10 - Physical Security Requirements

Question 1

What are some elements that go into designing and planning a site for IT infrastructure?

Answer 1

• Secure Facility Plan: emphasizes mechanisms needed to secure the location
• Site Selection: Determining the safety of a location
• Visibility
• Natural Disasters
• Facility Design: Designing a safe facility that is up to code and secure from intrusion.

Question 2

What is Critical Path Analysis?

Answer 2

The effort to identify relationships between mission-critical applications, processes, and operations and all the necessary supporting elements.

Question 3

What is Technology Convergence?

Answer 3

The tendency for various technologies to evolve and merge over time.

Question 4

What are the different groups for physical security controls?

Answer 4

• Administrative: Facility construction and selection, site management, training, emergency response and procedures.
• Technical: Access controls, Intrusion detection, CCTV, monitoring, HVAC, Fire detection
• Physical: Fencing, lighting, locks, construction materials, mantraps, dogs and guards.

Question 5

What order should security controls should be used?

Answer 5

1. Deterrence
2. Denial
3. Detection
4. Delay

Question 6

What is an SLA?

Answer 6

A Service Level Agreement defines the response time a vendor will provide in the event of an equipment failure emergency.

Question 7

What is MTTF/MTTR?

Answer 7

• MTTF (Mean Time To Failure): Expected lifetime of the device based on the environment
• MTTR (Mean Time To Repair): Average length of time required to perform a repair.

Question 8

What is a Wiring Closet?

Answer 8

Where networking cables for a location are connected to other essential equipment such patch panels, switches, routers, etc. Can also include equipment for other components such as telephony systems, alarm systems, security systems, etc.

Question 9

What are Server Rooms?

Answer 9

Enclosed, restricted, and protected rooms where your mission-critical servers and network devices are housed. The more human incompatible it is, the better.

a.k.a.: Data Centers, Communications rooms, wiring closets, server vaults, and IT closets.

Question 10

What are Smartcards?

Answer 10

Credit-card sized IDs, badges, or security passes with an embedded magnetic strip, bar code, or integrated circuit chip which contain info about the holder so it can be used to authenticate.

Question 11

What is a Proximity Reader?

Answer 11

A device that can be worn or held by a holder, when it passes a reader which checks the electromagnetic field for alterations and authenticates.

Question 12

What are Intrusion Detection Systems?

Answer 12

Systems designed to detect an attempted intrusion, breach, or attack. Can be physical or digital.

Question 13

What are Access Abuses?

Answer 13

Methods people use to gain access to an unauthorized area:

• Masquerading: Using someone else’s security ID to gain entry
• Piggybacking: The Following someone through a secured access point.

Question 14

What is Emanation Security?

Answer 14

Protection against the interception of electrical signals that can contain confidential data. Such measures are:

• Faraday Cage: A box, room, or buidling designed with an external metal skin, often a wire mesh, that acts as EMI-absorbing material which prevents signals from entering or leaving.
• White Noise: Broadcasting false traffic to mask and hide real emanations.
• Control Zone: Areas where emanation is supported and allowed.

Question 15

What are Media Storage Facilities?

Answer 15

A secure place where media, new and used, can be stored and tracked without fear of theft and corruption. Best practices:

• Store in locked unit
• Have someone managing the media
• Use check-in/check-out process
• Sanitize returned media:
  
  • Zeroization: Erases data by replacing it with meaningless data like zeros.
• Verify data by checking hashes.

Question 16

What is Data Remnants?

Answer 16

The remaining data elements that are left on a storage device after deletion/formatting.

Question 17

What is Evidence Storage?

Answer 17

The storing of important data, logs, files, etc, that could be used later in an investigation.

Best Practices:

• Store on a separate dedicated system
• Keep system offline
• Track activity on this system
• Calculate hashes on files for change tracking
• Encrypt all data.

Question 18

What are some power issues and what tools are used to avoid them?

Answer 18

Known issues:

• Fault: A momentary loss of power
• Blackout: A complete loss of power
• Sag: Momentary low voltage
• Brownout: Prolonged low voltage
• Spike: Momentary high voltage
• Surge: Prolonged high voltage
• Inrush: Initial surge of power
• Noise: Steady interfering power distrubance
• Transient: short duration of line noise disturbance
• Clean: Nonfluctuating pure power
• Ground: wire in circuit that is grounded.

Some tools used to avoid damage from power surges and power interruptions are:

• UPS (Uninterruptible Power Supply)
• Battery Backup
• Surge Protectors: Has fuse that will blow before power levels change
  *

Question 19

What are the 2 different types of electronic noise that can cause issues on the quality of communications and transmissions?

Answer 19

• EMI (Electromagnetic Interference):
  
  • Common Mode Noise: Generated by a difference in power between the hot and ground wires of a power source.
  • Traverse Mode Noise: Generated by a difference in power between the hot and neutral wires of a power source.
• RFI (Radio-Frequency Interference)

Question 20

What are some other site/facility controls that should be taken into consideration for IT architecture?

Answer 20

• Temperature, Humidity, and Static:
  
  • Equipment should be kept at room temp and humidity at 40-60%
• Water Issues (Leakage and Flooding):
• Fire Prevention, Detection, and Suppression:
  
  • Fire Triangle (Fuel, Heat, and Oxygen [Chemical Reaction])
  • Stages of Fire:
    
    • 1: Incipient Stage: Only air, no smoke
    • 2: Smoke Stage
    • 3: Flame Stage
    • 4: Heat Stage: Intense heat buildup
  • Fire Extinguishers:
    
    • A: Common Combustibles
    • B: Liquids
    • C: Electrical
    • D: Metal
  • Fire Detection Systems:
    
    • Fixed Temperature Detection: Suppression is triggered when a specific temp is reached
    • Rate-of-Rise Detection: Measures the speed of temperature change
    • Flame-Actuated Systems:
    • Smoke-Actuated Systems
  • Water Suppression Systems:
  • Gas Discharge Systems:

Question 21

What are some different types of Fire Prevention, Detection, and Suppression?

Answer 21

Fire Prevention, Detection, and Suppression:

• Fire Triangle (Fuel, Heat, and Oxygen [Chemical Reaction])
• Stages of Fire:
  
  • 1: Incipient Stage: Only air, no smoke
  • 2: Smoke Stage
  • 3: Flame Stage
  • 4: Heat Stage: Intense heat buildup
• Fire Extinguishers:
  
  • A: Common Combustibles
  • B: Liquids
  • C: Electrical
  • D: Metal
• Fire Detection Systems:
  
  • Fixed Temperature Detection: Suppression is triggered when a specific temp is reached
  • Rate-of-Rise Detection: Measures the speed of temperature change
  • Flame-Actuated Systems:
  • Smoke-Actuated Systems
• Water Suppression Systems
• Gas Discharge Systems

Question 22

What are the 4 main types of Water Suppression Systems?

Answer 22

• Wet Pipe System (Closed Head System): Always full of water to be discharged immediately when needed
• Dry Pipe System: Contains compressed air, when triggered, air escapes opening a water valve that causes pipes to fill and discharge
• Deluge System: A form of dry pipe system but with larger pipes for more water discharge
• Preaction System: A combo of dry pipe/wet pipe. Pipes are dry until the initial stages of fire and then are filled with water which is only released when the sprinkler heads are melted. Pipes can be manually emptied as well. Allows manual intervention.

Question 23

How do gas discharge systems work?

Answer 23

They usually remove the oxygen from the air supressing the fire. These systems should not be used in areas containing humans.

Halon used to be used for this but is environmentally dangerous. Replaced by more environmentally friendly gases such as:

• FM-200
• CEA-410
• Argon
• Aero-K

Question 24

What are some Perimeter Security Controls?

Answer 24

• Fence: A perimeter-defining device that separates areas that are under secure control and those that aren’t.
• Gate: A controlled exit and entry point in a fence. Should have an equal deterrent level as the fence to maintain security. Keep number of gates to a minimum.
  
  • Turnstile: A form of a gate that prevents more than one person at a time from entering and usually only allows one direction of movement.
• Mantrap: A double set of doors that is often protected by a guard that can prevent piggybacking and can trap individuals at the discretion of the security personnel.
• Lighting: Discourages intruders by illuminating the compound. Should not be the sole deterrent and should not illuminate intrusions detection systems.
• Security Guards and Dogs: Used to intervene and stop actual intrusions and attacks.

Question 25

What are some Internal Physical Security Controls?

Answer 25

• Locks: Crude form of an identification and authorization mechanism.
  
  • Preset Locks: Key based locks
  • Combination Locks
• Badges (ID Cards, etc): Forms of physical identification and/or electronic access control devices. Can be nametags or smartcards.
• Motion Detectors: A device that senses movement or sound in a specific area. Monitors for meaningful changes in the monitored area.
  
  • Infrared (Passive Infra-Red): Monitors heat levels
  • Wave Pattern: Transmits frequency signal and monitors for changes.
  • Capacitance: Senses changes in the electrical or magnetic field surrounding an object.
  • Photoelectric: Senses changes in visible light levels.
  • Passive Audio: Listens for abnormal sounds
• Intrusion Alarms: Triggers a deterrent, repellent, and/or notification.
  
  • Deterrent: Engages locks, shuts doors, etc.
  • Repellant: Sounds a siren or bell and/or turns on the lights.
  • Notification: Triggers notifications that are usually silent to the intruder.
  • Local Alarms System: Must broadcast sound that can be heard 400 feet away and be protected from tampering by local security who are nearby
  • Central Station System: Usually silent locally but alerts offsite agents who are monitoring (ADT)
  • Auxiliary Alarm System: Notifies emergency services to arrive on the scene.
• Secondary Verification Mechanisms: Reduces the risk of a false alarm. Requiring 2 or more triggers in succession before an alarm sounds. CCTV can also be used to verify an intrusion.
  *