Chapter 6 - 02 - Discuss Various Physical Security Controls - 01_ocred.pdf

Certified Cybersecurity Technician Network Security Controls — Physical Controls Exam 212-82 Module 1 Understand the Importance of Physical Security 2 Discuss Various Physical Flow Security Controls 3 Describe Workplace Security 4 Describe Various Environmental Controls Discuss Various Physical Secu...

Certified Cybersecurity Technician Network Security Controls — Physical Controls Exam 212-82 Module 1 Understand the Importance of Physical Security 2 Discuss Various Physical Flow Security Controls 3 Describe Workplace Security 4 Describe Various Environmental Controls Discuss Various Physical Security Controls This section explains various physical security controls that can be used in organizations. Module 06 Page 625 Certified Cybersecurity Technician Copyright © by EG-Council All Rights Reserved. Reproduction is Strictly Prohibited. Certified Cybersecurity Technician Network Security Controls — Physical Controls Exam 212-82 Types of Physical Security Controls o Preventive Controls Q o Prevent security violations and enforce various access control mechanisms QO Examples include door lock, security guard, and other measures Detective QO Detect security violations and record any intrusion attempts Controls O Examples include motion detectors, alarm systems and sensors, video surveillance, and other methods Deterrent Controls O Used to discourage attackers and send warning messages to the attackers to discourage intrusion attempts QO Examples include various types of warning signs Recovery QO Used to recover from security violation and restore information and systems to a persistent state Controls O Compensating Controls Examples include disaster recovery, business continuity plans, backup systems, and other processes 0 Used as an alternative control when the intended controls failed or cannot be used O Examples include hot sites, backup power systems, and other means Copyright © by EC-{ L All Rights Reserved. Reproduction is Strictly Prohibited Types of Physical Security Controls Physical security application. following. Based controls are categorized on their functionality, based the types on their functionality of physical security and control the plane include of the Preventive Controls These controls prevent security violations and enforce various access control mechanisms. Preventive controls may be physical, administrative, or technical. Examples include door locks and security guards. Detective Controls These controls detect security violations and record any intrusion attempts. They act when preventive controls fail. Examples include motion detectors, alarm systems and sensors, and video surveillance. Deterrent Controls These controls may not prevent access directly. They are used to discourage attackers and send warning messages to them to discourage an intrusion attempt. Examples include various types of warning signs. Recovery Controls These controls are used in serious situations to recover from security violations and restore information and systems to a persistent state. Examples include disaster recovery, business continuity plans, and backup systems. Module 06 Page 626 Certified Cybersecurity Technician Copyright © by EG-Council All Rights Reserved. Reproduction is Strictly Prohibited. Certified Cybersecurity Technician Network Security Controls — Physical Controls = Exam 212-82 Compensating Controls These controls are used as alternatives when the primary controls fail or cannot be used. They do not prevent any attack attempt but attempt restoration using techniques such as restoring from a backup. Examples include hot sites and backup power systems. Based on the plane of application, the types of security controls include the following. * Physical security controls such as doors, secure facilities, fire extinguishers, and flood protection * Administrative security controls such as the organization’s guidelines to provide information security * Technical security controls such as IDSes/IPSes, firewalls, and authentication systems Module 06 Page 627 policies, procedures, and Certified Cybersecurity Technician Copyright © by EG-Council All Rights Reserved. Reproduction is Strictly Prohibited. Certified Cybersecurity Technician Network Security Controls — Physical Controls Exam 212-82 Location Considerations Visibility of assets Neighboring buildings Local considerations Impact of catastrophic events Joint tenancy risks L All Rights Reserved. Reproduction is Strictly Prohibited Location Considerations Organizations should consider various factors that may to buy or lease a building. The factors to consider may buildings, joint tenancy risks, power and water supply, private roads, transportation, emergency support, fire affect physical security before planning include the facility location, neighboring sewage systems, proximity to public and stations, hospitals, airports, local crime or rate of riots, and prior security incidents in the surrounding area. The location should not be prone to natural disasters such as floods, tornadoes, earthquakes, hurricanes, excessive snow or rainfall, mudslides, and fires. Module 06 Page 628 Certified Cybersecurity Technician Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited. Certified Cybersecurity Technician Network Security Controls - Physical Controls Exam 212-82 o Identify what are the critical infrastructures o Have a separate location for the server and storage room o Identify what safety measures are required for these systems C Have emergency exits 0D Make plans to manage environment hazards 0D Define who will be responsible for managing these systems 0O Establish procedures explaining how they should be protect ed 0 Use a proper sanitation system such as manholes, sewers etc. C Site Architecture Considerations | Keep parking away from the main building Copyright © by EC Al Rights Reserved. Reproductionis Strictly Prohibited Site Architecture Considerations After gaining adequate information about the facility locati on, the planning and designing of the internal infrastructure and architecture should be perfo rmed. While planning and designing the site architecture, an organization should prepare a list of all of its assets in the facility. The organization should consider the following points while designing the infrastructure and architecture. Decide the number of entrances required for the building, including the main entrance, staircase, parking, lift, hallway, and reception area. Find the neighboring facilities around the site locati on and check the internal and external architecture for them. Talk to the supervisors or owners of the buildings to gain additional insights about the surroundings. Analyze the assets that can be impacted by catastrophic failures as well as the visibility of assets to outsiders. Consider the joint tenancy factor; if the facility is shared with other companies, consider their impact on the organization’s sensitive information and critical assets. Identify the necessary critical infrastructure that is requi red for managing the physical security, storing sensitive data, and running business opera tions effectively. Design separate security zones to place critical components and equipment deep inside the premises without any direct contact with entry doors, compound walls, and windows. Establish a demilitarized zone (DMZ) between highly secure infrastructure and publicaccess areas. Module 06 Page 629 Certified Cybersecurity Technician Copyright © by EG-ounc il All Rights Reserved. Reproduction is Strictly Prohibited. Certified Cybersecurity Technician Network Security Controls - Physical Controls Exam 212-82 Ensure a separate location for the server and storage room. Identify what safety measures are required for these systems. Use security labels and warning signs wherever necessary to make visitors understand that tight security is implemented within the premises. Ensure that public areas having high accessibility are under complete and simplified surveillance. Implement emergency exits. Make plans to manage environmental hazards. Define who will be responsible for managing these systems. Establish procedures explaining how they should be protected. Use a proper sanitation system including manholes and sewers. Keep parking away from the main building. Communicate physical security control procedures and policies with the employees, tenants, stakeholders, and administration to minimize physical security threats such as insider theft, fraudulent activities, and collusion. Restrict the movement of people between different zones. These critical infrastructure systems may not use standard IT for safety, performance, and reliability, but they are critical to business operations. An improper or faulty implementation of certain physical measures such as electricity, backup, storage facilities, lighting, wiring, and cooling systems can be critical to the business operations of the organization. Module 06 Page 630 Certified Cybersecurity Technician Copyright © by EG-Council All Rights Reserved. Reproduction is Strictly Prohibited.