What class of gate is typically used for limited access and industrial sites?

Physical security requires that building site(s) be safeguarded in a way that minimizes the risk of resource theft and destruction. To accomplish this, decision-makers must be concerned about building construction, room assignments, emergency procedures, regulations governing equipment placement and use, power supplies, product handling, and relationships with outside contractors and agencies.

The physical plant must be satisfactorily secured to prevent those people who are not authorized to enter the site and use equipment from doing so. A building does not need to feel like a fort to be safe. Well-conceived plans to secure a building can be initiated without adding undue burden on your staff. After all, if they require access, they will receive it--as long as they were aware of, and abide by, the organization's stated security policies and guidelines (see Chapter 3). The only way to ensure this is to demand that before any person is given access to your system, they have first signed and returned a valid Security Agreement. This necessary security policy is too important to permit exceptions.

Physical Threats (Examples)

• Natural events (e.g., floods, earthquakes, and tornados)
• Other environmental conditions (e.g., extreme temperatures, high humidity, heavy rains, and lightning)
• Intentional acts of destruction (e.g., theft, vandalism, and arson)
• Unintentionally destructive acts (e.g., spilled drinks, overloaded electrical outlets, and bad plumbing)

The following countermeasures address physical security concerns that could affect your site(s) and equipment. These strategies are recommended when risk assessment identifies or confirms the need to counter potential breaches in the physical security of your system.

• Don't arouse unnecessary interest in your critical facilities: A secure room should have "low" visibility (e.g., there should not be signs in front of the building and scattered throughout the hallways announcing "expensive equipment and sensitive information this way").

• Maximize structural protection: A secure room should have full height walls and fireproof ceilings.
• Minimize external access (doors): A secure room should only have one or two doors--they should be solid, fireproof, lockable, and observable by assigned security staff. Doors to the secure room should never be propped open.
• Minimize external access (windows): A secure room should not have excessively large windows. All windows should have locks.
• Maintain locking devices responsibly: Locking doors and windows can be an effective security strategy as long as appropriate authorities maintain the keys and combinations responsibly. If there is a breach, each compromised lock should be changed.

• Investigate options other than traditional keyhole locks for securing areas as is reasonable:
Based on the findings from your risk assessment (see Chapter 2), consider alternative physical security strategies such as window bars, anti-theft cabling (i.e., an alarm sounds when any piece of equipment is disconnected from the system), magnetic key cards, and motion detectors.

• Be prepared for fire emergencies: In an ideal world, a secure room should be protected from fire by an automatic fire-fighting system. Note that water can damage electronic equipment, so carbon dioxide systems or halogen agents are recommended. If implemented, staff must be trained to use gas masks and other protective equipment. Manual fire fighting equipment (i.e., fire extinguishers) should also be readily available and staff should be properly trained in their use.
• Maintain a reasonable climate within the room: A good rule of thumb is that if people are comfortable, then equipment is usually comfortable--but even if people have gone home for the night, room temperature and humidity cannot be allowed to reach extremes (i.e., it should be kept between 50 and 80 degrees Fahrenheit and 20 and 80 percent humidity). Note that it's not freezing temperatures that damage disks, but the condensation that forms when they thaw out.
• Be particularly careful with non-essential materials in a secure computer room: Technically, this guideline should read "no eating, drinking, or smoking near computers," but it is quite probably impossible to convince staff to implement such a regulation. Other non-essential materials that can cause problems in a secure environment and, therefore, should be eliminated include curtains, reams of paper, and other flammables.

Don't say it if you don't mean it--instituting policies that you don't bother to enforce makes users wonder whether you're serious about other rules as well.

Locking critical equipment in secure closet can be an excellent security strategy findings establish that it is warranted.

• Keep critical systems separate from general systems: Prioritize equipment based on its criticality and its role in processing sensitive information (see Chapter 2). Store it in secured areas based on those priorities.
• House computer equipment wisely: Equipment should not be able to be seen or reached from window and door openings, nor should it be housed near radiators, heating vents, air conditioners, or other duct work. Workstations that do not routinely display sensitive information should always be stored in open, visible spaces to prevent covert use.
• Protect cabling, plugs, and other wires from foot traffic: Tripping over loose wires is dangerous to both personnel and equipment.
• Keep a record of your equipment: Maintain up-to-date logs of equipment manufacturers, models, and serial numbers in a secure location. Be sure to include a list of all attached peripheral equipment. Consider videotaping the equipment (including close-up shots) as well. Such clear evidence of ownership can be helpful when dealing with insurance companies.
• Maintain and repair equipment: Have plans in place for emergency repair of critical equipment. Either have a technician who is trained to do repairs on staff or make arrangements with someone who has ready access to the site when repair work is needed. If funds allow, consider setting up maintenance contracts for your critical equipment. Local computer suppliers often offer service contracts for equipment they sell, and many workstation and mainframe vendors also provide such services. Once you've set up the contract, be sure that contact information is kept readily available. Technical support telephone numbers, maintenance contract numbers, customer identification numbers, equipment serial numbers, and mail-in information should be posted or kept in a log book near the system for easy reference. Remember that computer repair technicians may be in a position to access your confidential information, so make sure that they know and follow your policies regarding outside employees and contractors who access your system.

"Percussive maintenance" is the fine art of pounding on a piece of sensitive electronic equipment until it returns to proper working order.

• Identify your equipment as yours in an overt way: Mark your equipment in an obvious, permanent, and easily identifiable way. Use bright (even fluorescent) paint on keyboards, monitor backs and sides, and computer bodies. It may decrease the resale value of the components, but thieves cannot remove these types of identifiers as easily as they can adhesive labels.

• Identify your equipment as yours in a covert way: Label the inside of equipment with the organization's name and contact information to serve as powerful evidence of ownership.
• Make unauthorized tampering with equipment difficult: Replace regular body case screws with Allen-type screws or comparable devices that require a special tool (e.g., an Allen wrench) to open them.
• Limit and monitor access to equipment areas: Keep an up-to-date list of personnel authorized to access sensitive areas. Never allow equipment to be moved or serviced unless the task is pre-authorized and the service personnel can produce an authentic work order and verify who they are. Require picture or other forms of identification if necessary. Logs of all such activity should be maintained. Staff should be trained to always err on the cautious side (and the organization must support such caution even when it proves to be inconvenient).

• Never leave a laptop computer unattended: Small, expensive things often disappear very quickly--even more quickly from public places and vehicles!

• Store laptop computers wisely: Secure laptops in a hotel safe rather than a hotel room, in a hotel room rather than a car, and in a car trunk rather than the back seat.
• Stow laptop computers appropriately: Just because a car trunk is safer than its back seat doesn't mean that the laptop won't be damaged by an unsecured tire jack. Even if the machine isn't stolen, it can be ruined all the same. Stow the laptop and its battery safely!
• Don't leave a laptop computer in a car trunk overnight or for long periods of time: In cold weather, condensation can form and damage the machine. In warm weather, high temperatures (amplified by the confined space) can also damage hard drives.

It Really Happens!

Jack's briefcase was his life. Well, maybe it wasn't his whole life, but it definitely contained the better part of his professional life. It held his grade book, his lesson plans, his master's thesis--all very important things in the world of a middle school teacher.

And it wouldn't be an exaggeration to say that Jack sure was surprised when his life (the briefcase) went up in flames one afternoon in the school cafeteria. He couldn't explain it, but nonetheless he found himself sitting in front of the district technologist trying to do exactly that--explain why his briefcase caught on fire and ruined, among more important things to him, the spare battery he was carrying for the school's laptop computer.

"So," the technologist asked, "you're saying that you're surprised that your briefcase caught on fire? Well, let me tell you, I'm glad that it was only your bag that was damaged. Didn't you know that the exposed terminals of a battery can cause a spark? Didn't you know that any piece of metal, even a paper clip, can serve as the conduit? That's all it takes: an improperly stored battery, a paper clip and anything combustible--and wham, you've got yourself a fire. Your home could have gone up in flames last night because of it. Or your school could have this afternoon. Didn't you know that?"

Jack almost replied that, of course, he hadn't known about all of those dangers, and that the technologist should have warned him about them before he had borrowed the laptop and extra battery. But instead he just shook his head sheepishly. After all, along with his grade book, lesson plans, and master's thesis, he had just burned a $200 dollar laptop battery that didn't belong to him.

• Be prepared for fluctuations in the electrical power supply: Do so by (1) plugging all electrical equipment into surge suppressors or electrical power filters; and (2) using Uninterruptible Power Sources (UPSs) to serve as auxiliary electrical supplies to critical equipment in the event of power outages.

• Protect power supplies from environmental threats: Consider having a professional electrician design or redesign your electrical system to better withstand fires, floods, and other disasters.
• Select outlet use carefully: Although little thought generally goes into plugging equipment into an outlet, machines that draw heavily from a power source can affect, and be affected by, smaller equipment that draws energy from the same outlet.
• Guard against the negative effects of static electricity in the office place: Install anti-static carpeting and anti-static pads, use anti-static sprays, and encourage staff to refrain from touching metal and other static-causing agents before using computer equipment.

• Keep photocopiers, fax machines, and scanners in public view: These types of equipment are very powerful tools for disseminating information--so powerful, in fact, that their use must be monitored.
• Assign printers to users with similar security clearances: You don't want employees looking at sensitive financial information (e.g., staff salaries) or confidential student information (e.g., individual records) while they are waiting for their documents to print. It is better to dedicate a printer to the Director of Finance than to have sensitive data scattered around a general use printer. Don't hesitate to put printers in locked rooms if that is what the situation demands.
• Label printed information appropriately: Confidential printouts should be clearly identified as such.
• Demand suitable security procedures of common carriers when shipping/receiving confidential information: Mail, delivery, messenger, and courier services should be required to meet your organization's security standards when handling your confidential information.
• Dispose of confidential waste adequately: Print copies of confidential information should not be placed in common dumpsters unless shredded. (Comparable requirements for discarding electronic copies of confidential information can be found in Chapter 6.)

It Really Happens!

Dr. Hamilton was everything that a school district could ask for. She was a great visionary, a trusted leader, and an excellent superintendent... but she was terrible with the piles of paper she kept on her desk. Luckily for her and the district, she had an equally competent secretary. Lucy was always one step ahead of Dr. Hamilton with the paperwork. She knew where to find the latest draft of the letter to the Board. She knew which form needed to be completed by when. She knew how many copies of the monthly report needed to be run off.

One afternoon, Dr. Hamilton came running out of her office to Lucy's desk, "You haven't shredded those papers I gave you this morning yet, have you?"

As was always the case, Lucy had, of course, completed the task shortly after it had been handed to her. She told Dr. Hamilton so, and asked what was the matter.

"I think that I accidentally gave you my only copy of the speech I'm giving to the Chamber of Commerce tonight," the distraught woman replied, knowing that she'd never be able to reproduce the outline in time for the meeting.

"Don't worry," Lucy said, beaming with pride that her forethought was about to again pay off, "I make backup copies of every sheet of paper you give me before I turn on that paper shredder. Let's look in my filing cabinet."

Dr. Hamilton let out a deep sigh of relief--Lucy had again saved the day. Suddenly, however, the astute superintendent paused, "What do you mean you make copies of everything I give you before you turn on the paper shredder?"

Physical Security Checklist

While it may be tempting to simply refer to the following checklist as your security plan, to do so would limit the effectiveness of the recom-mendations. They are most useful when initiated as part of a larger plan to develop and implement security policy throughout an organization. Other chapters in this document also address ways to customize policy to your organization's specific needs--a concept that should not be ignored if you want to maximize the effectiveness of any given guideline.

What class of gate is typically used for limited access and industrial sites like warehouses?

What is industrial camouflage?

What type of smart card is most likely to be used by active duty military?

Which type of fire extinguisher is used on electrical equipment and wires and consists of gas dry powders or carbon dioxide?