Chapter 2:Physical Security

Essentials
Dr. Sarah Abu Ghazalah
Information System Security
• Logical security. Protects computer-based data from software-based
and communication-based threats.
• Physical security. Also called infrastructure security. Protects the
information systems that keep data and the people who use, operate,
and maintain the systems.
Physical Security
• Physical security involves two complementary requirements:
1. First, physical security must prevent damage to the physical
infrastructure that sustains the information system.
2. Second, physical security must prevent misuse of the physical
infrastructure that leads to the misuse or damage of the protected
information. The misuse of the physical infrastructure can be
accidental or malicious. It includes vandalism, theft of equipment,
theft by copying, theft of services, and unauthorized entry.
Physical Security Threats

Environmental
threats

Human-
Technical
caused
threats
threats
Inappropriate Temperature and Humidity
• Computers and related equipment are designed to operate within a
certain temperature range.
• Most computer systems should be kept between 10 and 32 degrees
Celsius (50 and 90 degrees Fahrenheit). Outside this range, resources
might continue to operate but produce undesirable results.
Inappropriate Temperature and Humidity
• Another temperature-related concern is the internal temperature of equipment,
which can be significantly higher than room temperature.
• Computer-related equipment comes with its own temperature dissipation and
cooling mechanisms, but these may rely on, or be affected by, external conditions.
• Such conditions include excessive ambient temperature, interruption of supply of
power or heating, ventilation, and air-conditioning (HVAC) services.
• High humidity also poses a threat to electrical and electronic equipment.
Environmental Threats
• Fire and Smoke
• Water damage
• Chemical, Radiological, and Biological Hazards
• Dust
Technical Threats
• Electrical Power: Electrical power is essential to the operation of an information
system. All the electrical and electronic devices in the system require power.
Technical Threats
Power utility problems can be broadly grouped into three categories:

Undervoltage, Overvoltage, Noise

Technical Threats
• An undervoltage occurs when the IS equipment receives less voltage
than is required for normal operation.
• Most computers are designed to withstand prolonged voltage
reductions of about 20% without shutting down and without
operational error.
• Deeper dips or blackouts lasting more than a few milliseconds trigger a
system shutdown.
• Generally, no damage is done, but service is interrupted.
 • Far more serious is an overvoltage. A surge of
Technical voltage can be caused by a utility company supply
anomaly, by some internal (to the building) wiring
fault, or by lightning.
Threats • Power lines can also be prone to noise causing
logical errors.
 Stuxnet
• Stuxnet is the name given to a software worm that
disrupted the Iranian Uranium enrichment centrifuges.
• Stuxnet utilized four separate zero-day exploits to
infiltrate SCADA systems controlling centrifuges in Iran
and quietly cause failure.
• The worm itself was only discovered long after damage
had been done
• The worm would cause the centrifuges to speed up and
slow down, until they failed, while simultaneously
reporting normal operation back to the SCADA system.
https://www.youtube.com/watch?v=7g0pi4J8auQ
Human-Caused Physical Threats
• Human-caused threats are more difficult to deal with than the
environmental and technical threats discussed so far.
• We can group such threats into the following categories:

Unauthorized
physical
Misuse access

Vandalism Theft.
Human-Caused Physical Threats
• Unauthorized physical access: Information system assets, such as servers, mainframe
computers, network equipment, and storage networks, are generally housed in restricted
areas. Access to such areas is usually restricted to only a certain number of employees.
Unauthorized physical access can lead to other threats, such as theft, vandalism, or
misuse.
• Theft. This threat includes theft of equipment and theft of data by copying, Eavesdropping
and wiretapping also fall into this category.
• Vandalism. This threat includes destruction of equipment and destruction of data.
• Misuse. This category includes improper use of resources by those who are authorized to
use them, as well as use of resources by individuals not authorized to use the resources at
all.
PHYSICAL SECURITY PREVENTION AND
MITIGATION MEASURES
Technical Threats Prevention
• To deal with brief power interruptions, an
uninterruptible power supply (UPS) should be employed
for each piece of critical equipment.
• The UPS is a battery backup unit that can maintain
power to processors, monitors, and other equipment
for a period of minutes.
• For longer blackouts or brownouts, critical equipment
should be connected to an emergency power source,
such as a generator.
Technical Threats Prevention
A spectrum of approaches can be used to restrict access to equipment.
• Physical contact with a resource is restricted by restricting access to the building. This approach is
intended to deny access to outsiders but does not address the issue of unauthorized insiders or
employees.
• Physical contact with a resource is restricted by putting the resource in a locked cabinet, safe, or
room.
• Usage of Password, smart cards, and/or biometric for authentication.
• Usage of barriers such as fences.
• A machine may be accessed, but it is secured (perhaps permanently bolted) to an object that is
difficult to move. This will deter theft but not vandalism, unauthorized access, or misuse.
• A movable resource is equipped with a tracking device so that a sensing portal can alert security
personnel or trigger an automated barrier to prevent the object from being moved out of its proper
security area.
• A portable object is equipped with a tracking device so that its current position can be monitored
continually.
 Surveillance Systems
• In addition to physical and procedural barriers, an effective physical
access control regime includes a variety of sensors and alarms to
detect intruders and unauthorized access or movement of equipment.
Surveillance systems are frequently an integral part of building
security.

https://www.youtube.com/watch?v=iSe-jVy5wFk
RECOVERY FROM PHYSICAL SECURITY
BREACHES
• The most essential element of recovery from physical security
breaches is redundancy.
• Redundancy does not undo any breaches of confidentiality, such as the
theft of data or documents, but it does provide for recovery from loss
of data.
• At the extreme, a hot site can be created off site that is ready to take
over operation instantly and has available to it a near-real-time copy of
operational data
Threat Assessments
• To implement a physical security program, an organization must
conduct a threat assessment to determine the number of resources to
devote to physical security
 Set up a
steering
committee

Obtain
Prioritize the information
threats and
assistance

Approximate Identify all

the direct possible
costs. threats

Determine
the
likelihood of
each threat
Prioritize the threats

Importance=Likelihood * (Direct Cost +Secondary Cost)

Personal Identity Verification (PIV)
• A level of some confidence corresponds to use of the card reader and
PIN.
• A level of high confidence adds a biometric comparison of a
fingerprint.
• A very high confidence level requires that the process just described is
completed at a control point attended by an official observer
Personal Identity Verification (PIV)
• The other major component of the PIV system is the PIV card issuance
and management subsystem.
• This subsystem includes the components responsible for identity
proofing and registration, card and key issuance and management, and
the various repositories and services (public key infrastructure [PKI]
directory).
• The PIV system interacts with an access control subsystem, which
includes components responsible for determining a particular PIV
cardholder’s access to a physical or logical resource.
Personal Identity Verification (PIV)
• Unlike the typical card number/facility code encoded on most access
control cards, the FIPS 201 CHUID (Card Holder Unique Identifier)
takes authentication to a new level, through the use of an expiration
date and an optional CHUID digital signature.
• A digital signature can be checked to ensure that the CHUID recorded
on the card was digitally signed by a trusted source and that the
CHUID data have not been altered since the card was signed.
• The CHUID expiration date can be checked to verify that the card has
not expired
Physical and Logical Access Control
If the integration of physical and logical access control extends beyond a
unified front end to an integration of system elements, a number of
benefits accrue, including the following:
• Employees gain a single, unified access control authentication device
• A single logical location for employee ID management reduces
duplicate data entry operations
• Auditing and forensic groups have a central repository for access
control investigations.
Physical Security Checklist
• Look at page 130-131