• Choose a category
• All
• Classic-Fiction

By Root 342 0

and removable media such as removable drives, backup tapes, and disks should be restricted and protected. Computer screens should be positioned such that they can't be seen by passers-by, and a policy should be implemented and enforced that requires users to lock their systems when they leave the computer for any reason. Computer systems with highly sensitive data should be protected in an enclosed and locked area such as a credential-access room with a rack-mount case and lock.

Technical Technical security measures such as firewalls, IDS, spyware content filtering, and virus and Trojan scanning should be implemented on all remote client systems, networks, and servers.

Operational Operational security measures to analyze threats and perform risk assessments should be a documented process in the organization's security policy.

Technical and Operational security measures are dealt with in other chapters of this book.

What Is the Need for Physical Security?

You need physical security measures for the same reason you need other types of security (such as technical or operational) to prevent hackers from gaining access to your network and your information. A hacker can easily get such access through weaknesses in physical security measures. In addition, data can be lost or damaged by natural causes; so, risk managers must add natural disasters to the equation when planning appropriate security. Physical security measures are designed to prevent the following:

■ Unauthorized access to a computer system

■ Stealing of data from systems

■ Corruption of data stored on a system

■ Loss of data or damage to systems caused by natural causes

Who Is Accountable for

Physical Security?

The following people in an organization should be accountable for physical security:

■ The organization's physical security officer

■ Information system professionals

■ Chief information officer

■ Employees

Everyone in an organization is responsible for enforcing physical security policies. It's the physical security officer's responsibility to set the physical security standard and implement physical security measures.

Factors Affecting Physical Security

Physical security is affected by factors outside the physical security controls. Factors that can affect an organization's physical security include the following:

■ Vandalism

■ Theft

■ Natural causes, such as

■ Earthquake

■ Fire

■ Flood

Security professionals need to be aware of these risk factors and plan accordingly. Many organizations create a business continuity plan (BCP) or disaster recovery plan (DRP) to prepare for these possibilities.

Exam Essentials

Understand the attacks that can be performed via physical access. Physical access gives a hacker the ability to perform password cracking, rogue wireless access points and theft of equipment attacks.

Understand the important role physical security plays in an organization's security plan. Physical security is critical to an organization's security plan.

Know some factors that affect the enforcement of physical security. Vandalism, theft, and natural causes affect the enforcement of physical security.

Know who is accountable for physical security. The organization's security officer, information system professionals, chief information officer, and employees are responsible for physical security.

Understand the need for physical security. Physical security is necessary to prevent unauthorized access to a building or computer system, theft of data, corruption of data stored on a system, and loss of data or damage to systems caused by natural causes.

Review Questions

1. Who is responsible for implementing physical security? (Choose all that apply.)

A. The owner of the company

B. Chief information officer

C. IT managers

D. Employees

2. What factor does impact physical security?

A. Encryption in use on the network

B. Flood or fire

C. IDS implementation

D. Configuration of firewall

3. Physical security is designed to prevent what?

A. Stealing confidential data

B. Hacking systems from the inside

C. Hacking