In this lesson,
we're going to discuss the importance of physical security
to our network security.
After all,
if an attacker can touch your networking equipment,
such as your switches, your routers, your firewalls
and other devices,
they could change your configurations
or completely bypass the devices
by patching around them with patch cables.
So, as we move through this lesson,
we're going to cover both detection and prevention mechanisms
that you can use to protect your network
and its critical equipment.
First, we're going to start with detection mechanisms.
Things like cameras, motion detectors,
asset tags and tamper detection.
When it comes to detection mechanisms
and detective controls,
we're going to be talking about security controls
that are used during an event
to find out whether or not,
something malicious may have happened.
Detection controls are going to be useful in determining
if something happened,
but only after the fact.
These type of controls won't stop something from happening,
but they can provide a method to log it
or identify if a piece of networking equipment
has remained under your control the entire time.
When it comes to cameras,
these are often mounted inside and outside of rooms
that contain your networking gear.
For example, you should have a camera point
at the entrance door to your main distribution frame,
your intermediate distribution frames,
your data center and your telecommunication closets.
When it comes to placing your cameras,
it's really important to understand
where your high value targets are,
and that way you can understand what you need to protect.
If you're pointing the cameras at the entrance or exits,
you'll be able to see when people enter
or leave a data center
or your various telecommunication closets.
In addition to this,
you may wish to have cameras covering the entrance
and exits to your building and your parking lot
to detect if anyone is out there parked
for a long period of time,
trying to connect to your wireless network
and be able to remotely access you from there.
By utilizing a closed circuit TV system or CCTV,
you can either actively monitor these doors
with a security guard or you record the video feeds
and play them back after a suspected incident.
This way, you can verify if anyone entered or left rooms,
containing your network equipment.
Surveillance cameras are going to come in many different types,
including both wired and wireless versions.
A wired camera allows the device to physically be cabled
from the camera all the way to a central monitoring station,
usually using a coaxial cable for analog solutions
or an unshielded twisted pair for digital solutions.
If you're instead using a wireless camera solution,
you don't have to run physical cables.
Instead, they're going to be easier to install,
but you do have some things you have to worry about,
such as interference
with other wireless systems like 802.11 wireless networks.
Also, if they're wireless
and an attacker could jam or break those signals,
they could prevent them from communicating
with the central monitoring station
and that way you wouldn't be able to see the video feed.
In addition to wired and wireless varieties,
there's also indoor and outdoor versions
of surveillance cameras.
If you're going to be monitoring the parking lot
or an external door,
you need to use an outdoor camera
that can withstand the elements like snow, wind and rain.
If instead,
you're going to be monitoring things contained inside
your building,
then you can choose an indoor camera,
because they're going to be a little bit lighter,
cheaper and easier to install.
Normally when a camera is mounted,
it's going to be put in one location
with a fixed field of view.
On some higher end models though,
you can purchase what's known as a PTZ camera.
Now, a PTZ means pan, tilt and zoom.
If you watch any bank heist movies,
you've probably seen these PTZ cameras used.
With these systems,
a security guard can move the camera
from a central monitoring station by panning,
moving it left or right,
tilting, moving it up or down,
or zooming by getting closer or further
with the field of vision,
all from a joystick at the control panel.
Another option to consider
is whether or not to purchase an infrared camera system.
Now, an infrared camera system
will display images based on the amount of heat in a room.
These are really helpful inside our data centers
and telecommunication closets for two reasons.
First, you can quickly and easily identify
where a person is inside a given room.
If an attacker manages to get themself into the data center,
they're not going to be able to hide from you,
because their body heat will create
a bright orange or red glow on an infrared camera.
Second, even if no one is in the room,
you can use an infrared camera
to identify hotspots in the room,
such as when a fan in a server rack isn't working anymore
and therefore heat starts building up.
Using this type of camera could be a way to detect gear
that may overheat before it actually overheats.
The final type of surveillance camera you can purchase
is known as an ultrasonic camera,
which is going to use sound-based detection.
If you've ever watched the "Mission Impossible" movies,
they had an ultrasonic system
that would sit there and listen.
Even if a pin was dropped on the floor,
it would be detected by the camera
at its super sensitive microphones,
then the guards could come and arrest the attacker.
On the other side of physical security,
we also have controls we put in place
to prevent things from happening.
Some prevention methods that we use
are things like access control hardware,
like badge readers and biometrics.
Access control vestibules, smart lockers,
locking racks, locking cabinets and employee training.
When it comes to access control hardware,
we usually are going to rely on either a badge reader
or a biometric reader to control access
to a secure telecommunications closet or data center.
A badge reader is going to rely on either a magnetic strip,
like a credit card,
a chip card like a smart card,
or an RFID or radio frequency ID card.
In general, it's going to be a great practice
to require all your employees
to wear an identification badge within your buildings.
This badge is then used to unlock an electronic lock
on the different doors of your data center
or other secured spaces
in combination with some kind of a knowledge factor,
like a pin number that's unique to that employee.
By doing this,
we now have a two-factor authentication system.
Something you have, your badge
and something you know, your pin.
Some of these locks
can also choose to use a biometric authentication,
instead of a badge.
For example, I've seen some data centers,
protected by a fingerprint reader,
a retina scan or a voice print and a pin.
Again, by adding the pin to the biometric factor,
we're gaining two factor authentication
and making our data center much more secure.
In high security facilities,
they also use an access control vestibule
in combination with an access control hardware or lock.
An access control vestibule
is an area between two doorways that holds people,
until they're identified and authenticated.
Sometimes these are automated,
like using an electronic badge and pin system
that we just discussed,
but sometimes they're actually manned
by a security personnel
who's going to physically look at your badge
to verify you are who you claim to be.
The most common placement of a man trap
is actually at the entrance to your office building.
So, as you enter the building,
there might be an open lobby that anyone can access,
but then there's this set of turnstiles
where you're going to scan your badge
and enter your pin number.
This will allow you to go past those turnstiles
and get into the building.
This area between the front door and the turnstiles,
that is considered the access control vestibule or man trap.
Once you get past that turnstile,
you're now in the secure area
and you've already been authenticated
and now you can be trusted.
In some organizations,
they instead opt to have less secure at the main floor,
and instead they're going to use access control vestibule,
located at key choke points throughout the building
as you go into certain higher security areas
of the building.
Sometimes you may have both at the entrance of the building
that everyone goes in who works in their facility,
but then you have an additional access control vestibule,
going into a higher security area, such as your data center.
In this case, the first access control vestibule
at the main entrance of the building gives you access
to a generic level of organizational security,
but then you need to go into a top secret area.
You then need to go through a second verification
at another access control vestibule.
Next, let's talk about personal electronic devices.
A lot of organizations prevent the use
of personal electronic devices like cell phones,
smartphones and tablets inside their office spaces.
This is done as a form of data loss prevention.
After all, if I can simply carry my smartphone
with me into a top secret building,
I could take pictures of some highly classified documents
from my computer screen,
and then those documents could walk right out the front door
with me on my cell phone.
This would not be very secure.
So, in these organizations,
they're usually going to be located
in something like a government or military building
and they're going to place a smart locker in the entrance,
right before the access control vestibule.
This way, you can drop off your cell phone
and lock it up securely in the smart locker.
Now, a smart locker is a fully integrated system
that looks a lot like a large vending machine.
Basically, you're going to scan your employee badge
at the smart locker on a digital badge reader.
Then you pick an open locker from the display screen,
and once you select it,
that is going to unlock and open up that locker.
You then put in your laptop, your tablet, your smartphone,
your smartwatch or other valuables inside the locker
and once you shut the door to the locker,
it automatically is going to lock
and you can go about the rest of your day.
Whenever you need to get your things back,
you go back to the display screen,
click Open Locker, and scan your badge.
At that point, the locker will unlock again
and you can retrieve your items from the locker.
Next, let's talk about protecting the things
that are inside of our data center.
Now, once we get inside of our data center
or telecommunication closets,
you're going to see racks or cabinets
that contain the different networking equipment
and servers that we're going to use.
A standard server and networking equipment rack
is about 48 units high, also known as 48U.
This is also about 50 inches deep and about 20 inches wide.
These can house networking equipment,
like switches and routers,
patch panels, servers,
rack mounted undirected power supplies and much more.
To protect these devices from being tampered with,
these racks and cabinets may contain a small key lock.
By these racking cabinets,
you can control physical access to your equipment.
Generally, one person will be the key custodian
for the data center
and that person will also maintain a log
of who has which keys and when
in case that information is needed,
during an incident response.
Finally, we need to talk about
the most beneficial prevention mechanism
that you have that you can invest in
and this is employee training.
According to a study by Forrester Research,
providing employee cybersecurity awareness training,
produced a 69% return on investment
for small to medium sized companies
and a 248% return on investment
for large enterprise organizations.
The data supports it.
Employee training is a great investment.
This is particularly true,
because the biggest weakness in our networks is our users
and the administrators,
because both of these people are going to use
and run our networks
and they're going to cause a lot of problems for us
if they're not trained properly.
If an administrator configures a device, for example,
that creates a vulnerability
that could be exploited by an attacker.
If an end user clicks on a link in a phishing email,
they can cause the organization to get infected with malware
and spend a lot of time
and effort cleaning up this mess,
during an incident response.
When you're conducting your employee training,
it's important to stress the proper policies and procedures
that the employees need to follow
in regards to both their physical security,
such as challenging personnel to show their employee badges
or questioning why certain people
are trying to access certain areas
and technical security such as malware prevention
and anti-phishing training.