Page 625 - StudyBook.pdf

Operational and Organizational Security: Incident Response • Chapter 11 609

facility problems and determine what was needed in a new or renovated
facility, they appeared to ignore the specifications made by IT staff, and
forgot to include a server room and any locations for network equip-
ment. This happened not just once, but twice.
The cold, hard fact is that (unless there’s a problem) few people care
about the physical security of a server and other network equipment, so
it is up to IT staff to perform reviews. Part of the indifference lies in
advertising of “zero administration” and heightened security in oper-
ating systems (OSes), leading some people to believe that the need for
network administration and physical security has lessened. Another con-
tributing factor is that most people have computers and even home net-
works, so they consider themselves peers to the expertise of IT staff, and
feel they can effectively make these decisions that ultimately compromise
security. To help with these problems, policies should also be created that
include strict measures against those who compromise physical security.
However, while curbing these mindsets can be frustrating, the only
people-problem that IT staff can immediately fix is with themselves.
Because so much work can be done remotely, the physical presence of IT
staff visiting an offsite location is generally minimal. If a server is moved,
or the physical security of where it’s located is compromised, IT staff
won’t notice the problem until long after it has occurred. It is important
for routine reviews to be made of assets like servers and other network
equipment, inclusive to their locations in an organization, and whether
they are physically secure.

Access Control

Physical security is a way of controlling access, so that only authorized people can
gain entry to an area.Without access control, anyone can enter restricted locations
that contain vital equipment, data, or personnel. If an unimpeded person has mali-
cious intentions or causes accidental damage, the impact on people, data, and sys-
tems could be severe. Physical security is needed to manage who can and cannot
enter sensitive areas.
Identification is a common method of determining who has access to certain
areas. Badges, cards, or other IDs can be used to show that a person has gone
through the proper security channels, and has an established reason for being in a
particular location. For example, the identification may distinguish them as an
employee, visitor, or another designation.To obtain such an identification card, the
person would need to go through established procedures, such as being issued a
card upon being hired, or signing a logbook at the front desk.

www.syngress.com