download Physical Security-Computer And System Security-Lecture Slides and more Slides Cryptography and System Security in PDF only on Docsity! Physical Security Chapter 9 If someone really wants to get at the information, it is not difficult if they can gain physical access to the computer or hard drive. --Microsoft White Paper, July 1999 docsity.com Principles of Information Security - Chapter 9 Slide 2 Learning Objectives: Upon completion of this chapter you should be able to: – Understand the conceptual need for physical security. – Identify threats to information security that are unique to physical security. – Describe the key physical security considerations for selecting a facility site. – Identify physical security monitoring components. – Grasp the essential elements of access control within the scope of facilities management. – Understand the criticality of fire safety programs to all physical security programs. docsity.com Principles of Information Security - Chapter 9 Slide 5 Community Roles General management: – responsible for the security of the facility  IT management and professionals: – responsible for environmental and access security  Information security management and professionals: – perform risk assessments and implementation reviews docsity.com Principles of Information Security - Chapter 9 Slide 6 Access Controls There are a number of physical access controls that are uniquely suited to the physical entry and exit of people to and from the organization’s facilities, including – biometrics – smart cards – wireless enabled keycards docsity.com Principles of Information Security - Chapter 9 Slide 7 Facilities Management A secure facility is a physical location that has been engineered with controls designed to minimize the risk of attacks from physical threats A secure facility can use the natural terrain; traffic flow, urban development, and can complement these features with protection mechanisms such as fences, gates, walls, guards, and alarms docsity.com Principles of Information Security - Chapter 9 Slide 10 Locks and Keys  There are two types of locks – mechanical and electro-mechanical  Locks can also be divided into four categories – manual, programmable, electronic, and biometric  Locks fail and facilities need alternative procedures for access  Locks fail in one of two ways: – when the lock of a door fails and the door becomes unlocked, that is a fail-safe lock – when the lock of a door fails and the door remains locked, this is a fail-secure lock docsity.com Principles of Information Security - Chapter 9 Slide 11 Figure 9-1 docsity.com Principles of Information Security - Chapter 9 Slide 12 Mantraps An enclosure that has an entry point and a different exit point The individual enters the mantrap, requests access, and if verified, is allowed to exit the mantrap into the facility  If the individual is denied entry, they are not allowed to exit until a security official overrides the automatic locks of the enclosure docsity.com Principles of Information Security - Chapter 9 Slide 15 Alarms and Alarm Systems Alarm systems notify when an event occurs Used for fire, intrusion, environmental disturbance, or an interruption in services These systems rely on sensors that detect the event: motion detectors, smoke detectors, thermal detectors, glass breakage detectors, weight sensors, and contact sensors docsity.com Principles of Information Security - Chapter 9 Slide 16 Computer Rooms and Wiring Closets Computer rooms and wiring and communications closets require special attention Logical controls are easily defeated, if an attacker gains physical access to the computing equipment Custodial staff are often the least scrutinized of those who have access to offices and are given the greatest degree of unsupervised access docsity.com Principles of Information Security - Chapter 9 Slide 17 Interior Walls and Doors  The walls in a facility are typically either: – standard interior – firewall  All high-security areas must have firewall grade walls to provide physical security from potential intruders and improves the facility's resistance to fires  Doors that allow access into secured rooms should also be evaluated  Computer rooms and wiring closets can have push or crash bars installed to meet building codes and provide much higher levels of security than the standard door pull handle docsity.com Principles of Information Security - Chapter 9 Slide 20 Fire Detection  Before a fire can be suppressed, it must be detected  Fire detection systems fall into two general categories: – manual and automatic  Part of a complete fire safety program includes individuals that monitor the chaos of a fire evacuation to prevent an attacker accessing offices  There are three basic types of fire detection systems: thermal detection, smoke detection, and flame detection – Smoke detectors operate in one of three ways: photoelectric, ionization, and air-aspirating docsity.com Principles of Information Security - Chapter 9 Slide 21 Fire Suppression  Can be portable, manual, or automatic  Portable extinguishers are rated by the type of fire: – Class A: fires of ordinary combustible fuels – Class B: fires fueled by combustible liquids or gases – Class C: fires with energized electrical equipment – Class D: fires fueled by combustible metals  Installed systems apply suppressive agents, either sprinkler or gaseous systems – Sprinkler systems are designed to apply liquid, usually water – In sprinkler systems, the organization can implement wet-pipe, dry-pipe, or pre-action systems – Water mist sprinklers are the newest form of sprinkler systems and rely on microfine mists docsity.com Principles of Information Security - Chapter 9 Slide 22 Figure 9-3 Water Sprinkler System docsity.com Principles of Information Security - Chapter 9 Slide 25 Failure of Supporting Utilities and Structural Collapse  Supporting utilities, such as heating, ventilation and air conditioning, power, water, and other utilities, have a significant impact on the continued safe operation of a facility  Extreme temperatures and humidity levels, electrical fluctuations and the interruption of water, sewage, and garbage services can create conditions that inject vulnerabilities in systems designed to protect information docsity.com Principles of Information Security - Chapter 9 Slide 26 Heating, Ventilation, and Air Conditioning HVAC system areas that can cause damage to information systems: – Temperature • Computer systems are subject to damage from extreme temperature • The optimal temperature for a computing environment (and people) is between 70 and 74 degrees Fahrenheit – Filtration – Humidity – Static • One of the leading causes of damage to sensitive circuitry is electrostatic discharge (ESD) • A person can generate up to 12,000 volts of static current by walking across a carpet docsity.com Principles of Information Security - Chapter 9 Slide 27 Ventilation Shafts Security of the ventilation system air ductwork: – While in residential buildings the ductwork is quite small, in large commercial buildings it can be large enough for an individual to climb through – If the vents are large, security can install wire mesh grids at various points to compartmentalize the runs docsity.com Principles of Information Security - Chapter 9 Slide 30 Uninterruptible Power Supplies (UPSs)  A standby or offline UPS is an offline battery backup that detects the interruption of power to the power equipment  A ferroresonant standby UPS is still an offline UPS – the ferroresonant transformer reduces power problems  The line-interactive UPS is always connected to the output, so has a much faster response time and incorporates power conditioning and line filtering  The true online UPS works in the opposite fashion to a standby UPS since the primary power source is the battery, with the power feed from the utility constantly recharging the batteries – this model allows constant feed to the system, while completely eliminating power quality problems docsity.com Principles of Information Security - Chapter 9 Slide 31 Emergency Shutoff One important aspect of power management in any environment is the need to be able to stop power immediately should the current represent a risk to human or machine safety Most computer rooms and wiring closets are equipped with an emergency power shutoff, which is usually a large red button, prominently placed to facilitate access, with an accident-proof cover to prevent unintentional use docsity.com Principles of Information Security - Chapter 9 Slide 32 Electrical Terms Fault: momentary interruption in power Blackout: prolonged interruption in power Sag: momentary drop in power voltage levels Brownout: prolonged drop in power voltage levels Spike: momentary increase in power voltage levels Surge: prolonged increase in power voltage levels docsity.com Principles of Information Security - Chapter 9 Slide 35 Testing Facility Systems Physical security of the facility must be constantly documented, evaluated, and tested Documentation of the facility’s configuration, operation, and function is integrated into disaster recovery plans and standing operating procedures Testing provides information necessary to improve the physical security in the facility and identifies weak points docsity.com Principles of Information Security - Chapter 9 Slide 36 Interception of Data There are three methods of data interception: – Direct observation – Data transmission – Eavesdropping on signals • TEMPEST is a technology that involves the control of devices that emit electromagnetic radiation (EMR) in such a manner that the data cannot be reconstructed docsity.com Principles of Information Security - Chapter 9 Slide 37 Mobile and Portable Systems  With the increased threat to overall information security for laptops, handhelds, and PDAs, mobile computing requires even more security than the average in-house system  Many of these mobile computing systems not only have corporate information stored within them, many are configured to facilitate the user’s access into the organization’s secure computing facilities docsity.com Principles of Information Security - Chapter 9 Slide 40 Remote Computing Security  Remote site computing - distant from the organizational facility  Telecommuting - computing using telecommunications including Internet, dial-up, or leased point-to-point links  Employees may need to access networks on business trips  Telecommuters need access from home systems or satellite offices  To provide a secure extension of the organization’s internal networks, all external connections and systems must be secured docsity.com Principles of Information Security - Chapter 9 Slide 41 Special Considerations for Physical Security Threats  Develop physical security in-house or outsource? – Many qualified and professional agencies – Benefit of outsourcing physical security includes gaining the experience and knowledge of these agencies – Downside includes high expense, loss of control over the individual components, and the level of trust that must be placed in another company  Social engineering is the use of people skills to obtain information from employees docsity.com Principles of Information Security - Chapter 9 Slide 42 Inventory Management  Computing equipment should be inventoried and inspected on a regular basis  Classified information should also be inventoried and managed – Whenever a classified document is reproduced, a stamp should be placed on the original before it is copied – This stamp states the document’s classification level and document number for tracking – Each classified copy is issued to its receiver, who signs for the document docsity.com