We'll continue looking at Access Controls Concepts for the
Certified in Cybersecurity course with a more in‑depth look
at physical access controls.
This is one of the three modules of this course,
the idea being that we looked at the concepts or theory.
Now we want to look at how we implement those in a
physical access control world. And later,
we'll look at how we implement them in a logical or
technical access control environment as well.
We identify the various physical threats,
natural events, for example, crime, competitors.
Yeah, a competitor may want to steal our best employees,
they may try to monopolize the supply chain so we
can't get the raw materials we need.
We've even had cases where they purchased land so that we had a limited
supply of water available for our systems to run.
We also have the problem of a geopolitical event,
some things like wars, insurrection, unrest,
for example.
It's important that we set up the correct support for our IT systems
to operate in our data centers and server rooms.
That means we put in systems such as heating,
ventilation, air conditioning, we put in power support systems and lighting.
In the case of heating, ventilation, air conditioning,
we try to control the temperature to a temperature that
is good for the systems to run at.
Now this varies a lot.
It used to be that the temperatures were a lot lower than they are today.
We spend a lot of money trying to cool a data center.
So, a lot of our equipment now will actually run
quite a bit hotter than it used to.
We used to have very strict controls over humidity
between 40 and 60% relative humidity,
but we see some data centers today going 20 to 80% relative humidity.
When it comes to power,
we want to ensure we have clean and steady power for our systems to run.
Maybe that means we have a UPS, or uninterruptible power supply,
and if the power goes out,
we have a generator that can kick in and start to provide the power we need.
When it comes to lighting,
it's good for our systems to be well lit in the way of
providing more safety for our personnel,
for example,
and hopefully less of a hazard of a person tripping or whatever, as well.
Physical security is very much based on concepts such as layered defense.
A layered defense, sometimes known as defense in depth,
means I'm not going to rely on just a single control to
protect something that is an important asset.
So we have controls arranged in a sequence or in a series such as we could
have at the outside perimeter of our facility a fence,
then into the building, a door, behind the door,
a security guard, into a secure work area,
another type of biometric lock, for example. Within the work area,
locked cabinets.
What does this do?
This means that the data we have in that locked cabinet would
only be accessible to a person who would actually manage to get
past all five of these actual controls.
So the idea of layered defense is important.
Why?
Because physical security vulnerabilities can be more serious
than any other security control vulnerability.
The idea is that I could have long passwords and I could have,
for example, a lot of technical controls,
but if my building was just wiped out in a flood,
then it doesn't matter if I had, for example,
redundant equipment.