Physical Security
Physical security breaches can result in more issues for an organization than a worm attack
Loss of data, temporary loss of availability by shutting systems down, or longer term loss of availability by bomb or arson are all things to consider when implementing physical security.
Depending on the organization physical security countermeasures will vary. A government agency such as the Department of Defense may have armed guards at the door of the building. Many organizations are not in the position of breaching national security so armed guards are not a necessity. In many cases a receptionist greets any new visitors and makes the appropriate arrangements for an on-site visit.
Physical security has three important components: access control, surveillance and testing. Obstacles should be placed in the way of potential attackers and physical sites should be hardened against accidents, attacks or environmental disasters. Such hardening measures include fencing, locks, access control cards, biometric access control systems and fire suppression systems.
Server room Protection
Access Cards
These are tied to a specific user and must be swiped in order to gain access. The downside is that they can be stolen and used without authorization and they are really expensive to implement.
Biometrics
Uses a physical characteristic such as a fingerprint or retina to identify a user. Due to the cost of implementing this solution, as well as employee privacy issues, biometrics has not been widely accepted yet.
User Awareness
User awareness is by far the most important aspect to security.
Laptop and Desktop Protection
User Awareness
Employees need to be made aware that strangers cannot be in the office without an escort. Awareness programs should encourage all employees to confront and ask an unidentified individual if they need any assistance.
Device Lock
These cables are physically connected to the laptop, which are then connected to a desk. A key is required to unlock the cable and, although these cables can be cut, implementing them on easily removable devices such as laptops may deter an attacker from actually making the effort.
OS Hardening
USB ports for drives and CD-R/DVD-R drives should be disabled on all laptops/desktops so that files cannot be easily copied and stolen by a malicious user wandering around in the office. There is still the problem of USB devices that are programmable keyboards.
Rings Approach to Physical Security Defense
Areas on the perimeter of the business building
Immediate area around the business building
