All
right, let's go and take a look at Module
Six, network security controls of the physical variety.
First, it's important to understand the necessity of physical security.
Without it, you have absolutely nothing.
You can have the best logical security controls, strong authentication
permissions, data classifications, all that stuff in place.
If somebody has physical access to your resources, you are seriously exposed.
We could at the very least cause a denial service.
We could steal data, we could sabotage equipment, install listening devices, harm
personnel, and the list just goes on and on.
So successful, unauthorized physical
access may lead to theft, modification, or damage to information systems.
It'll directly impact confidentiality, integrity, and availability.
The basis of any information security program is physical security.
Physical security is your first line of
defense, and people are sometimes referred to as your last line of defense.
We know that the last line of defense can be the weakest link in the security chain.
But also, we want to remember that humans still have to carry out
the appropriate procedures, implement the appropriate controls, follow policy.
The same goes for your physical security policy.
Now, physical security, initially, I had a little bit of an issue qualifying fire
suppression as physical security, things like that, or something that should be
included in an information security discussion.
But what happens if your data center burns up?
You have a denial service.
So at the very least, we can DOS.
We could probably do a lot more damage with direct access.
And in a penetration test, one of the most
fun exercises is to see how far you can intrude into the perimeter before somebody
actually confronts you and challenges you or asks if they can help you.
So a lot of fun.
Tailgating, piggybacking, wandering into areas adjacent to public areas.
Physical security is the physical layer of the OSI model.
We've touched a little bit on some of the
OSI considerations, but at layer 1 always refers to physical.
When we look at physical controls, they're going to fall into three
categories, administrative, technical, and physical physical controls.
Probably the easiest types of controls are countermeasures to visualize because
everybody knows what a fire is or a fire extinguisher or a lock or a door or a
fence or a light or a security camera or a guard, etc.
Your physical security attack vectors.
Now, a lot of the stuff you will take into
consideration when you're performing a risk analysis.
The likelihood of floods, fires,
earthquakes, lightning and thunder, temperature and humidity.
Wherever you live on planet Earth, there is a threat of some a natural disaster.
I'm in Florida, and we always have the
threat of hurricanes and tropical storms, and they can definitely wreak some havoc.
Wherever you go, there's some risk associated with Mother Nature.
All right, manmade threats, wherever you
go that humans are present, you have the possibility of vandalism,
device loss, damage of physical devices, theft, terrorism,
social engineering, a huge one, unauthorized access to systems, etc.
Now, again, these are just starter lists,
short lists of possibilities we could go on and on with lots of different examples
of manmade threats, natural environment, and so forth.