Physical Security ( Information Security )
A significant amount of security incidents are found to be
performed utilizing some vulnerability of the physical security.
So, here is a set of rules to create a blueprint of physical security of a IT department and data center for a company.
- The system room must not have windows. Ideally, it should be in the center of the building.
- All equipment that is not used must be stored in dedicated storage space, away from production environment
- All high security spaces should be monitored by CCTV cameras.
- Access
control zones must be implemented, to create a security barrier as well
as provide a log of access activities. These are created by doors
opened by electronic key cards or multiple-factor authentication.
- All windows should be fully tempered, and equipped with a glass break sensor connected to a central alarm system
- All spaces that don't have 24/7 access should have motion sensors connected to the central alarm system.
- The
design of the environment should enable technical service personnel to
operate with minimal risk of unauthenticated access to data
- All alarm events and CCTV control should be under maximum security but should NOT be accessible by IT personnel
- Paper,
optical and magnetic data carriers should be handled in a controlled
environment, and properly destroyed prior to discarding
- High security environment should always implement multi-factor authentication.
The following image presents a concept for an IT department and System room environment that follows the presented set of rules:
The set-up of the environment is the following:
The reception area
is the only way to access the entire floor, and everyone accessing this
space is recorded on the CCTV camera. The access to the rest of the
floor is restricted by an
key card controlled door.
The Communication Room is also in the reception area, and it is accessible by a
key card and PIN controlled door. It houses access panels where the communication providers (
Telecoms, Internet,
VPN etc.) terminate the purchased links. This is the last point where a representative of the
telco providers can access to configure connectivity. The comm room has to be opened by an authorized System Administrator, so the
telco provider's person is always escorted by an authorized person.
All the corridors in the space around the data-room are under CCTV surveillance
All offices have windows made of tempered glass that cannot be opened and are equipped with motion sensors which activate after 7 PM.
Support center which
is manned 24/7, the toilet and the equipment storage room are the only
rooms without motion sensor. These spaces can be used 24/7 so there is
no point in placing motion sensors.
All documentation photocopying and destruction is performed in a dedicated room equipped with proper devices (shredder,
degausser).
Dedicated storage space is used to store all unused equipment, which is accessed by a
key card controlled door and is also monitored by CCTV.
The data-room is central to the floor, and has strengthened walls (Blue walls). The data-room is divided into two segments:
- Pre-system space - this space is accessible via a dual key card door, which opens only when two persons use their key cards simultaneously. The Pre-system
space contains the supporting infrastructure, which is placed outside
of the system space to minimize risks of battery or coolant leaks, and
to allow service personnel to access and service this infrastructure
without having access to the actual servers.
- System space -
this space is accessible via the dead-man door, which is actually a
very small corridor (only fits one person at a time) with two doors at
the end. If one of the doors is open the other is automatically locked.
In order to pass through the dead-man door, one must pass a multi-factor
authentication: He/She needs to present his key card
(something he/she has), type in the corresponding PIN (something he/she
knows), and after entering the dead-man space, he is measured to verify
the stored weight of the person, and a biometric verification is
performed - retina or fingerprint (something he/she is).
The
system space is under constant CCTV surveillance, and it also contains a
separate small electronically locked space where the security
controllers reside, to isolate these controllers from the
SysAdmins.
