CHAPTER 5_Physical and Environmental Security Flashcards
Emphasis: Cross-sectional
A photoelectric system, or photometric system, detects the change in a light beam and thus can be used only in windowless rooms. These systems work like photoelectric smoke detectors, which emit a beam that hits the receiver. If this beam of light is interrupted, an alarm sounds. The beams emitted by the photoelectric cell can be cross-sectional and can be invisible or visible beams. Cross-sectional means that one area can have several different light beams extending across it, which is usually carried out by using hidden mirrors to bounce the beam from one place to another until it hits the light receiver. These are the most commonly used systems in the movies. You have probably seen James Bond and other noteworthy movie spies or criminals use night-vision goggles to see the invisible beams and then step over them.
Emphasis: Similarities in Approaches
Similarities in ApproachesThe risk analysis steps that need to take place for the development of a physical security program are similar to the steps outlined in Chapter 2 for the development of an organizational security program and the steps outlined in Chapter 8 for a business impact analysis, because each of these processes (development of an information security program, a physical security program, or a business continuity plan) accomplishes goals that are similar to the goals of the other two processes, but with different focuses. Each process requires a team to carry out a risk analysis to determine the company’s threats and risks. An information security program looks at the internal and external threats to resources and data through business processes and technological means. Business continuity looks at how natural disasters and disruptions could damage the organization, while physical security looks at internal and external physical threats to the company resources.
Explanation Bullets: If a team is organized to assess the protection level of an existing facility, it needs to investigate the following:
- Construction materials of walls and ceilings
- Power distribution systems
- Communication paths and types (copper, telephone, fiber)
- Surrounding hazardous materials
- Exterior components:
- Topography
- Proximity to airports, highways, railroads
- Potential electromagnetic interference from surrounding devices
- Climate
- Soil
- Existing fences, detection sensors, cameras, barriers
- Operational activities that depend upon physical resources
- Vehicle activity
- Neighbors
Emphasis: Standby UPS
Standby UPS devices stay inactive until a power line fails. The system has sensors that detect a power failure, and the load is switched to the battery pack. The switch to the battery pack is what causes the small delay in electricity being provided. So an online UPS picks up the load much more quickly than a standby UPS, but costs more, of course.
Explanations: Intrusion Detection Systems Characteristics
IDSs are very valuable controls to use in every physical security program, but several issues need to be understood before implementing them:
Bullets: Class II
Commercial usage, where general public access is expected; examples include a public parking lot entrance, a gated community, or a self-storage facility
Bullets: Class III
Industrial usage, where limited access is expected; an example is a warehouse property entrance not intended to serve the general public
Bullets: Depositories
Safes with slots, which allow the valuables to be easily slipped in
Explanations: Types of Fire Detection
Fires present a dangerous security threat because they can damage hardware and data and risk human life. Smoke, high temperatures, and corrosive gases from a fire can cause devastating results. It is important to evaluate the fire safety measurements of a building and the different sections within it.
Bullets: In-rush current
Initial surge of current required to start a load
Explanations: Gauges and Mesh Sizes
The gauge of fence wiring is the thickness of the wires used within the fence mesh. The lower the gauge number, the larger the wire diameter:
Bullets: Supply system threats
Power distribution outages, communications interruptions, and interruption of other resources such as water, gas, air filtration, and so on
Bullets: Tempered
Glass is heated and then cooled suddenly to increase its integrity and strength.
Emphasis: fire-resistant material
A building could be made up of incombustible material, such as steel, which provides a higher level of fire protection than the previously mentioned materials, but loses its strength under extreme temperatures, something that may cause the building to collapse. So, although the steel will not burn, it may melt and weaken. If a building consists of fire-resistant material, the construction material is fire-retardant and may have steel rods encased inside of concrete walls and support beams. This provides the most protection against fire and forced entry attempts.
Emphasis: Vibration sensors
An acoustical detection system uses microphones installed on floors, walls, or ceilings. The goal is to detect any sound made during a forced entry. Although these systems are easily installed, they are very sensitive and cannot be used in areas open to sounds of storms or traffic. Vibration sensors are similar and are also implemented to detect forced entry. Financial institutions may choose to implement these types of sensors on exterior walls, where bank robbers may attempt to drive a vehicle through. They are also commonly used around the ceiling and flooring of vaults to detect someone trying to make an unauthorized bank withdrawal.
Emphasis: Wafer tumbler
Wafer tumbler locks (also called disc tumbler locks) are the small, round locks you usually see on file cabinets. They use flat discs (wafers) instead of pins inside the locks. They often are used as car and desk locks. This type of lock does not provide much protection because it can be easily circumvented.
Explanation Bullets: IDSs can be used to detect changes in the following:
- Beams of light
- Sounds and vibrations
- Motion
- Different types of fields (microwave, ultrasonic, electrostatic)
- Electrical circuit
Emphasis: Testing and Drills
Testing and DrillsHaving fire detectors, portable extinguishers, and suppressions agents is great, but people also need to be properly trained on what to do when a fire (or other type of emergency) takes place. An evacuation and emergency response plan must be developed and actually put into action. The plan needs to be documented and to be easily accessible in times of crisis. People who are assigned specific tasks must be taught and informed how to fulfill those tasks, and dry runs must be done to walk people through different emergency situations. The drills should take place at least once a year, and the entire program should be continually updated and improved.
Explanation Bullets: The following are some of the EPA-approved replacements for halon:
- FM-200
- NAF-S-III
- CEA-410
- FE-13
- Inergen
- Argon
- Argonite
Explanations: Personnel Access Controls
Proper identification needs to verify whether the person attempting to access a facility or area should actually be allowed in. Identification and authentication can be verified by matching an anatomical attribute (biometric system), using smart or memory cards (swipe cards), presenting a photo ID to a security guard, using a key, or providing a card and entering a password or PIN.
Emphasis: auto iris lens
CCTV lenses have irises, which control the amount of light that enters the lens. Manual iris lenses have a ring around the CCTV lens that can be manually turned and controlled. A lens with a manual iris would be used in areas that have fixed lighting, since the iris cannot self-adjust to changes of light. An auto iris lens should be used in environments where the light changes, as in an outdoor setting. As the environment brightens, this is sensed by the iris, which automatically adjusts itself. Security personnel will configure the CCTV to have a specific fixed exposure value, which the iris is responsible for maintaining. On a sunny day, the iris lens closes to reduce the amount of light entering the camera, while at night, the iris opens to capture more light—just like our eyes.
Bullets: Vaults
Safes that are large enough to provide walk-in access
Emphasis: passive infrared system (PIR)
A passive infrared system (PIR) identifies the changes of heat waves in an area it is configured to monitor. If the particles’ temperature within the air rises, it could be an indication of the presence of an intruder, so an alarm is sounded.
Bullets: Incident assessment
Response of security guards to detected incidents and determination of damage level
Explanations: Natural Surveillance
Please sit on this bench and just watch people walking by. You are cheaper than hiring a security guard.
Explanations: Natural Access Control
I want to go into the building from the side, but I would have to step on these flowers. I better go around to the front.
Bullets: Master keying
Enables supervisory personnel to change access codes and other features of the cipher lock.
Explanation Bullets: When dealing with electric power issues, the following items can help protect devices and the environment:
- Employ surge protectors to protect from excessive current.
- Shut down devices in an orderly fashion to help avoid data loss or damage to devices due to voltage changes.
- Employ power line monitors to detect frequency and voltage amplitude changes.
- Use regulators to keep voltage steady and the power clean.
- Protect distribution panels, master circuit breakers, and transformer cables with access controls.
- Provide protection from magnetic induction through shielded lines.
- Use shielded cabling for long cable runs.
- Do not run data or power lines directly over fluorescent lights.
- Use three-prong connections or adapters if using two-prong connections.
- Do not plug outlet strips and extension cords into each other.
Bullets: Amount of illumination of the environment
Lit areas, unlit areas, areas affected by sunlight
Emphasis: Fire detection
Fire detection response systems come in many different forms. Manual detection response systems are the red pull boxes you see on many building walls. Automatic detection response systems have sensors that react when they detect the presence of fire or smoke. We will review different types of detection systems in the next section.
Emphasis: Laminated glass
Laminated glass has two sheets of glass with a plastic film in between. This added plastic makes it much more difficult to break the window. As with other types of glass, laminated glass can come in different depths. The greater the depth (more glass and plastic), the more difficult it is to break.
Emphasis: Responsive area illumination
Responsive area illumination takes place when an IDS detects suspicious activities and turns on the lights within a specific area. When this type of technology is plugged into automated IDS products, there is a high likelihood of false alarms. Instead of continuously having to dispatch a security guard to check out these issues, a CCTV camera can be installed to scan the area for intruders.
Explanations: Internal Support Systems
Having a fortified facility with secure compartmentalized areas and protected assets is nice, but also having lights, air conditioning, and water within this facility is even better. Physical security needs to address these support services, because their malfunction or disruption could negatively affect the organization in many ways.
Intrusion Detection Systems Characteristics : IDSs are very valuable controls to use in every physical security program, but several issues need to be understood before implementing them:
- They are expensive and require human intervention to respond to the alarms.
- A redundant power supply and emergency backup power are necessary.
- They can be linked to a centralized security system.
- They should have a fail-safe configuration, which defaults to “activated.”
- They should detect, and be resistant to, tampering.
Bullets: Wet pipe
Wet pipe systems always contain water in the pipes and are usually discharged by temperature control-level sensors. One disadvantage of wet pipe systems is that the water in the pipes may freeze in colder climates. Also, if there is a nozzle or pipe break, it can cause extensive water damage. These types of systems are also called closed head systems.
Explanations: The Planning Process
Okay, so what are we doing and why?Response: We have no idea.
Bullets: Class IV
Restricted access; this includes a prison entrance that is monitored either in person or via closed circuitry
Explanations: Heat Activated
Heat-activated detectors can be configured to sound an alarm either when a predefined temperature (fixed temperature) is reached or when the temperature increases over a period of time (rate-of-rise). Rate-of-rise temperature sensors usually provide a quicker warning than fixed-temperature sensors because they are more sensitive, but they can also cause more false alarms. The sensors can either be spaced uniformly throughout a facility, or implemented in a line type of installation, which is operated by a heat-sensitive cable.
Explanations: Ventilation
Can I smoke in the server room?Response: Security!
Explanations: Electric Power
We don’t need no stinkin’ power supply. Just rub these two sticks together.
Emphasis: PIDAS Fencing
PIDAS FencingPerimeter Intrusion Detection and Assessment System (PIDAS) is a type of fencing that has sensors located on the wire mesh and at the base of the fence. It is used to detect if someone attempts to cut or climb the fence. It has a passive cable vibration sensor that sets off an alarm if an intrusion is detected. PIDAS is very sensitive and can cause many false alarms.
Emphasis: capacitance detector
A proximity detector, or capacitance detector, emits a measurable magnetic field. The detector monitors this magnetic field, and an alarm sounds if the field is disrupted. These devices are usually used to protect specific objects (artwork, cabinets, or a safe) versus protecting a whole room or area. Capacitance change in an electrostatic field can be used to catch a bad guy, but first you need to understand what capacitance change means. An electrostatic IDS creates an electrostatic magnetic field, which is just an electric field associated with static electric charges. All objects have a static electric charge. They are all made up of many subatomic particles, and when everything is stable and static, these particles constitute one holistic electric charge. This means there is a balance between the electric capacitance and inductance. Now, if an intruder enters the area, his subatomic particles will mess up this lovely balance in the electrostatic field, causing a capacitance change, and an alarm will sound. So if you want to rob a company that uses these types of detectors, leave the subatomic particles that make up your body at home.
Emphasis: blackout
Blackout A blackout is when the voltage drops to zero. This can be caused by lightning, a car taking out a power line, storms, or failure to pay the power bill. It can last for seconds or days. This is when a backup power source is required for business continuity.
Bullets: Access control mechanisms
Locks and keys, an electronic card access system, personnel awareness
Bullets: Reduction of damage through the use of delaying mechanisms
Layers of defenses that slow down the adversary, such as locks, security personnel, and barriers
Emphasis: Patrol Force and Guards
Patrol Force and GuardsOne of the best security mechanisms is a security guard and/or a patrol force to monitor a facility’s grounds. This type of security control is more flexible than other security mechanisms, provides good response to suspicious activities, and works as a great deterrent. However, it can be a costly endeavor, because it requires a salary, benefits, and time off. People sometimes are unreliable. Screening and bonding is an important part of selecting a security guard, but this only provides a certain level of assurance. One issue is if the security guard decides to make exceptions for people who do not follow the organization’s approved policies. Because basic human nature is to trust and help people, a seemingly innocent favor can put an organization at risk.
Emphasis: facility safety officer
Every organization should have a facility safety officer, whose main job is to understand all the components that make up the facility and what the company needs to do to protect its assets and stay within compliance. This person should oversee facility management duties day in and day out, but should also be heavily involved with the team that has been organized to evaluate the organization’s physical security program.
Emphasis: Heavy timber construction material
Heavy timber construction material is commonly used for office buildings. Combustible lumber is still used in this type of construction, but there are requirements on the thickness and composition of the materials to provide more protection from fire. The construction materials must be at least four inches in thickness. Denser woods are used and are fastened with metal bolts and plates. Whereas light frame construction material has a fire survival rate of 30 minutes, the heavy timber construction material has a fire rate of one hour.
Emphasis: Star Trek
These access cards can be used with user-activated readers, which just means the user actually has to do something—swipe the card or enter a PIN. System sensing access control readers, also called transponders, recognize the presence of an approaching object within a specific area. This type of system does not require the user to swipe the card through the reader. The reader sends out interrogating signals and obtains the access code from the card without the user having to do anything. Spooky Star Trek magic.
Bullets: Manmade threats
Unauthorized access (both internal and external), explosions, damage by disgruntled employees, employee errors and accidents, vandalism, fraud, theft, and others
Explanation Bullets: So, before an effective physical security program can be rolled out, the following steps must be taken:
- Identify a team of internal employees and/or external consultants who will build the physical security program through the following steps.
- Carry out a risk analysis to identify the vulnerabilities and threats and to calculate the business impact of each threat.
- Identify regulatory and legal requirements that the organization must meet and maintain.
- Work with management to define an acceptable risk level for the physical security program.
- Derive the required performance baselines from the acceptable risk level.
- Create countermeasure performance metrics.
- Develop criteria from the results of the analysis, outlining the level of protection and performance required for the following categories of the security program:
- Deterrence
- Delaying
- Detection
- Assessment
- Response
- Identify and implement countermeasures for each program category.
- Continuously evaluate countermeasures against the set baselines to ensure the acceptable risk level is not exceeded.
