Chapter 10physical Security Requirementsapply Secure Principles To S ✓ Solved

Chapter 10 Physical Security Requirements Apply Secure Principles to Site and Facility Design Secure Facility Plan Site Selection Visibility Natural Disasters Facility Design overview Secure Facility Plan Critical path analysis Security for basic requirements Technology convergence Include security staff in design considerations Site Selection Cost Location Size Security requirements Pre-existing structure or custom construction Proximity to others Weather conditions Visibility Surrounding terrain Vehicle and foot traffic Residential, business, or industrial area Line of sight Crime rate Emergency services Unique local hazards Natural Disasters Common local natural disasters Severe weather patterns Protection for workers and assets Facility Design Based on level of security needs Combustibility, fire rating Construction materials Load rating Intrusion, emergency access, resistance to entry Security architecture Crime Prevention through Environmental Design (CPTED) Implement Site and Facility Security Controls Design concepts Equipment failure Wiring closets Cable plant management policy Server rooms/data centers Media storage facilities Evidence storage Restricted and work area security Utilities and HVAC considerations Water issues Fire prevention, detection, and suppression overview Design Concepts Administrative physical security controls Technical physical security controls Physical controls for physical security Corporate vs. personal property Deterrence Denial Detection Delay Equipment Failure Failure is inevitible Purchase replacement parts as needed Onsite replacement warehousing SLA with vendors MTTF MTTR MTBF Wiring Closets Premises wire distribution room Intermediate distribution facilities (IDF) Prevent physical unauthorized access Do not use as general storage Do not store flammable materials Use video surveillance Perform regular physical inspections Cable Plant Management Policy Entrance facility Equipment room Backbone distribution system Telecommunications room Horizontal distribution system Server Rooms/Data Centers Need not be human compatible Locate in core of building One hour minimum fire rating for walls Physical access control: Smartcards, proximity readers, IDS Access abuses: Masquerade, piggyback Emanation security Faraday cages, white noise, and control zones Media Storage Facilities Store blank, reusable, and installation media Data remnants Use a locked cabinet Have a librarian or custodian Check-in/check-out process Sanitization, zeroization Evidence Storage Becoming important business task Drive images and virtual machine snapshots Distinct from production Block Internet access Track all activities Calculate hashes of all files Limit access Encrypt stored data Restricted and Work Area Security Operations centers Distinct and controlled area access Walls or partitions Shoulder surfing Assign classifications Track assets with RFID Sensitive Compartmented Information Facility (SCIF) Utilities and HVAC Considerations UPSes Double conversion UPS Line-interactive UPS Surge protectors Generators Fault, blackout, sag, brownout, spike, surge, inrush, noise, transient, clean, ground EMI vs.

RFI Temperature, humidity, static Water Issues Leakage Flooding Electrocution Water detection circuits Shutoff values Drainage locations Fire Prevention, Detection, and Suppression 1/3 Fire triangle: fire, heat, oxygen, combustion Stages: Incipient, smoke, flame, heat Fire Prevention, Detection, and Suppression 2/3 Fire extinguisher classes: Class Type Suppression Material A Common combustibles Water, soda acid B Liquids CO2, halon*, soda acid C Electrical CO2, halon* D Metal Dry powder Fire Prevention, Detection, and Suppression 3/3 Fire detection systems: Fixed temperature, rate-of-rise, flame-actuated, smoke-actuated Water suppression Wet pipe, dry pipe, pre-action, deluge Gas suppression CO2, Halon, FM-200, alternatives Damage Smoke, heat, suppression media Implement and Manage Physical Security Perimeter Security Controls Internal Security Controls overview Perimeter Security Controls Fences Gates Turnstiles Mantraps Lighting Security guards and dogs Internal Security Controls 1/2 Keys and combination locks Electronic access control (EAC) locks Badges Motion detectors Infrared, heat, wave pattern, capacitance, photoelectric, passive audio Intrusion alarms Deterrent alarms, repellant alarms, notification alarms Local alarm, central station, auxiliary station Internal Security Controls 2/2 Secondary verification mechanisms Environment and life safety Privacy responsibilities and legal requirements Regulatory requirements Conclusion Read the Exam Essentials Review the Chapter Perform the Written Labs Answer the Review Questions Chapter 5 Protecting Security of Assets Identify and Classify Assets Defining Sensitive Data Defining Classifications Determining Data Security Controls Understanding Data States Handling Information and Assets Data Protection Methods Determining Ownership Data Processors Using Security Baselines overview Defining Sensitive Data Personally Identifiable Information (PII) NIST SP Protected Health Information (PHI) HIPAA Proprietary Data Defining Classifications 1/3 Government/Military Top Secret Secret Confidential Unclassified For Official Use Only (FOUO) Sensitive but Unclassified (SBU) Non-government Class 3, 2, 1, 0 Defining Classifications 2/3 Defining Classifications 3/3 Civilian Confidential or Proprietary Private Sensitive Public Defining Asset Classifications Asset classification should match system classifications for use/access Determining Data Security Controls Define a policy for all forms and locations of data Encrypt all the things Consider the value of data Use labels and enforcement Use data loss prevention (DLP) Set requirements for: Communications, Storage, and Backups Understanding Data States Data at rest Data in motion Data in use Encryption Authentication Authorization Handling Information and Assets 1/4 Marking Sensitive Data and Assets Physical and logical labeling Assists with DLP and human handling Address downgrading Handling Sensitive Information and Assets Be aware of common loss of control situations, such as backups and cloud storage Handling Information and Assets 2/4 Storing Sensitive Data Use storage encryption Manage the environment Provide quality storage devices for long term retention Destroying Sensitive Data NIST SP 800-88r1, “Guidelines for Media Sanitization†Handling Information and Assets 3/4 Eliminating Data Remanence HDD vs.

SSD/flash Sanitization Erasing Clearing Purging Degaussing Destruction Declassification Handling Information and Assets 4/4 Ensuring Appropriate Asset Retention Record retention Media, system retention Employees and NDAs A necessary element of a security policy Data Protection Methods Protecting Data with Symmetric Encryption AES Triple DES Blowfish Protecting Data with Transport Encryption TLS VPN IPSec SSH Determining Ownership 1/4 Data Owners Asset Owners/System Owners Business/Mission Owners Data Processors (next slide) Determining Ownership 2/4 Data Processors The person or entity that controls processing of the data GDPR EU-US Privacy Shield Notice; Choice; Accountability for Onward Transfer; Security; Data Integrity and Purpose Limitation; Access; Recourse, Enforcement, and Liability Determining Ownership 3/4 Pseudonymization Artificial identifiers Anonymization Inferencing Data masking and randomization Administrators Determining Ownership 4/4 Custodians Users Protecting Privacy HIPAA California Online Privacy Protection Act of 2003 (CalOPPA) Personal Information Protection and Electronic Documents Act (Canada) GDPR NIST SP 800-53 Scoping Selecting controls that specifically apply to the protected target Tailoring Adjust security control baseline to align with organization mission Selecting Standards Contractual vs. regulation/legislation Using Security Baselines Conclusion Read the Exam Essentials Review the Chapter Perform the Written Labs Answer the Review Questions

Paper for above instructions

Physical Security Requirements: Applying Secure Principles to Site and Facility Design

Introduction

Physical security is a critical component of organizational safety, encompassing measures designed to safeguard personnel, information, and assets from damage or theft. Effective physical security integrates various principles to ensure a secure environment, particularly when planning and designing sites and facilities. This analysis discusses secure facility planning, site selection factors, natural disaster considerations, facility design, and technological convergence, alongside incorporating security staff in design considerations.

Secure Facility Plan

A secure facility plan begins with sound site selection, which focuses on the cost, location, size, and specific security needs of the organization. The existing structure could influence the engineering design and security measures to be adopted. The U.S. Secret Service notes that site location impacts security selections and methods, emphasizing that proximity to potential threats should be cautiously assessed (U.S. Secret Service, 2021).
Moreover, visibility is crucial in deterring criminal activity, whereby clear sightlines and open landscapes around a facility enhance security (Crowe, 2000). Natural disasters also require attention in secure planning, with climate patterns influencing construction materials and emergency response strategies.

Site Selection Factors

Selecting the right site involves multiple considerations:
1. Cost: The budget must align with security requirements and potential risks associated with the area.
2. Location and Proximity: The facility should be positioned to minimize risk from potential threats, like crime or natural disasters.
3. Surrounding Terrain: The landscape should be assessed to understand any natural barriers that may assist or challenge security measures (Harris, 2017).
4. Crime Rate and Emergency Services: Areas with high crime rates or limited access to emergency services are less favorable (National Crime Prevention Association, 2018).

Weather Conditions

Weather patterns directly impact facility resilience. Facilities in hurricane-prone areas must employ wind-resistant designs, while those in snow-heavy regions must ensure structural integrity against heavy snow loads (National Weather Service, 2022). Understanding local conditions leverages improved planning for adverse events, ensuring continuous protection for assets and personnel.

Facility Design Overview

The facility design plays a pivotal role in establishing levels of security needed. The choice of construction materials must consider fire ratings, load ratings, and resistance to unauthorized entries (Jasinski, 2016). Crime Prevention through Environmental Design (CPTED) emphasizes designs that discourage criminal activity. Ensuring that windows and entrances remain visible while considering natural surveillance can considerably detour intruders (Cozens et al., 2005).

Security Architecture and Fire Safety

Fire prevention, detection, and suppression systems form an integral part of physical security. Based on the fire triangle concept (fire, heat, oxygen), comprehensive strategies for early detection through smoke and heat alarms, as well as suppression via sprinklers or gaseous systems, must be installed (Fennelly & Perry, 2014).

Controlled Access

Access control measures, including physical barriers, electronic locks, and security personnel, must be diligently used to safeguard premises. Utilizing smart cards and biometric access ensures that only authorized personnel enter restricted areas (Turner et al., 2020).

Technology Convergence

The integration of technology into physical security has ushered in innovative solutions that enhance safety. Technology convergence includes the amalgamation of traditional physical security measures with digital systems, such as closed-circuit television (CCTV), intruder detection systems, and alarm systems. The increase in reliance on technologies like drones for site monitoring reflects a significant shift in security strategies (Makris, 2016).

Security Staff in Design Considerations

Including security personnel in the design phase is crucial. Their expertise provides insights into the practical aspects of security measures that new designs must implement (Perrin & Ewen, 2020). Engage them in discussions around technology requirements, physical barriers, and emergency response plans during facility design to ensure a comprehensive approach.

Security Controls for Essential Areas

Strategies must encompass controls for critical areas within the facility:
1. Server Rooms/Data Centers: These must employ both physical access confines and environmental controls to ensure sensitive data is secure from both physical and digital breaches (Wang et al., 2017).
2. Media Storage Facilities: These areas require rigorous access controls and protocols to manage data effectively (Raghu, 2019). Employing encryption and strict access management practices prevents unauthorized access.
3. Evidence Storage: Increasingly relevant in organizational contexts, stringent management of this area requires logging all access and employing encryption measures for stored data (Gregory, 2013).

Conclusion

Organizations today face multifaceted security challenges that require a holistic approach when designing secure facilities. By addressing factors like site selection, designing controlled environments, and leveraging technology, organizations can significantly mitigate risks to their assets and personnel. Ensuring that security staff play an integral role in the design process leads to a more resilient security posture. Ultimately, the principles of physical security must be embedded into the planning and design phases to create an environment that prioritizes safety and minimizes risks.

References

1. Crowe, T. (2000). Business Security Compliance: How to Manage ISO 17799 and Other Security Standards.
2. Cozens, P., Saville, G., & Hillier, D. (2005). Crime Prevention through Environmental Design.
3. Fennelly, L. J., & Perry, M. C. (2014). An Introduction to Fire Protection.
4. Gregory, L. (2013). Managing evidence storage: best practices for security organizations.
5. Harris, D. (2017). Security Risk Management: Applications and Strategies for the 21st Century.
6. Jasinski, J. (2016). Designing Secure Facilities: A Guide for Builders and Owners.
7. Makris, A. (2016). Security and Surveillance Drones: A Discussion of Applications and Case Studies.
8. National Crime Prevention Association. (2018). Understanding and combating local crime.
9. National Weather Service. (2022). Weather Patterns & Their Impact on Security Planning.
10. Perrin, J., & Ewen, R. D. (2020). The Role of Security Personnel in Physical Security Design.
This overview provides a detailed perspective on physical security requirements in a comprehensive manner, including technical, design, and strategic elements integrated into facility planning and execution.