Physical security is often defined as the protection of personnel, hardware, software, networks, and data from physical actions and events that could cause serious loss or damage to an organization. Physical security is a vitally important business practice with many goals: to prevent unauthorized persons from entering a business and causing harm; to protect intellectual property from corporate espionage; and to mitigate workplace violence, among other concerns. Today, organizations must consider physical security as a primary pillar of their cybersecurity strategy. The success of an organization’s physical security program can often be attributed to how well each component is implemented, improved, and maintained.
Consider the following tips for enterprise security leaders to improve organizational physical security:
Establish physical security perimeters
Walls that act as barriers, card-controlled entry doors, and staffed reception desks should be used to protect an organization’s facilities. This is especially important for areas that contain sensitive information or the information systems used to process or manage that type of information. Access to data centers or other high-risk areas should require an additional layer of physical access requests and approvals prior to access being granted. Information systems should be located in rooms with doors and windows that are locked when left unattended. External protective measures should also be considered, particularly for offices or other locations at ground level.
Ensure physical entry controls are in place
Secure areas should be protected by appropriate entry controls to ensure that only authorized personnel are permitted access. Physical access to facilities where information systems reside should be monitored using physical intrusion alarms and surveillance equipment to detect potential physical security incidents. Physical access logs should be reviewed at least quarterly. Reviews should also be performed when potential events are identified. If a physical security incident is identified, incident response reports should include all response actions taken. Video cameras or other access control mechanisms should be implemented and secured in order to monitor individual physical access to sensitive areas.
Implement external and environmental threat protection
Physical protection against damage from fires, floods, earthquakes, explosions, civil unrest, and other forms of environmental or human-made disasters should be implemented to protect the organization. Once defined, these controls can be used to protect information systems and personnel. Security leaders should install smoke- or heat-activated fire detectors and alarms, and appropriate fire suppression systems, such as sprinklers, should be implemented throughout facilities and within secure areas containing information systems. Water or moisture detection devices should be located in dropped ceilings and within raised floors to detect water leaks or possible flooding. Information systems should be protected from damage resulting from water leaks by ensuring that master shutoff valves are installed, accessible, and working properly.
Provide safe equipment placement and protection
Information systems and devices should be located in secure areas. Equipment needs to be protected to reduce risks from environmental threats and hazards and secured to reduce opportunities for unauthorized access. Adding new infrastructure devices, servers or other systems and tools can impact the performance capabilities of supporting utilities. Enterprise security professionals should perform an assessment prior to installation to ensure the supporting tools and utilities are capable of supporting the new infrastructure or other hardware devices. Physical access should be restricted to wireless access points, gateways, network hardware, communications hardware, and telecommunication lines.
Manage supporting utilities
All supporting utilities, such as electricity, natural gas, water supplies, sewage, heating ventilation, and air conditioning (HVAC), should be adequate for the systems and personnel they support. These utilities necessitate a suitable electrical supply that meets the power requirements defined by equipment manufacturers. An uninterruptible power supply (UPS) should be implemented to support the orderly shutdown of equipment that supports critical business operations. Emergency lighting should be installed and regularly tested to ensure it is operating correctly in case of a power failure. Emergency power-off switches should be located near emergency exits in data centers and equipment rooms to facilitate a rapid power down in case of an emergency.
Provide security for power and telecommunications cabling
Power and telecommunications cabling that is in place to support information systems or transfer data should be protected from interception, interference, or damage. Enterprise security teams should use clearly identifiable cable markings to minimize potential handling errors, such as the accidental unplugging or movement of incorrect patching or network cables. Physical access to information system distribution and transmission lines should be controlled within an organization’s facilities. Spend the time that is necessary to ensure cables are labeled and neatly organized to prevent unintentional errors. A short-term project to address cabling today will help prevent countless issues tomorrow.
Secure information assets while off-premises
Computers, peripherals, paperwork, reports, software, or other information assets belonging to an organization should not be taken offsite without prior authorization. Security professionals should deploy full-disk encryption on all laptops. Information assets remain the property of an organization even when they are off-premises. Personnel should be trained so that these assets should not be used by family members or friends. This unauthorized use may introduce not only technical risks but also potential risks to the confidentiality of data contained on devices due to improper viewing of information by unauthorized audiences. All personnel need to be responsible, and held accountable, for all actions performed on or with the information assets that are assigned to them.
Protect physical media in transit
Media containing information needs to be protected against unauthorized access, misuse, and corruption during transportation beyond the organization’s physical boundaries. Media should be encrypted prior to being moved offsite. A complete inventory of all physical media that is transferred outside of the organization should be maintained. If an organization uses an offsite archiving or long-term storage provider, the business should require the provider to submit an inventory of organizational media on a recurring basis. Additionally, the security controls in place at the provider’s facility should be tested at least annually.
Security leaders should ensure that a comprehensive physical security program is developed and implemented consistently across the organization. Organizations that do not could potentially overlook a pivotal security function or leave a physical security vulnerability unaddressed. By developing a comprehensive physical security program supported by all organizational stakeholders, organizations can avoid key physical control pitfalls for effective overall security.
