Let's continue looking at facilities security.
We start at the outside with external physical access
controls. We put in place fences, good lighting. For example,
in parking areas,
we'll often have flood lighting so it's safe for our
people to get out to their vehicles,
whereas against the building will often have just a low‑level
lighting that shines down the wall of the building so our cameras
could pick up if somebody was there, that sort of thing.
We have guards.
Now the idea of a guard is that a guard is there to watch,
and if something happens,
they can try to determine whether or not this is good or bad.
So in other words, it's what we call discriminating judgment.
You take, for example,
a smoke detector as a good example of a device which is a very good alert,
very important to have,
but doesn't have much discernment because a smoke
detector could be telling you there is a fire or it could
be that there is excess humidity.
We often see that smoke detectors close to a bathroom will
trigger if a person has a very hot shower,
or a smoke detector may just be telling us that the toast is burnt.
So the problem with that type of a device is that it doesn't tell us the
scope or should we say whether or not it's a serious problem.
A guard can help us to make that determination.
Is this something that is serious?
What should be the correct response be?
We also use a lot of alarms.
These are very good to indicate if there is some type of a problem,
an intruder for example, a door open alarm,
these are all very important, as well as,
of course,
the basics such as fire alarms or even a duress alarm where if an
employee is under some type of duress or being threatened,
they can trigger alarm that would silently call,
for example, security or the police.
It is important that we try to control entry to our facilities.
Maybe we put up bollards or things to block people
from going in areas they shouldn't, driving into should we say,
employee parking area, there is barriers there to prevent that.
We should have a designated visitor parking area which
allows us then to watch who's coming in,
and of course, separate that out from the employee area.
When you look at physical access controls,
a person coming into the building should have a badge.
That badge very often will have their picture and name on it and an expiry date,
and those are important so that nobody could use somebody
else's badge so that if the badge is expired,
then it should trigger and not be able to be used.
And a lot of the badges, of course,
also work together with a smartcard so that you can use them to
open up a turnstile or use it to open up a door,
that sort of thing.
Many people, of course,
use these even on a reader on their desktop so that their
badge has to be plugged into that desktop reader for them
to log in to the desktop.
We're all familiar with turnstiles,
even if we're not familiar with the term itself,
but that turnstile is that little gate that as we walk through it a
couple of arms turn and we put this in front of many buildings so that
when you come in the front door you tap your card on a little reader and
the gate will open and let you in, for example.
We also have mantraps.
This is like a type of double door facility.
You come in through one door, it closes behind you,
you then are identified maybe using your badge reader,
and the second door will open and you can continue into the building,
but you're actually trapped in there until you
provide the correct identification.
When it comes to visitors, obviously, we want that everyone in
the secure facility is wearing an ID badge that clearly
displays what their access should be.
Are they allowed to just wander anywhere in the building?
Their ID badge should quickly indicate if they are a foreign national
or if they are only allowed in one area or another.
And, of course, a lot of these badges today will automatically expire.
They couldn't use them again just the next day, for example.
And it's important that when a person is issued a temporary badge,
we have a record of who that person is, we check,
for example,
some type of identifier and put it into a log that a
temporary badge was issued to this person.
It's, just as a point,
it's good for us to actually write it in a log because it
could well be that if we say to a person,
I'll give you a temporary badge,
just please put your name in the log here and they could sign in,
for example, as a cartoon character, and if nobody checks,
then we actually have no record of who it was that we gave that badge to.
It can well be in a number of situations that if a
person is going to walk through an area,
they must be escorted.
There must be a person who goes with them to make sure that they do
not go to some place they're not allowed to go.
One of the most important physical access controls we have are cameras
and cameras are essential because they allow us to one,
identify the type of incident,
the size or magnitude of the incident so that we can
then launch the correct response.
They also record so that we have a record we can go back and look at later.
So a lot of value in cameras, but it comes down to again,
is it a good quality image?
There has been many cases with the images so poor quality,
you can't even make out facial features of a person.
That's something we should certainly watch for,
that we have good quality equipment with good lighting.
Then we store those, should we say, images for a time period.
Now one of the things we should do is control who has access to the storage.
We don't want a person going through it who doesn't have a need to know.
There is no reason they should be looking at camera footage.
We protect those stored images in case we have to do some type of incident,
and we have a clear policy on how long we would retain or how
long we would keep those images as well.
We also should, of course, monitor large areas,
and for this,
we could have a number of different types of cameras that
operate in different types of lighting scenarios.
Maybe it's a zoom‑in camera or it's one that can pan across from side‑to‑side,
tilt up and down.
But the camera should be installed in a way that they
work together with the lighting,
not that the camera is blinded by lights then that make it
so the camera can't see certain areas.
The cameras should be set up so that we have full coverage of the area.
Now cameras capture personal information,
so it's important that we are legally compliant with any types of
rules about whether or not we can have a camera and how we use it
and that sort of thing as well.
An important thing is we have signs, and we disclose the fact that
we have a camera so these people are aware of it.
There are also a number of internal threats.
Someone could steal equipment,
they could trip over a power cord and disconnect power to a server.
You take cleaning staff, for example,
one of the more famous examples of this is where every day a
system went down at a company in the evening,
they didn't know why and what it was that the cleaning
staff came in unplugged that power bar that ran that
system and plugged in their vacuum,
did their cleaning and then plugged it in again at the end,
and so the system would come back up,
but they didn't know why it was failing every single day.
The other thing, of course,
is we can have a lot of interruptions because
somebody is doing some construction,
some work in the area, they cut network cables,
they cut power, and it can disrupt operations.
When it comes to damage to wiring,
this is where often we use things like conduit, we'll,
and if we have wire that goes in an exposed area,
we'll put it into either a plastic or metal tube to
try and protect it from damage.
We also want to protect our equipment.
Maybe we even use some type of screens on the equipment if
it's a high dust area or a lot of moisture.
We should use screen filters so that people can't just see what's on our screen,
all good things to try and protect from improper disclosure
or should we say damage to equipment.
When it comes to protecting the building itself,
the facilities,
we have to look after our employees and customers and have emergency exits.
They should never be blocked.
It should always be easy for a person to see where those exits are,
so with what we call egress lighting as well that will light their way
even if there is a power failure to the exit and show the location of
the exit and that emergency lighting should allow at least enough light
that if there was a power failure, people can safely get out of the building.
We use the term fail safe, and you see this in a number of buildings.
We have a main entrance and people can come in and go
out through that main entrance,
but we also have other doors along the side of the building where there
is no door handle, and those are fail safe doors.
So if there's a problem, people can go out through that door,
but since there is no handle on the outside,
they can't come back in through that door,
so it fails in a safe manner to preserve life.
If I have a shared facility,
there are several companies working in the same building,
this is where we need to make sure we secure work areas that people
from another company can't get into our work area,
but we have a higher risk now of interception of traffic.
If we have a wireless in there,
undoubtedly our neighbors are going to be able to see that.
And we quite often will have shared wiring closets.
The wires that run in the building with everything from power to
communications are running in the risers as we often call them and wiring
closets that should be secured so people can't get in there and tap into our
lines or we can say here intercept our traffic.
And so the challenge with this is that obviously other
people can get in there as well.
We use conduit to protect our cables so people can't tap into
it and certainly our equipment cabinet should be locked so
that no one can get in and steal, for example,
some of our, the IT equipment.
The key points review.
When we talk about physical security,
it's more important than most IT people recognize because a physical
breach can circumvent almost any technical control.