Physical Security By Nathan Conroy COSC

Outline Purpose of physical security Two types of physical security Different types of security devices Layers of security Conclusion

Purpose Preventing and protecting against physical intrusions Virtual security is useless if someone can just walk in and take what they want Both internal and external threats – Internal: employees physically intruding – External: anyone outside the scope of the company – Internal are typically more dangerous

Two Types of Physical Security Preventative – Meant to restrict access – Gates, locks, security guards, etc. – Also includes deterrent measures Restorative – Meant to restore status of systems if preventative measures do not work – Security cameras, access logs, etc. – Find out who did it – Mitigate damage

Two Types (cont.) Many security features can serve both purposes – ID scanners Physically prevents someone without access entrance Keeps log of who attempted to access – Security camera CCTV and IP cameras Can be used in a security room Often used in real time Can be used to view who was in a secure room at a certain time

Security Policies Policies are possibly the most important part of security – Must be strong and must be enforced – Lacking in either of these will lead to problems They are also the easiest way to protect valuable electronics if done right Only allowing IT staff access to server rooms, etc. is a good start Make employees report when their ID cards are stolen or misplaced, particularly IT staff

Security Cameras Closed-Circuit TV (CCTV) – CCTV captures and records analog video and sound – This is recorded on tapes for possible future use – Still very common in many workplaces, however... IP Cameras – Becoming much more prevalent – Transmit video and sound through the local internet – Easy to use and very mobile – Almost all can record in HD

Advantages of IP Cameras Higher quality than CCTV cameras Video can be broadcast over the internet outside of the internal network Storage is not nearly as bulky – No special tapes – But this does mean that there needs to be a secure server for video and audio protection Much easier set-up than CCTV More likely to see advances in IP cameras than in CCTV Some IP cameras allow the viewer to interact with those in the cameras view via voice

Individual IDs All companies have some sort of employee identification system Can be as simple as username and passwords for factory workers Typically an ID badge for most employees – Either a magnetic stripe card or a “proximity card” Biometric security: fingerprint, retina, iris, and voice scanners More secure areas will require multiple forms of identification

ID Badges Magnetic stripe cards require the card be run through a scanner – Most common, used on credit cards, iCards, etc. – Scanner reads the magnetic stripes Proximity cards – Can hold more data than magnetic stripe cards – Passive vs. active cards Passive: lower range, most common Active: require a battery, used in vehicles – Passive cards require a reader which is constantly emitting a signal When in range of a reader, the card will react to the signal from the reader and transmit its information

ID Badges (cont.) Badges can be customized greatly – May only grant access to certain doors – Can only access at certain hours E.g. only from 7AM to 6PM They can log when they are used – This is part of restorative security Very handy, but also easy to lose – Can be bad if they fall into the wrong hands

Fingerprint Scanning Optical – An image of the fingerprint is captured using visible light – Problem: very susceptible to damage to the scanner or a dirty fingerprint Ultrasonic – An image is created using ultrasonography Ultrasonography uses very high pitched sound waves to penetrate the initial layer of skin – The layer under the first layer will have the same pattern – Thus the fingerprint will be much more accurate since it also ignores any substances on the fingerprint

Iris Scanning Uses a camera which captures visible and infrared or near-infrared light The camera takes a high-contrast picture of your entire eye and focuses on: – Center of the pupil – Edge of the pupil – Edge of the iris – The eyelids and eyelashes The pattern in the iris is then analyzed Over 200 patterns can be analyzed, far more than a fingerprint

Layers of Physical Security Ground entrance – Gates, fences, security guards Building entrance – Generally just an employee badge Individual room entrance – ID badge, biometric scanners Individual items – Safes for backups, lock-and-keys for individual computers or servers Each one can have multiple layers within itself – E.g. a military base

Other Measures “Crime prevention through environmental design” – Designing a building to increase its security – Make all entrances well lit – Place critical infrastructure in well watched areas

Conclusion Two types of security: preventative and restorative Most security can serve both purposes Security is costly, but worth it Policies can make or break security

Sources Talbot, Julian & Jakeman, Miles (2011). Security Risk Management Body of Knowledge. John Wiley & Sons. pp. 72–73. Deutsch, William. "Increased Visibility Means Increased Security." AboutMoney. N.p., n.d. Web. 12 Nov "Natural Surveillance." County of Henrico. N.p., n.d. Web. 12 Nov "Chapter 1: Physical Security Challenges". Field Manual : Physical Security. Headquarters, United States Department of Army Jeffery, C. R. "Crime Prevention Through Environmental Design." NCJRS. N.p., Web. 12 Nov "IP Camera -vs- CCTV Security Systems PROs / CONs." EBay. N.p., 20 Feb Web. 12 Nov Norman, Thomas L. (2011). Electronic Access Control. Elsevier. pp. 57–58.