![Page 1: Information Systems Security Physical Security Domain #4](https://reader036.vdocument.in/reader036/viewer/2022062314/56649d805503460f94a6454d/html5/thumbnails/1.jpg)
Information Systems Security
Physical Security
Domain #4
![Page 2: Information Systems Security Physical Security Domain #4](https://reader036.vdocument.in/reader036/viewer/2022062314/56649d805503460f94a6454d/html5/thumbnails/2.jpg)
Physical Security Areas
Threat Types Threat Sources Vulnerabilities Physical Organization Current Measures Physical Security Procedures Environmental Controls Physical Barriers
![Page 3: Information Systems Security Physical Security Domain #4](https://reader036.vdocument.in/reader036/viewer/2022062314/56649d805503460f94a6454d/html5/thumbnails/3.jpg)
Threat Types
Environmental Malicious Accidental
![Page 4: Information Systems Security Physical Security Domain #4](https://reader036.vdocument.in/reader036/viewer/2022062314/56649d805503460f94a6454d/html5/thumbnails/4.jpg)
Layered Defense
Site Location Physical and Procedural Methods Physical Controls
– Guard Post– Visitor Security– Delivery Security– Fire Control
![Page 5: Information Systems Security Physical Security Domain #4](https://reader036.vdocument.in/reader036/viewer/2022062314/56649d805503460f94a6454d/html5/thumbnails/5.jpg)
Fire Detection Systems
Ionization – Reacts to charged particles in smoke
Photoelectric – Reacts to changes in or blockage of light caused by smoke
Heat – Significant changes in ????
![Page 6: Information Systems Security Physical Security Domain #4](https://reader036.vdocument.in/reader036/viewer/2022062314/56649d805503460f94a6454d/html5/thumbnails/6.jpg)
Physical Controls
Fencing Lighting Locks Mantraps Dogs Guards
![Page 7: Information Systems Security Physical Security Domain #4](https://reader036.vdocument.in/reader036/viewer/2022062314/56649d805503460f94a6454d/html5/thumbnails/7.jpg)
Location Consideration
Natural Disasters Local Crime Highway/airport access Customer access Joint tenants Proximity to emergency services Visibility????
![Page 8: Information Systems Security Physical Security Domain #4](https://reader036.vdocument.in/reader036/viewer/2022062314/56649d805503460f94a6454d/html5/thumbnails/8.jpg)
Construction Issues
Building Codes Levels of fire resistance Data Center Location
– No basements or top floors– Controlled access– Do not use partitions
![Page 9: Information Systems Security Physical Security Domain #4](https://reader036.vdocument.in/reader036/viewer/2022062314/56649d805503460f94a6454d/html5/thumbnails/9.jpg)
Physical Controls
Locks– Conventional– Pick-resistant– Electronic key systems– Electronic combination lock
![Page 10: Information Systems Security Physical Security Domain #4](https://reader036.vdocument.in/reader036/viewer/2022062314/56649d805503460f94a6454d/html5/thumbnails/10.jpg)
Facility Access
Photo ID viewed by a guard Biometric devices Card badge reader Proximity devices
– User activated– System sensing
AVOID PIGGYBACKING– Use mantraps
![Page 11: Information Systems Security Physical Security Domain #4](https://reader036.vdocument.in/reader036/viewer/2022062314/56649d805503460f94a6454d/html5/thumbnails/11.jpg)
Fencing
3-4 Feet – deters casual trespassers 6-7 Feet – hard to climb easily 8 Feet with 3 strands of barbed wire BEST Powered Fences PIDAS Fences
– Perimeter Intrusion Detection and Assessment System
![Page 12: Information Systems Security Physical Security Domain #4](https://reader036.vdocument.in/reader036/viewer/2022062314/56649d805503460f94a6454d/html5/thumbnails/12.jpg)
Lighting
Required in critical areas Ensure there are no dead zones Two candle feet of power at eight feet high
![Page 13: Information Systems Security Physical Security Domain #4](https://reader036.vdocument.in/reader036/viewer/2022062314/56649d805503460f94a6454d/html5/thumbnails/13.jpg)
Guards
Best deterrent, but most expensive Provides discriminating judgment Watches for piggybacking and suspicious
activity Enforce regulations
![Page 14: Information Systems Security Physical Security Domain #4](https://reader036.vdocument.in/reader036/viewer/2022062314/56649d805503460f94a6454d/html5/thumbnails/14.jpg)
Types of Physical IDS
Electro-mechanical– Magnetic switches– Metallic foil in windows– Pressure mats
Volumetric– Vibration– Photoelectric– Ultrasonic and passive infrared
![Page 15: Information Systems Security Physical Security Domain #4](https://reader036.vdocument.in/reader036/viewer/2022062314/56649d805503460f94a6454d/html5/thumbnails/15.jpg)
Mobile Devices
Locking cable to anchor Tracing software Encryption Biometric controls
![Page 16: Information Systems Security Physical Security Domain #4](https://reader036.vdocument.in/reader036/viewer/2022062314/56649d805503460f94a6454d/html5/thumbnails/16.jpg)
HVAC
Positive air pressure– Air goes out when doors are opened
Protect vent Dedicated power lines Emergency switch-off valves Same rules for water supply
![Page 17: Information Systems Security Physical Security Domain #4](https://reader036.vdocument.in/reader036/viewer/2022062314/56649d805503460f94a6454d/html5/thumbnails/17.jpg)
Electrical Power
Dependable primary power source Alternative power source
– Generator– UPS (online and standby)
Additional feeder from substation Power not always clean and constant Voltage fluctuations
![Page 18: Information Systems Security Physical Security Domain #4](https://reader036.vdocument.in/reader036/viewer/2022062314/56649d805503460f94a6454d/html5/thumbnails/18.jpg)
Power Terms
Fault – momentary loss of power Blackout – complete loss of power Sag – momentary low voltage Spike – momentary high voltage Surge – prolonged high voltage Noise – steady interfering disturbance Transient – short noise disturbance
![Page 19: Information Systems Security Physical Security Domain #4](https://reader036.vdocument.in/reader036/viewer/2022062314/56649d805503460f94a6454d/html5/thumbnails/19.jpg)
Electrical Consideration
High Humidity– Can cause corrosion
Low Humidity– Can cause static electricity
Also use antistatic flooring in server areas Wear antistatic bands when working on
internal computer systems
![Page 20: Information Systems Security Physical Security Domain #4](https://reader036.vdocument.in/reader036/viewer/2022062314/56649d805503460f94a6454d/html5/thumbnails/20.jpg)
Recommendation
Computer room 60-75 Fahrenheit Humidity 40% - 60% 17,000 volts damages circuits
![Page 21: Information Systems Security Physical Security Domain #4](https://reader036.vdocument.in/reader036/viewer/2022062314/56649d805503460f94a6454d/html5/thumbnails/21.jpg)
Fire Prevention
Four legs of fire – Heat (Reduce Temperature)– Fuel (Remove fuel)– Oxygen (Remove oxygen)– Chemical Reaction (Disrupt chemical
combustion)
![Page 22: Information Systems Security Physical Security Domain #4](https://reader036.vdocument.in/reader036/viewer/2022062314/56649d805503460f94a6454d/html5/thumbnails/22.jpg)
Fire Detection Systems
Configured to call fire station Shuts down HVAC On and above suspended ceilings Below raised floors In air ducts
![Page 23: Information Systems Security Physical Security Domain #4](https://reader036.vdocument.in/reader036/viewer/2022062314/56649d805503460f94a6454d/html5/thumbnails/23.jpg)
Fire Types
CLASS TYPE ELEMENT METHOD
Class A Common Wood, paper, cloth
Water & Soda
Class BLiquid Gas, oil,
alcoholCO2, FM-200
Class C Electrical Circuits & Wires
Halon or CO2
Class D Metals Sodium, Potassium
Dry Chemicals
![Page 24: Information Systems Security Physical Security Domain #4](https://reader036.vdocument.in/reader036/viewer/2022062314/56649d805503460f94a6454d/html5/thumbnails/24.jpg)
Extinguishers
Halogenated– Used in place of water
FM-200– Replacement for Halon
Carbon Dioxide– Does not damage sensitive devices
Dry Chemicals– Not effective against electrical fires
![Page 25: Information Systems Security Physical Security Domain #4](https://reader036.vdocument.in/reader036/viewer/2022062314/56649d805503460f94a6454d/html5/thumbnails/25.jpg)
Water Pipes
Wet Pipe– Always contains water– Can freeze in cold weather– Most commonly used
Dry Pipe– Water not in pipe– Released after delay– Allows system shut down before water release
![Page 26: Information Systems Security Physical Security Domain #4](https://reader036.vdocument.in/reader036/viewer/2022062314/56649d805503460f94a6454d/html5/thumbnails/26.jpg)
Water Pipes (contd)
Pre-action systems– Water released after a sprinkler head is melted
Deluge system– Sprinkler head is open– Releases a lot of water fast
![Page 27: Information Systems Security Physical Security Domain #4](https://reader036.vdocument.in/reader036/viewer/2022062314/56649d805503460f94a6454d/html5/thumbnails/27.jpg)
Extinguishers
Placed within 50 feet of electrical equipment Inspected four times a year Clearly marked Easily reached Filled with appropriate reagents
![Page 28: Information Systems Security Physical Security Domain #4](https://reader036.vdocument.in/reader036/viewer/2022062314/56649d805503460f94a6454d/html5/thumbnails/28.jpg)
Combustion Elements
Suppression Methods
How Method Works
Fuel Soda acid Removes fuel
Oxygen CO2 Removes oxygen
Temperature Water Reduces temperature
Chemical Halon or FM200 Stops chemical reaction
![Page 29: Information Systems Security Physical Security Domain #4](https://reader036.vdocument.in/reader036/viewer/2022062314/56649d805503460f94a6454d/html5/thumbnails/29.jpg)
Physical Intrusion Detection
Electrical Circuits Light Beams Passive IR Ultrasonic
![Page 30: Information Systems Security Physical Security Domain #4](https://reader036.vdocument.in/reader036/viewer/2022062314/56649d805503460f94a6454d/html5/thumbnails/30.jpg)
Management Issues
Physical Security Audits Drills Internal Testing Pen Testing Maintenance Issues Education and Training