Is your physical protection system secured?

Introduction:

Virtually all organisations are secured by some form of physical protection system (PPS). From a small business to an international enterprise, all assets are at risk if their PPS are vulnerable.

Why?

What are the reasons for organisations to care about their PPS' security? Examples:

1. Reduce legal liabilities in case of loss

2. Mitigate against cyber risks for many incidents begin with a physical breach

3. Boost staff morale and productivity by preserving their safety and peace of mind

4. Strengthen client and investor confidence in the business' long term viability

5. Ensure overall physical security effectiveness

What to do?

PPS usually consists of three subsystems: Access Control, Video Surveillance, and Intrusion Detection. Subsystems' main components are listed below supplemented with some baseline security measures.

Access Control System:

1. User credentials (e.g.: access card, PIN, or smartphone)

   1. Educate users on safeguarding their assigned credentials.

   2. Implement procedures on issuance, return, and loss.

   3. Review credential technology annually.

2. Credential readers

   1. Secure reader installation with anti-tampering screws.

   2. Implement procedures on regular visual inspection and routine maintenance.

   3. Install tampering switch to detect unauthorised dismantling.

3. Backend access panels

   1. Secure panels within locked metal cabinet equipped with tampering switch.

   2. Implement procedures on applying latest firmware and/or patches.

   3. Implement procedures on updating login password regularly.

Video Surveillance System:

1. Security cameras

   1. If possible, arrange camera layout where each camera's phyiscal location is covered by another camera.

   2. Implement procedures on updating login password regularly.

   3. Implement video footage tampering reporting measures (e.g.: physical blocking, signal loss, or view angle change)

2. Network switches

   1. Secure switches within locked server rack that is located within secured room.

   2. Implement procedures on updating login password regularly.

   3. Implement network access control to prevent and report unauthorised access.

3. Video recorders

   1. Secure recorders within locked server rack that is located within secured room.

   2. Implement procedures on updating login password regularly.

   3. Implement procedures on operating system and application patching regularly.

Intrusion Detection System:

1. Intrusion detection sensors (e.g.: motion sensors, door contacts, or seismic sensors)

   1. If possible, install sensors on the secured side of the environment. For example, installing door contact on the secured side of the door.

   2. If sensors are network based (a.k.a. IOT), implement procedures on updating login password regularly.

2. Backend alarm panels

   1. Secure panels within locked metal cabinet equipped with tampering switch.

   2. Implement procedures on applying latest firmware and/or patches.

   3. Implement procedures on updating login password regularly.

General components:

1. System server & workstation

   1. Secure component within access controlled room.

   2. Implement procedures on operating system and application patching regularly.

   3. Implement procedures on updating login password regularly.

   4. Implement procedures on reviewing user access at least annually.

2. PPS documentations

   1. Ensure drawings (e.g.: layouts, schematics, and elevations) are maintained

   2. Ensure equipment inventory are maintained

   3. Ensure network related information (e.g.: IP/MAC addresses) are maintained

3. Physical keys

   1. Ensure all keys are tagged with useful information without identifying associated lock

   2. Implement procedures to review keys issuance regularly

Bottom Line:

Optimal security requires dedication from the business. What is worst than lack of security would be a false sense of security. As a business leader, you are duty bound to safeguard your company's assets and people. Talk to a trusted security professional either internally or externally on how to start (tips: policy support).