- In this lesson 2.3,
we're gonna focus in on physical security.
So often, I've heard from cybersecurity practitioners,
it's like, "Oh physical security, that's not my job.
That's what building maintenance does
or building security does."
And I disagree.
I think physical security and environmental security,
that we're gonna talk about in the next lesson,
absolutely are our responsibility.
Because if our intruder, right?
Our threat actor, our adversary,
can get into secure areas,
into our wiring closets,
into our data centers
or manipulate our environmental systems
they can effectively own us or even destroy us.
So physical security, really important.
So we define physical security
as a protection of people, property
and physical assets from actions or events
that can cause damage, loss
or unauthorized activity.
Now, physical security is based
upon a layered defensive model
or defense in depth like we've talked about.
Now, the premise of a layered defense model is that,
if an intruder can bypass one layer of controls,
the next layer of controls
should provide additional deterrence
or detection capabilities.
So this should sound familiar.
Because it's very much what we talked about
in terms of control, categories and classifications.
In the physical world,
we have obstacles, detective controls
and response mechanisms.
Obstacles, which really think of them
as deterrent controls
are used to frustrate trivial attackers
and delay serious ones.
Detective controls make it likely
that an attack will be noticed
and response mechanisms are used to catch
or to impede attackers.
Now, physical security really starts
all the way back in the design phase.
Now we can always retrofit for physical security
but that's a little bit challenging and it can be expensive.
But if we keep physical security in mind
right from the very beginning,
we'll have a better outcome.
So I want to introduce you
to a really interesting premise called CPTED, C-P-T-E-D,
which stands for
Crime Prevention through Environmental Design.
And that's the idea that proper design
and effective use of a physical environment,
can lead to a reduction in the incident and fear of crime
and an increased safety.
And the CPTED concepts are extremely applicable
to physical cybersecurity.
Now, CPTED relies
on psychological and sociological responses
and there are really three constructs.
One, that people protect territory
that they feel is their own
and people have a certain respect
for the territory of others.
Second is that, intruders do not wanna be seen.
And third, limiting access discourages intruders
or marks them as intruders.
So when we're doing our physical design,
we wanna keep these things in mind, right?
The people will protect territory they feel as their own.
So if this is my space,
I'm gonna protect it.
And innately, right?
People have a certain respect
for the territory of others.
Insures definitely don't wanna be seen.
So we don't wanna give them a lot of hiding spaces, right?
And limiting access says,
"Okay well if you got in,
we know who you are."
And it marks them as intruders
if we haven't seen maybe that they have a badge on.
It's a really interesting area
if you go out and just to do a little research on CPTED,
I just think it's so interesting
how we have this convergence
between architecture and design
and physical security and ultimately cybersecurity.
Now, there are two modes
for physical security structure controls.
We have fail-safe and fail-secure.
Fail-safe implies that in an emergency or a fault situation,
controls will default to open or unlocked.
So if there was a problem in the building
all doors would open.
That would be a good example of fail-safe.
Fail-secure implies that an emergency controls
will default to closed or locked.
Again, emergency of some kind in the building.
Every door gets locked.
That's fail-secure versus fail-safe.
And we're gonna use these same terms
a little bit later on when we're talking
about some technical security components.
But for now, I want you to make sure
you know fail safe says the emergency or fault
all controls default to open whatever the open posture is
fail secure, they all will default
to closed or the locked posture.
Now, as I mentioned already
and I really wanna emphasize,
there is significant overlap
in physical and cybersecurity controls.
And here's an example for you.
Using picture ID badge
to identify oneself to security guards,
then we use the same card to swipe into the building.
And then that same card might lock,
log me into my computer with proximity technology
that automatically locks down the computer
when we walk away from the desk
and produces an audit trail
of your whereabouts and activities.
So more and more,
we're using a lot of the same tools and techniques,
we're having this convergence
of our cyber and physical security controls.
My preference in an organization is that,
both cybersecurity and physical security ultimately
report up to the same management structure
because we want to really encourage a working relationship,
a close working relationship between those departments.
So let's circle back to some design considerations.
Structural design can be used
to deter, prevent and detect unauthorized access.
So for example, in our data center, right?
When we cite our data center,
assuming it's not its own physical building, right?
It's inside another building,
we wanna it located in the center of a facility
with no external doors or windows, why?
Because we're trying to limit access control.
We want it located on floors other than the basement.
'Cause basement might be damp,
we might get flooding in the basement,
might be some access to the basement, right?
There's gonna be other equipment
for interference in the basement.
The first floor,
because the first floor is extremely accessible.
And the top floor, right?
We don't wanna be at the top floor
because we might get access from the ceiling
or we might get things like leaks or damage from storms.
We wanna make sure we have full walls,
they extend right from the floor all the way to the ceiling.
And we wanna have non partition ceilings.
Think about our elevators and stairwells
how we move around the building.
We can restrict access in a number of ways
including having a keypad code.
So you go up a stairway
and then to get into a particular floor,
you'd have to punch in the code
or an RFID card in an elevator, right?
Which the card access in which call buttons won't register
until that authorized card is detected.
And then the site level,
we have a whole array of security controls,
lighting signs, barriers and guards.
Lighting for personnel safety and for intruder deterrence
because intruders are less likely to enter a well-lit area.
We have signs for personnel safety and intruder deterrence.
Warning signs indicate surveillance
that somebody is paying attention, right?
Our intruders don't wanna be seen
and they don't wanna be found out.
Then we can have barriers such as walls,
fences, gates, bollards,
bollards extensions that you might see
maybe outside a mall
or to direct traffic in a certain way.
And then access control vestibules
to define the perimeter
and can be used to control or divert the flow of traffic.
Now an access control vestibules, really interesting
and we'll talk about that a little bit later on as well.
But just to give you a sense of what it is
I want you to imagine that,
you're trying to get into a building.
You come through the first door,
there's a vestibule that you're in,
you're evaluated,
maybe you have to do your biometric authentication.
That first door that just came in,
locked behind you,
you can't get into through the second door
which will take you into the building
until you've been authenticated.
We used to refer to those as a man trap.
We now refer to those as an access control vestibule.
And lastly, security guards or centuries
which may be stationed at checkpoints.
They patrol the area,
they manage surveillance
and they respond to breaches and or suspicious activity.
Very often there are first responders.
And of course,
every door is going to have a lock of some kind.
And there are four different types of locks
that you wanna be able to recognize.
Pick resistant, electronic smart, and biometric.
Now a pick resistant lock
is gonna have an extra set of tumblers.
So they're resistant to bumping
which is a really common way to be able to open a door.
And they have complex and difficult to reproduce keys.
An electronic lock
will either use a keypad or a card system.
And most of the time electronic locks
will automatically lock the door when they close behind you.
So think about being in a hotel
when you close the door,
that's an automatic lock
that door will close directly behind you
and then you use a card, right?
If you wanna get back in.
Smart locks connect via Bluetooth
or wifi or Z-wave to a smartphone for access control.
Smart locks can be
a part of a full system of video and audio monitoring
and a whole bunch of other cool IoT features.
And lastly, biometric locks.
Biometric locks are designed to grant access
based on a physiological trait.
So a finger scan, retinal or facial recognition.
And we'll talk more about biometric
little bit later on we'll talk
about the various different biometric markers
that can be used.
And then we have surveillance sensors.
Now these are sensors that are physical sensors
that are used to monitor and detect
suspicious, abnormal or unwanted behavior.
And there's just a whole array of them.
Passive infrared, motion, photometric
acoustical, contact, measure,
microwave and ultrasonic.
A passive sensor, sometimes referred to
as an IDS, IPS, a passive sensor
sense changes in heat signatures.
A motion sensor, census changes in movement,
a photometric change, sense changes in light.
Acoustical, just what it sounds like.
Census changes in noise.
A contact sense penetration or break
in an electrical circuit.
A pressure sensor changes in surface weight.
A microwave sensor movement
within an invisible field of energy
between the transmitter and the receiver.
And an ultrasonic is a proximity sensor
that measures the distance of a target
by emitting ultrasonic waves
and converting that reflective sound
into an electronic signal.
So all types of sensors that can be used
to monitor and detect suspicious, abnormal
or unwanted behavior.
That my friends brings us to a three second challenge.
Are you ready?
We've got five challenge questions coming right up.
Be sure to shut them out.
"Two-tier barrier with an entry on one side
and an exit on the opposite side."
I gave you its old name and its new name.
What's it called?
One, two, three.
It's gonna be an access control vestibule.
We used to call it a man trap.
We don't call it that anymore.
Question two, "Sensor that measures
changes in surface weight."
I just showed you all of those different types of sensors.
One, two, three,
it's gonna be a pressure sensor.
Number three, "Optimal location
within a building for a data center."
So where do we want that?
Optimal location within a building for a data center.
One, two, three, centered right in the building, right?
We want it right in the center,
not in the basement,
not on the first floor.
And then on the top floor,
not having external doors or windows,
right in the middle.
Number four, "Locks are designed to grant access
based on a physiological trait."
One, two, three.
And that's gonna be biometric.
And our last challenge, question number five.
"This mode implies that,
in an emergency or fault situation,
controls will default to open or unlocked."
You have two choices on this one.
What's it gonna be?
Which mode?
One, two, three.
That's gonna be fail-safe, right?
Brings us to a Security-in-Action case study
where you get to apply what you have just learned.
Let's read a case study together
then I'm gonna ask you a question
then you should put me on pause
and work through the answer
then come back and we'll do it together.
This is about a workplace intrusion.
An intruder was able to enter corporate headquarters
through a locked loading dock door
right past a security officer.
Now the intruder was wearing a delivery uniform
maybe FedEx or UPS or the Postal Service.
Now, outside of a clean room,
she unsuccessfully attempted to disable the CCTV camera.
That's a closed circuit TV camera.
Now, none of the IDS motion centers
indicated anything amiss in the hallway.
But a suspicious employee notified security
who initiated a fail-safe order.
What is your analysis of this situation?
So all of this happened.
What do you think?
What went wrong?
What went right?
What was good, what was bad?
What could have been improved?
Go ahead and put me on pause and write up your analysis.
Well, first of all,
there were several control failures.
The intruder successfully got into the building.
Now my guess is, right?
They used social engineering techniques,
they dressed as that delivery person.
Maybe they were carrying a lot of boxes, right?
So someone said, "Oh, that's UPS or FedEx
or the Postal Service, we gotta let them in."
And came and opened the door for them.
'Cause maybe they were carrying a lot of boxes
or they were wheeling them in.
So the intruder successfully used
those social engineering techniques to get in the building.
There was a CCTV system,
but it wasn't being monitored
because if it was being monitored,
the fact that the intruder was trying to disable that camera
somebody would've seen it.
Now, IDS motion centers in public spaces like a hallway
are generally not in use during business hours
because they would go off all the time, right?
So they should not have ever been relied upon
in this particular situation.
And fail safe, right?
Would've unlocked all exit doors
making it easy for the intruder to escape.
Now, on the other hand, right?
Maybe we didn't wanna go into fail-secure mode
'cause we locked everything down.
Maybe our intruder would've panicked, right?
And maybe there could have been some additional danger.
But fail safe opened every door
which means that made it easy to escape
but also maybe made it easy
for that intruder to get into secure places.
So it wasn't a very good idea.
Okay, so what was the good news in all this?
The good news was that an employee, right?
Saw something going on.
So saw something, said something, right?
The employee reported the suspicious activity.
And that's awesome.
And that's the thing we try to teach a lot
in our security awareness classes.
See something, say something.
So being able to analyze situations like this
and come to conclusions that will allow you
to have continuous improvement,
that my friends is definitely Security-in-Action.
All right, there's your word cloud.
You know what to do.
No moving on, until you can recognize
all of these terms on this word cloud.
And when you're ready,
I'll see you in the next lesson.