The reception area.
I got a fun story on this one, but the
reception area should be spacious, offer a proper scope to control building access,
visitor traffic, and assess visitors behavior.
It's your initial point of entrance to the building in a lot of cases.
People from the public areas can wander into the reception area.
Nothing sensitive should be in the field of view.
The design and placement of reception deskshould help in discouraging and
appropriate access to the administration area.
Computers should be positioned so the
screens are not visible to the visitors, and computers at the reception desk must
always be locked when the receptionist personnel is away from the desk.
I'll tell you a quick story.
Another easy counsel instructor and I, I got to sit...
The guy that wrote the CPAP course, got to sit his advanced penetration testing
class, and we did an onsite location and we walked into this secure area and
we're getting our IDs copied and so forth and we escorted in.
I looked down and I look down and
there's this binder open with a bunch of systems usernames and passwords.
And all I could think of was I was going to try to grab my phone and take a picture
of it, but then I thought I might get caught and I might not go over too well.
But that stuff is typically accessible or
kept the front desk area, but it shouldn't be out.
And they were actually working on
something at the time, but it was in the field of view.
And had I been quick and sly with my phone, I would have captured a list of
credentials for various systems, alarm systems and that thing.
Interesting.
Our visitor logs.
The visitor logs is used to capture and maintain a record of visitors' data
whenever they access vigilant zones in the premises.
You don't need to log everybody walking in the front door to reception, but if they
enter any restricted area, most definitely.
Paper based and digital logbooks are two different flavors.
Details like the visitor's name, contact
details, login, log out time, purpose of access.
Digital logbooks automatically detect or
verify static pictures, fingerprints or ID swipe via the Internet.
Logbooks also generate emergency
notifications in case of hazardous conditions.
Server or backup device security.
You want to keep critical network assets,
servers, backup devices in a separate room.
We already talked about that.
Protect tip with an appropriate access control.
Keep the server room and backup devices under video surveillance.
Again, principle of least privilege.
If you're not supposed to be in the area, you're not allowed in.
Critical assets and removeable devices.
Keep your network devices and computer
equipment in lock cabinets to prevent physical access.
Some cabinets can be equipped with biometrics and climate control features,
which we're going to talk about in a second.
You also want to restrict the use of
removable media, DVDs, USPend drives, SD cards, and so forth.
And again, the whole thing is implemented through policy and procedure.
Let's create network cables.
Network cables can be easily cut or eaves dropped on or tapped into.
You want to lay network wiring separate
from all other wiring to prevent electronic interference, radio frequency
interference, or electromagnetic interference.
You want to protect the actual physicality of the cables.
Undergrounding the cables will prevent physical access.
Don't lay cables above false ceilingsto avoid fire risks and again, document
everything, your entire cable infrastructure.
All right, securing portable media devices.
Use cables and locks to safeguard laptops.
Encrypting hard drives, always recommended, makes it impossible to access
files when it's lost or stolen and the drive is actually removed from the device.
Install anti theft software that can remotely lock.
Device tracking and remote wipes, really important.
So if that physical device is lost, it can be easily accessed and remotely cleaned.
Enable or install the remote wipe, erase data stored in devices.
Don't lend your device to third parties.
Don't leave them unattended in public places, label the device or attach a
sticker with the name and the contact details.
The device can be returned if lost or your
contact information on your home screen of your mobile phone.
Airports and a rod, notorious for malware, free public WiFi, things like that.
You have theft rings that just work
airports, look for unattended laptop bags, etc.
And boom, they walk away.
Lots of incidents of theft in airports and hotels and things like that.