Physical Security ( Information Security )
A significant amount of security incidents are found to be
performed utilizing some vulnerability of the physical security.
So, here is a set of rules to create a blueprint of physical security of a IT department and data center for a company.
- The system room must not have windows. Ideally, it should be in the center of the building.
- All equipment that is not used must be stored in dedicated storage space, away from production environment
- All high security spaces should be monitored by CCTV cameras.
- Access control zones must be implemented, to create a security barrier as well as provide a log of access activities. These are created by doors opened by electronic key cards or multiple-factor authentication.
- All windows should be fully tempered, and equipped with a glass break sensor connected to a central alarm system
- All spaces that don't have 24/7 access should have motion sensors connected to the central alarm system.
- The design of the environment should enable technical service personnel to operate with minimal risk of unauthenticated access to data
- All alarm events and CCTV control should be under maximum security but should NOT be accessible by IT personnel
- Paper, optical and magnetic data carriers should be handled in a controlled environment, and properly destroyed prior to discarding
- High security environment should always implement multi-factor authentication.
The set-up of the environment is the following:
The reception area is the only way to access the entire floor, and everyone accessing this space is recorded on the CCTV camera. The access to the rest of the floor is restricted by an key card controlled door.
The Communication Room is also in the reception area, and it is accessible by a key card and PIN controlled door. It houses access panels where the communication providers (Telecoms, Internet, VPN etc.) terminate the purchased links. This is the last point where a representative of the telco providers can access to configure connectivity. The comm room has to be opened by an authorized System Administrator, so the telco provider's person is always escorted by an authorized person.
All the corridors in the space around the data-room are under CCTV surveillance
All offices have windows made of tempered glass that cannot be opened and are equipped with motion sensors which activate after 7 PM.
Support center which is manned 24/7, the toilet and the equipment storage room are the only rooms without motion sensor. These spaces can be used 24/7 so there is no point in placing motion sensors.
All documentation photocopying and destruction is performed in a dedicated room equipped with proper devices (shredder, degausser).
Dedicated storage space is used to store all unused equipment, which is accessed by a key card controlled door and is also monitored by CCTV.
The data-room is central to the floor, and has strengthened walls (Blue walls). The data-room is divided into two segments:
- Pre-system space - this space is accessible via a dual key card door, which opens only when two persons use their key cards simultaneously. The Pre-system space contains the supporting infrastructure, which is placed outside of the system space to minimize risks of battery or coolant leaks, and to allow service personnel to access and service this infrastructure without having access to the actual servers.
- System space - this space is accessible via the dead-man door, which is actually a very small corridor (only fits one person at a time) with two doors at the end. If one of the doors is open the other is automatically locked. In order to pass through the dead-man door, one must pass a multi-factor authentication: He/She needs to present his key card (something he/she has), type in the corresponding PIN (something he/she knows), and after entering the dead-man space, he is measured to verify the stored weight of the person, and a biometric verification is performed - retina or fingerprint (something he/she is).
