All right.
There's also a subcategory of controls
that deals with the controls intent, purpose, application.
So in the administrative, technical, and physical realms, we have preventative.
Preventive, sometimes referred to as preventative, same thing.
If you get an extra symbol in there,
they're talking about the same type of control.
That used to drive me nuts because one
book will say preventive, the other book will say preventative.
I'm thinking there's two different categories or levels of prevention.
They're meant to prevent security
violations and enforce various access control mechanisms.
They're also quite often an extended
duration delay or deterrent type of mechanism.
So a preventive, first off, nothing is 100 % preventive.
But if it's a long term deterrence or
delay, like a lock, for example, then it's likely to prevent somebody from continuing
to attempt, walk away, go after lower hanging fruit.
So there's always a way in somehow, even if it's a preventive control, you can pick
a lock, for example, or you can take a sledgehammer and pop the door open.
Detective controls are meant to detect
security violations, record intrusion attempts.
Probably your best example of a detective control is an intrusion detection system.
We just got done talking about intrusion
detection systems, smoke detectors, cameras, guards, and so forth, all meant
to detect possible security violations or record or detect intrusion attempts.
Examples, motion detectors, alarm,
sensors, video surveillance, other methods.
And again, you go on and on with lots of examples of these types of controls.
Deterrent controls are meant to discourage attackers, send warning messages to
attackers to discourage intrusion attempts.
Signage, great example of a deterrent control.
Velvet ropes, the example of a deterrent control.
How many times you've been standing in
line at TSA, the airport, or in some line where there's velvet ropes and you're
thinking to yourself, I could hop that thing pretty easily.
They're definitely not meant to prevent.
You can plow right through them if you like, but they give you pause.
They make you think twice, especially
things like no trespassing, authorized personnel only, that thing.
Recovery controls.
They are used to recover from a security
violation and restore information and systems to a persistent state.
Now, sometimes you'll actually see recovery and corrective.
I can spell it right here.
Corrective is a flavor of recovery control.
There are actually two different
categories, but recovery is typically going to bring you up from a failed state.
Corrective typically fixes something on the fly.
They'll give you examples of corrective
and recovery, and sometimes they're talking about the same thing.
Like antivirus could be an example of a corrective or recovery control.
Corrective, Hey, I detect a malicious file and I quarantine it.
The recovery mechanism could be cleaning the files after infection if they've
already say infected the system like a rescue desk.
So recovery, bring it up from a failed state.
Corrective, fix an issue but not
necessarily an issue that's caused the system to completely fail.
Restore systems and information to a persistent state.
Great examples of recovery are disaster recovery, business continuity plans,
backup systems, and other restoration processes.
Compensating controls.
I used to think of these as a consolidation control.
That's how I kept it straight when I was
studying for my first exam that tested you on controls.
It's an alternative too.
Compensating is an alternative in case your primary control is unavailable.
So like a cost of living, you can't have your primary control, but you can have
this one instead because it costs less or it's within your budget.
One of the great examples of that is security guards.
Security Guards, they're humans.
They're an ongoing cost.
They get a salary and they get vacations
and they tend to be in some situations unreliable because they're humans.
They get sick, you got to train them, etc.
The price tag on a security guard is
higher than any other type of control in general.
I guess you could get a really beefy
hot site set up and so forth that would cost more than the side of a security
guard, but generally that's referenced as one of your more expensive controls.
We can't afford a security guard, maybe instead we employ security cameras.
Security guards have that whole
discerning, discriminating judgment quality.
They notice when somebody is there that doesn't belong there, a camera can do the
same thing but not be nearly as intimidating, say, as a security guard.
So it's compensating.
Dogs, for example, also compensatory controls.
So an alternative to or a compensation for
the lack of a control or some shortcoming in a control.
And can the controls failed or cannot be used?
Examples include hot sites, backup power systems, and other means.
Location considerations.
You have two considerations when you're determining a location for data
processing, operations, whatever the case may be.
Are you going to build from scratch or are
you going to use pre existing construction?
You need to take a look at the current
building structure, resilience to break and intrusions and so forth,
and determine if it's more cost effective to retrofit or construct from scratch.
You also want to consider whether or not you want to be found.
Visibility of assets.
Do you need to be found?
Do people need to visit your facility?
If not, be as inconspicuous as possible.
Call that urban camouflage.
Neighborhood buildings, a lot of danger from neighbors.
There was an example in
one of the old basic text for one of my first security exams.
We got tested on this stuff.
They were talking about a mushroomilow factory that was in close
proximity to a rocket fuel processing plant.
The mushroomilow factory real dangerous activity there.
They're making marshallows, for crying out loud.
The rocket fuel plant, well, another story.
Volatile, toxic chemicals and so forth.
Anyway, this thing goes up
and it takes out the mushroomilow factory at the same time.
Neighboring buildings or neighbors in
close proximity definitely pose a threat and danger.
And all I could visualize was raining, burning Mushroomallows.
I thought for sure they made that up for just an example.
But sure enough, that actually occurred in Nevada years ago.
Local considerations, crime rates,
flood, regional issues, we've talked about that a bit already.
The impact of catastrophic events,
joint tenancy risk of the cohabitation variety in the same building.
So a lot of building construction is fairly cheaply manufactured these days.
Not a lot of resistance to a concerted or
directed effort to compromise walls and partitions.
A lot of times, it's ceilings don't go walls don't go all the way up to the
ceiling, they go up to the drop ceiling and that's it.
A lot of times you can just pop ceiling
tiles up and jump right into the office next to you.
So issues from joint tenancy should be considered as well.
We could go on and on about that.
Site architect teach your considerations.
Identify what are critical
infrastructures, have a separate location for the server and storage room.
This goes into control zoning.
Like everything else, there should be
classifications grouped by sensitivity and criticality.
When you classify or set up security zones
physically, you're going to want to put your most sensitive areas at the core of
the building with no adjacentcies to any public access.
Have a separate location for the server and storage room.
Keep everything segregated.
You also want to consider emergency access.
You want to consider fire suppression, which we're getting ready to talk about.
Identify what safety measures are required for these systems.
The question of a manned or unmanned facility is raised.
Now, anywhere humans are present, there are always our ultimate priority.
With fire suppression, things like that.
In an unmanned facility, you can use oxygen displacement type of suppression.
But oxygen is needed by humans too.
We displace that, you not only put out the
fire, you put out the human, and we just can't have that.
So whether it's going to be manned or unmanned.
We have a lot of unmanned facilities these days, racks and miles and miles
seemingly of racks of servers, high capacity data centers, that thing.
We're going to have emergency exits.
So again, you have to be able to get out
in the event of an emergency, clearly marked signage, etc.
We'll call the signage that leads you to an emergency exit a directive control.
There's actually more controls than we saw in the previous slide.
A couple more I'll letter in here and there.
Not really one of your more mainstream shortlist types of controls, but
directives in general steer you in the right direction.
Make plans to manage environment hazards.
We're going to talk more about that a little bit later in this module.
Define who will be responsible for managing these systems, delegate
responsibility, establish procedures on how they should be protected.
Procedures. Over document your procedures.
If you don't have procedures clearly documented and straightforward and not
subject to confusion, then nothing gets done the same way every time.
You can hand down verbally how to do this process, do this process.
You get generational loss every time.
When you train somebody in accordance with a specific procedural document, then you
have a lot less likelihood of a mutation of those steps.
Use a proper sanitization system, manhole, sewers, etc.
Keep parking away from the building. How come?
Well, got a lot of car bombs, things like that these days.
People roll up in the parking lot,
explosive device, takes out part of the building.
Firefighting systems.
I remember when I first saw the chapter on
fire suppression, I'm like, What does that have to do with information security?
Everything. Again, when you consider availability, if
there's a fire, your servers burn up, your data goes away too.
Security goes right out the window.
Most security exams these days that address physical security
are going to hit you on fire suppression and firefighting systems.
There are a couple of different categories of firefighting systems.
You have active fire protection, which is
either manual or automatic, that involves fire detection and fire suppression.
Again, manual, I've got a pull an alarm, throw a valve, whatever the case may be.
Automatic, there is a sensor.
Sensor detects a temperature threshold or rate of rise or smoke detectors or
whatever and automatically releases suppression.
So smoke, flame, and heat detectors, we have a few varieties of those.
Fire suppression, a fire extinguisher, which is typically a manual operation.
Stand pipe systems or sprinkler systems.
Probably the most common are going to be your fire extinguishers,
which should be within 50 feet of electrical equipment and it exits and
there's different standards at the state and local levels versus federal.
Stand pipe systems, not as much as a sprinkler systems.
Sprinkler systems, if you look up and you're in a commercial building, most
likely you got little sprinkler heads along the ceiling.
Most likely they have little amber thermal
links that need to burn off before the sprinkler releases its water.
We call it a pre action, typically dry pipe system.
While we're on the subject, you will probably run into some
definitions, pre action, dry pipe, wet pipe, and maybe a deluge system.
The difference between those four
varieties are a dry pipe system does not contain water in the pipes to begin with.
A wet pipe system in cold climates, pipes
freeze, they burst, water escapes, destroys equipment.
Not good.
Dry pipes, no water is stored in the lines until a threshold is reached, a pressure
valve opens, it floods the pipes, and then they release their water.
A pre action system requires that that thermal link burn off before the sprinkler
head, and that gives you a little extra delay time.
A deluge system is tons of water right now.
Imagine somebody knocking the cap off of a fire hydrant and gushing water.
Maximum suppressive capacity, but also going to do the most damage if you've got
any equipment that's destroyed by water damage.
So the suppression media itself can also
cause damage, whether that's powders or water or so forth.
All right, passive fire protection.
That's your structural consideration, and
that's also a proactive type of protection.
You use of fire resistant construction
materials, compartmentalization, emergency exits, minimizing and flammable sources.
Let's say flammable sources.
Maintenance of fire fighting systems.
A lot of times you'll outsource that to a fire system or fire extinguisher company.
Emergency procedures and educating the occupants.
Emergency procedures.
Since most of us can remember all the way back to grade school, we did fire drills.
Part of your training and education is emergency situations, active shooters,
fire, and so forth, which there should be well documented procedures
for actually in the building, lots of directive signage, things like that.
And we'll talk more about that in our business continuity and disaster recovery
planning because there's a lot of emphasis on training and drills.
All right, the suppresents.
We have five classes of fires.
Class A is ordinary solid combust.
Class B is flammable liquids and gasses like petroleum products.
Class C is electrical equipment.
Class D is combustible metals like magnesium, tongue stent, that thing.
Tongue stent, wait a minute, that's wrong.
Magnesium, thermite, and so forth.
Thermite is one.
Then oils and fats.
K is the kitchen fire.
That's how I kept that one straight.
When you suppress a fire,
you actually attack one of the three legs of the fire triangle.
There's also a chemical reaction.
So heat, oxygen, and fuel.
Suppress the heat, remove the oxygen, separate the fuel from the fire.
You can also disrupt the chemical reaction, which is typically done with a
Halon system or an inner gin FM200 Halon replacement.
The suppressive needs to be appropriate for the type of fire.
Water is not a good idea to throw on burning liquids because it spreads it.
It's not a good idea to throw on electrical equipment in electrical fire
because it just makes it more angry and gives it more connectivity.
The foam option may be appropriate.
You see that actually apply to all categories.
Dry chemical with your powder extinguishers, that thing.
Wet chemicals, clean agents, CO2s, and special chemicals.
You want to have a fire extinguisher that
is rated for the types of fires you'd like to run into.
Class A, B, Cs are pretty common.
Physical barriers, keep people out physically.
I think we all know what a fence is.
Probably seen a fence before.
We also know that fences have different heights.
Like the deterrent controls, you may look
at a fence and go, I could hop that thing, no problem.
When I was younger, I could eyeball a
fence and say, I'd make it over that thing, no problem.
Nowadays, I might think twice about it
because I might actually screw up my knee or something.
But a fence that's 3 to 4 feet high deters casual trespassers.
A fence that's 6 to 7 feet high is more
deterrent, can't easily jump, so a little bit higher deterrent.
And then eight feet high and 12 inches or
three strands of barbed wire is going to give you your maximum deterrent effect.
And you can go higher than that.
You go 12 feet, razor wire, double stacked and so forth.
But you might want to be familiar with those different types of fence heights.
Steel rails and barricades.
Again, some of this stuff is stationary, some is not.
First line of defense to stop trespassers.
It may be deterrent, it may be preventive.
A ballard is a...
A lot of times those yellow pipes sticking
up out of the ground with concrete in them, or the big cement ball.
You're like, Hey, that's like art.
They're meant to control vehicular and pedestrian traffic.
So it keeps people from out of the blocking.
Arnold Schwarzenegger and Terminator, where he drives the car through the front
of the police station for crashing a physical barrier.
So ballards keep traffic from sensitive areas where people are.
Hopefully, nobody drives into an area where people are walking.
Again, the purpose for ballards is not necessarily for intrusion on the building.
Turnstiles. All right, turnstiles.
You can hop over a turnstile, possibly,
but it's meant to allow or admit one person at a time that's authenticated.
So a gate, for example, and a fence could
be opened, stay open, or a door, and people can just keep walking through, and
it may allow for unauthorized entry, tailgating and piggybacking.
Turnstiles are constructed so that only one person can pass at a time.
I guess if you've got really tailgating, you can squeeze two people through that,
but they're meant to, again, control access to one subject at a time.
A man trap is another option for that,
which we're going to see a dedicated slide for here in just a few slides.
Let's turn styles and then other physical
barriers, doors, windows, grills, glass, curtains, etc.
Again, some of this stuff is not meant to
prevent physical access, but maybe prevent field of view, the ability to see into
shoulder serve sensitive areas and that thing.
A lot of the emphasis on doors and windows and fire suppression material and so forth
on your physical construction, your doors need to...
All of the delay times need to match on your door.
So the lock, the casing, the door itself,
it's really useless to have a really high quality lock and resistant to picking and
bumping and all that, and have your door hinges on the intruder side where you can
just pop the pins out and take the door off.
I've got some stories around that when I was responsible for...
Well, somewhat responsible for building
security, but the building we were in, you could bump every lock, no problem.
We ended up changing out of the locks.
Then also there was a vertical piece of
glass next to every door that the trim ring, the screws were on the outside.
All you had to do was glass out and then walk through.
Turn sideways and walk through.
See lots of really insecure entrances.
My favorite are the ones where the
lock won't engage or the door doesn't close all the way or even propped open,
especially around patch closets and server rooms.
Security personnel, efficient and well
trained security personnel are critical to implement, monitor and maintain.
People have to carry all this stuff out.
In a manned facility, it's policy procedure documentation, but at
the end of the day, again, the people have to make it so.
And again, people will potentially be the breakdown of the weak link in the chain.
Guards, safety officers, security officers, supervisor, etc.
And everybody, actually,
every user, every employee in the organization is security personnel.
If you see something, say something.
Most people will have a sixth sense when
somebody is there that doesn't belong there, they're going to sense that.
So you should approach that person, May I help you find what you're looking for?
But they should be challenged, most
definitely, if you see somebody that looks like they don't belong.
Security personnel should be aware of
policies and procedures, emergency situations, patrolling procedures, first
aid, medical assistance, fire prevention, trespassers, and crowd management.
Security access badges.
I remember when we first started getting
access badges, I'm like, Is this really necessary?
And nowadays, it is standard issue.
Years ago, when I got into IT, 1999, nobody had ID badges.
We really had some pretty lax physical security and for a lot of considerations.
We didn't have the true floor to ceiling walls.
You could hop over into different shared
spaces just by popping the ceiling tile up.
We definitely addressed a lot of that stuff.
But we started issuing ID badges and became more and more mainstream.
But that is a great indicator of who belongs and who doesn't belong just by
seeing their lanyard around their neck since they've got a valid ID badge.
They'll also be typically used for a
secondary factor authentication or to swipe or badge into a badge entrance.
There are credential cards that you can use to authenticate personnel while
granting entry secured with an automated access control system.
They could also include parking gates, turns, dials and doors.
They're electronic in nature, which means
you can track and have auditing and accountability.
When the access badge is read by a card,
the facility code is forwarded access control system.
And again, whenever it's done digitally, we can audit and maintain a log file.
Really useful.
Physical locks are the biggest pain to replace when anything has to be changed.
Physical locks need to be changed out.
They need to be rekeyed.
I am not a big fan of repinning cylinder tumbler locks.
Definitely not my thing.
Frustrating is all get out.
I would much rather just replace the lock.
Unfortunately, you can't necessarily do that in a larger environment.
It might be more cost effective, maybe have somebody come in.
But the problem with mechanical locks is that when somebody leaves the company and
has a key, you can never really trust that key has been copied.
Even those do not copy stamps on keys, you'll find locksmith that will.
Anyway, so mechanical locks are not nearly
as convenient as digital locks, which require a fingerprint, smart card, or pin.
They're also trackable.
When Bob leaves the company, Bob's security code can be disabled.
We don't have to change the codes for anybody else.
You don't have to change out the locks.
Combination locks, pretty straightforward,
require a sequence of numbers or symbols to unlock.
This particular type of lock is easily changeable.
I've actually got one of those on my shed.
And then electronic, electric, or electromagnetic locks will engage a
solenoid or magnet to operate by supplying or removing power.
Now, with locks and automated locks, you
always want to error on the side of safety.
So when you think of failing safe versus
failing secure, failing safe is failing open, failing secure is failing closed.
If it's a lock and there's a fire, you
always need to fail safe so everybody can get out.
Otherwise, they're locked in and they burn up.
That's not good.
Fail secure, on the other hand, is when things fail to a secure state.
And again, when you're talking physical locks, physical environment, and humans
are involved, it's always going to be fail safe, always fail safe.
Concealed weapon contraband detection devices.
Anybody that has taken a flight in the last 20 years is very familiar with metal
detectors, X ray inspection systems, and one based detectors.
Depending on the security of your building, you may have a guard gate at the
front, walk through metal detectors, inspection systems, and wand detectors.
The man trap.
The man trap is a security system having
an entry door and an exit door on opposite sides.
Door number 1, you walk through, it closes.
Door number 2, you authenticate to.
If you authenticate, door opens, you walk through.
If you don't, door stays locked, first door stays locked, and here comes the
responding force or personnel or security guard to check your level of access.
This is also meant to control access.
It's meant to verify authentication.
It also is typically monitored, so you can see an elevator cam or whatever.
You can see if there's two people in there.
So a dual layer control.
Our warning signs.
Again, these are examples of deterrence or directed notifications.
Warning signs are used to ensure someone
does not inadvertently intrude on any restricted areas.
Didn't see the sign. Sorry about that.
Again, these are deterrent control authorized personnel only.
Now, I'm going to throw a little extra bonus in here.
You have a deter, delay, detect, and respond type of scenario.
For example, if you have a deterrent like a warning authorized users only or no
trespassing sign, somebody may think twice about trying to walk through a door.
If they decide to try to walk through the
door and they were out of the lock or in a pin code, they may be delayed long
enough to be detected and then long enough to be responded to.
When you're looking at security, you start with deterrence.
You want to slow them down long enough to say be detected.
You want to determine whether or not an
intrusion is taking place, and that gives you the ability to respond.
Our alarm sensor system.
The alarms should be installed inside at
the entrance to report intrusions, suspicious activity emergencies.
Alarms can be local or remote Annuncation.
They can be meant to be repellent or notification alarms.
They can be engaged by smoke detectors,
heat detectors, security personnel, manual poll switches, and so forth.
I think we're all pretty familiar with what a fire alarm sounds like.
Should be audible to everyone in the building.
Set at intervals of five minutes, such as
the first alert, second, and the final alert to evacuate.
They can be tripped by a variety of sensors.
A passive infrared sensor, for example,
detects changes in temperature at a given point in time.
You can use as infrared.
A circuit based alarm is where you break a physical circuit.
So the circuit based, think of the foil wrapper gum trick from Beverly Hills Cop.
There you go, circuit based sensor.
Infra sound detector, acoustically detects sounds.
Acoustically detects sounds, I think that was redundant.
Uses an acoustic detector or microphone to
detect low frequency sound vibrations below 20 Hertz.
A motion detector uses a lot of times
radar sensors, which are Doppler sensors, detects the movement of a person or an
animal within a small range, 40 feet, 135 degree field of vision.
Most have seen motion activated lighting
and cameras and so forth, and you got that whole field of view sensor.
Proximity detectors, use RFID tags and readers to detect the
movement of objects within a specified physical range.
Also detects the displacement of equipment or objects.
All right, video surveillance.
Two potential purposes for video surveillance.
One is identifying somebody uniquely.
That requires a much more high resolution
camera than just detecting motion intrusion.
Depending on what you want to use the
footage for, that dictates exactly what types of cameras to purchase.
If you need any detail or you need to
identify somebody uniquely, you need a high resolution 4K type of camera.
Otherwise, it's scary how often people are
caught redhanded on a video and they just say it's not me.
There's a reasonable doubt there.
May not be them, may look like it, but
it's video footage, you know, grainy and so forth.
So you may have issues with that in a legal proceeding at lower resolutions.
All right, CTV systems can be programmed
to capture motion and trigger alarms if an intrusion movement is detected.
One cool thing with video cameras is just
pixel changes in the video feed can indicate motion.
Our surveillance system should be installed in strategic locations.
You should be able to monitor the entire
perimeter and leave no avenue of access unmonitored.
Our lighting systems, lighting really important.
Shady people don't like bright spaces.
People want to hide if they're not supposed to be.
If they're an intruder, they're not supposed to be there.
They like to stay out of sight.
And lighting systems should be overlapping.
You should have eight feet up and two feet out of entrances.
Over overlapping radiuses.
Lighting systems can also be continuous,
which means continuous overlapping for the entire perimeter.
Standby, which kick in for some situation like the primary lighting fails.
Moveable, spotlights and things like that.
Then emergency lighting typically is battery operated.
That stuff lights up in the case of a
power outage and directs you to emergency exits.
Power supplies.
Again, a absence of power can be a
physical security issue causing a denial of service.
Different types of uninterruptible power supplies are stand by and in lines.
Online or stand by generally means do you have to switch over to the
battery or are you running off the battery?
Now there's six different flavors depicted here.
Standby is the most commonly used for personal computers.
Line interactive, used for small business, web and departmental servers.
Standby online is most commonly used for server rooms.
Standby fair out, typically not used these days because it becomes unstable when
operating a modern computer power supply load.
Double conversion where electrical isolation is necessary, and Delta
Conversion, where direct connectivity is required or complete isolation.
The two basic flavors are online and stand by.