In this lesson,
we're going to talk about some physical security controls
that you can use as remediations
against vulnerabilities found during your penetration tests.
Often, you're going to find that physical access
is a lot easier to achieve than getting remote access
because a lot of organizations
will fall for social engineering attacks
as well as having their facilities open to visitors,
which then can be another source of attack.
To overcome the different physical security vulnerabilities
you identified during your penetration test,
you're going to make recommendations
that concern physical controls to your target organization.
Some physical security controls that you can use
are things like access control hardware,
like badge readers and biometrics,
as well as access control vestibules, smart lockers,
locking racks, locking cabinets, employee training,
and video surveillance.
When it comes to access control hardware,
we are usually going to rely on either a badge reader
or a biometric reader to control access
to a secure telecommunications closet or data center.
A badge reader is going to rely on either a magnetic strip,
like a credit card, a chip card, like a smart card,
or an RFID, or radio frequency ID card.
In general, it's going to be a great practice
to require all your employees
to wear an identification badge within your buildings.
This badge is then used to unlock an electronic lock
on the different doors of your data center
or other secured spaces
in combination with some kind of a knowledge factor,
like a PIN that's unique to that employee.
By doing this,
we now have a two-factor authentication system:
something you have (your badge)
and something you know (your PIN).
Some of these locks can also choose
to use a biometric authentication instead of a badge.
For example, I've seen some data centers
protected by a fingerprint reader, a retina scan,
or a voice print and a PIN.
Again, by adding the pin to the biometric factor,
we're gaining two-factor authentication
and making our data center much more secure.
In high-security facilities,
they also use an access control vestibule
in combination with an access control hardware or lock.
An access control vestibule is also known as a mantrap.
An access control vestibule is an area between two doorways
that holds people
until they are identified and authenticated.
Sometimes, these are automated,
like using an electronic badge and PIN system
that we just discussed,
but sometimes they're actually manned
by a security personnel
who's going to physically look at your badge
to verify you are who you claim to be.
So as you enter the building,
there might be an open lobby that anyone can access,
but then there's this set of turnstiles
where you're going to scan your badge
and enter your PIN number.
This will allow you to go past those turnstiles
and get into the building.
This area between the front door and the turnstiles,
that is considered the access control vestibule.
Once you get past that turnstile,
you're now in the secure area,
and you've already been authenticated,
and now you can be trusted.
In some organizations,
they instead opt to have less security at the main floor,
and instead, they're going to use access control vestibules
located at key choke points throughout the building
as you go into certain higher security areas
of the building.
Sometimes, you may have both the mantrap
at the entrance of the building
that everyone goes in who works in that facility,
but then you have an additional access control vestibule
going into a higher security area,
such as your data center.
In this case, the first access control vestibule
at the main entrance of the building
gives you access to generic level
of organizational security,
but then, you need to go into a top-secret area,
you then need to go through a second verification
at another access control vestibule.
Next, let's talk about personal electronic devices.
A lot of organizations prevent the use
of personal electronic devices like cell phones,
smart phones, and tablets inside their office spaces.
This is done as a form of data loss prevention.
After all, if I can simply carry my smartphone with me
into a top-secret building,
I can take pictures of some highly classified documents
from my computer screen,
and then those documents could walk
right out the front door with me on my cell phone.
This would not be very secure.
So, in these organizations,
they're usually going to be located
in something like a government or military building,
and they're going to place a smart locker in the entrance
right before the access control vestibule.
This way, you can drop off your cell phone
and lock it up securely in the smart locker.
Now, a smart locker is a fully integrated system
that looks a lot like a large vending machine.
Basically, you're going to scan your employee badge
at the smart locker on a digital badge reader.
Then, you pick an open locker from the display screen.
And once you select it,
that is going to unlock and open up that locker.
You then put in your laptop, your tablet, your smartphone,
your smart watch, or other valuables inside the locker,
and once you shut the door to the locker,
it automatically is going to lock
and you can go about the rest of your day.
Whenever you need to get your things back,
you go back to the display screen,
click open locker, and scan your badge.
At that point, the locker will unlock again
and you can retrieve your items from the locker.
Next, let's talk about protecting the things
that are inside of our data center.
Now, once we get inside of our data center
or telecommunication closets,
you're going to see racks or cabinets
that contain the different networking equipment
and servers that we're going to use.
A standard server and networking equipment rack
is about 48 units high, also known as 48U.
This is also about 50 inches deep and about 20 inches wide.
These can house networking equipment
like switches and routers, patch panels, servers,
rack-mounted uninterrupted power supplies, and much more.
To protect these devices from being tampered with,
these racks and cabinets may contain a small key lock.
By locking these racks and cabinets,
you can control physical access to your equipment.
Generally, one person will be the key custodian
for the data center,
and that person will also maintain a log
of who has which keys and when,
in case that information is needed
during an incident response.
Finally, we need to talk about
the most beneficial prevention mechanism that you have
that you can invest in, and this is employee training.
According to a study by Forrester Research,
providing employee cybersecurity awareness training
produced a 69% return on investment
for small to medium sized companies,
and a 248% return on investment
for large enterprise organizations.
The data supports it.
Employee training is a great investment.
This is particularly true
because the biggest weakness in our networks is our users
and the administrators, because both of these people
are going to use and run our networks,
and they're going to cause a lot of problems for us
if they're not trained properly.
If an administrator misconfigures a device, for example,
that creates a vulnerability
that could be exploited by an attacker.
If an end user clicks on a link in a phishing email,
they can cause the organization to get infected malware
and spend a lot of time and effort cleaning up this mess
during an incident response.
When you're conducting your employee training,
it's important to stress
the proper policies and procedures
that the employees need to follow
in regards to both their physical security,
such as challenging personnel to show their employee badges
or questioning why certain people
are trying to access certain areas,
and technical security,
such as malware prevention and anti-phishing training.
The final physical control
we need to discuss is the use of video surveillance.
Video surveillance is a great way to use a detective control
to figure out what has happened in a particular area.
These cameras can be either wired or wireless,
and they can either be fixed or movement-based,
depending on how you configure them.
The one thing you have to be aware of
when using wireless based cameras
is that those wireless cameras
can be attacked by an attacker
by jamming their wireless signal.
For this reason,
it is much better to use wired cameras
instead of wireless cameras for your security system
as you're implementing video surveillance.