Bringing It All Together

Now that you understand the various threats to physical security and the tools and countermeasures available, let’s consider where these controls may need to be implemented and supported.

At the perimeter, which may include adjacent buildings or grounds, parking lots, and possibly a moat - well, that’s a stretch - physical security threats may include fire, water, vibration and movement, severe weather, sabotage and vandalism, and loss of communications or utilities.

And, of course, you were involved in the initial site selection and facility design planning when your building was built so you have no problem securing the perimeter, right? Well, for the other 99 percent that weren’t so fortunate and have to address physical security in a preexisting location and facility, begin by assessing what threats are most relevant and how to mitigate associated risks. Consider recommending physical security controls at the perimeter such as fencing, security guards, dogs, surveillance, and alarms, when applicable. If these controls already exist, ensure that they are adequate and assessed regularly. If physical security is not part of your responsibility, ensure that you have a good working relationship with whoever is responsible. Know who to call in an emergency (fire, police, and utilities) and don’t be a stranger - establish working relationships with these professionals before you need their help! Recommend appropriate security technologies that support physical and environmental security controls.

Interior security deals with . . . the inside of your facility! Many of the same physical security threats that affect the perimeter also affect the interior, but often in very different ways. A fire can be a far more life-threatening emergency inside a facility. Water damage may come from sources other than a flash flood, such as your own fire suppression system.

Again, under ideal circumstances, your employer’s interior designer consulted with a CISSP, but more often than not, you’ve got some work to do in this area as well! Consider the various aspects of the facility when recommending and supporting interior controls. These include the interior walls, ceilings, floors, doors, and storage areas. And don’t forget the lighting, electrical wiring, physical cabling, ventilation systems, and pipes.

Various controls for interior security may include locks, restricted areas, security badges, biometric access controls, surveillance, intrusion detection, motion detectors, alarms, and fire detection and suppression systems.

Operations/facility and equipment security will involve addressing many of the same threats as interior security and supporting many of the same security controls and countermeasures, but with a specific focus on how these threats may adversely affect your business and computer operations. Administrative controls, such as designating restricted areas, visitor policies, audit trails and access logs, and asset classification and control, are particularly important.