If you would like to limit the access to a particular area
you might want to use a barricade or a bollard.
These are used to prevent people from accessing
a particular area or in the case of bollards
usually would prevent someone in a car or truck
from entering an area.
These can be used to restrict access temporarily
to a particular area, for example, there
may be construction going on and instead
of having people walk through the construction area,
you could surround it with barricades.
You could also use something like bollards,
which are these concrete poles which
are designed to stop large items from being
able to pass through an area.
This could be used as a concrete barrier
to prevent cars or trucks from entering a particular location.
And you could use a water feature such as a moat
to surround an area and that would
create a natural barricade.
If you've ever visited a highly secure data center then
you probably step through an access control vestibule.
There's usually a door providing access
to the vestibule and another door
providing access to the data center that's just beyond.
The configuration of the door locking mechanisms
will depend on the vestibule that you're using.
For example, it might be that all doors are normally unlocked
until one person opens a door.
And as soon as that door is open all
of the other doors in the vestibule
are locked automatically, or it could
be that all the doors are normally locked
and if you unlock one of those doors
it restricts any of the other doors
from being unlocked at the same time.
And it may be that these locking mechanism
is based on whether the doors open or not.
If someone opens the door it may restrict other doors
from being open at the same time.
This allows the person who's managing access to the data
center to control exactly who may be allowed access
through the vestibule and to limit how many people can pass
through at any particular time.
Here is the view from outside of an access control vestibule,
looks like you need to first authenticate to gain access
through the locked door.
Once inside you may have to provide
some type of identification to whoever may be sitting here
for security.
And then inside the room that security
would then open the second door and allow
you access to the data center.
Another type of physical security device
is an alarm system.
If you have an alarm system on a door or window you
know that the alarm goes off if that door happens to open
or the window is open, that's usually based on a circuit.
There's usually a sensor connected to the door or window
and if that door window moves then the circuit is broken
and the alarm goes off.
There are also motion detection that you
can get with certain alarms that will look for reflections
or some type of infrared motion and be able to alarm
if it happens to see either of those.
Your alarm system might also have a duress button,
sometimes this is called a panic button
if you feel the situation is threatening
and you want to be able to call for a third party you can push
the panic button and it will handle calling
for additional reinforcements.
It's always important to provide signage,
so that people know exactly what should
be expected from an area.
There may be certain types of protection that are required,
maybe a particular group of people
is allowed or not allowed on a location
and there may be a requirement to inform people
of a dangerous environment.
This is not only important for the people that
work in a particular area but you also
have to consider visitors who've never been in the area before
and know nothing of the requirements
or the potential danger of an area.
Signs for personal safety may provide information
about fire exits, there may be warning
signs that describe where there may be chemicals or other types
of construction going on.
And it may be useful to also point
people towards medical resources or first aid kits.
And although this sign doesn't have any contact information,
it might be useful to add some contact details here especially
if there are any emergencies.
If you have a very large facility,
you may want to consider adding video surveillance,
this is sometimes seen as a CCTV or closed circuit television,
especially if it's an environment that's
only accessible from that single facility.
The features that are enabled in these cameras
can also be important, some cameras
can constantly monitor an area but only
inform you if there happens to be
some type of motion detection.
Or there may be specific object detection
built into the camera that can recognize whether something
moving through the camera range is an automobile or a person's
face and be able to lock onto that
and track it as it moves from place to place.
Very often many cameras are installed in a single facility
and all of those cameras are brought back
to a single recording device.
From that device you can either monitor in real time
or be able to go back in time to see what
may have happened previously.
I visited probably hundreds of data centers
and it's remarkable how many of them
you may have driven by not realizing
that just inside that building was millions
of dollars of technology.
This is industrial camouflage, it's
concealing what would be an important facility behind what
is normally seen in a particular area.
If you're in an industrial area this looks like a building that
could be a warehouse, it might be a small workplace,
or it could possibly be a data center.
Of course, you wouldn't put signs
telling people that the data center is here
and looking at this there doesn't
seem to be any type of visual cue
that tells us that inside of this building is a data center.
I've visited data centers that have water features around them
to prevent people from gaining access
and they might have a guard gate in front that would prevent
someone from driving in.
If you ever look at a data center like this
you may even find that they're big planters in the front that
are actually bollards, very large concrete devices that
would prevent somebody from driving
into or through the walls of that building.
Although we can automate many aspects
of security one of the best physical security features
we have are people.
And we can put guards and access lists
in front of a facility to be able to have
a human interaction with who might be coming in.
This would provide a validation of existing employees
and allow them access to the building
and it would allow someone to provide authentication
of any guest that may be arriving and make sure
that they have the proper access to the facility.
In many environments you're required
to carry around an ID badge and display that badge
at all times, so that anyone walking by
can easily see that you are where you are supposed
to be in that building.
If there is a security guard, they
may be able to look at an access list
to confirm whether someone should have or not have access
to a particular part of that facility.
And if you're an employee you're probably
using that ID badge to unlock a door which of course will
create a log entry.
If you're a visitor, the security guard
is usually adding your name to a visitor logs,
so that everyone knows exactly who has gained access
to that facility.
If you've worked somewhere with security guards
you may have noticed that it's unusual to have
a single security guard working.
It's very common to see more than one
working at the same time, this is called two-person integrity
or two-person control.
This is a way to minimize the exposure you might have
especially for someone who is in control of access
to a building.
This two-person integrity ensures that no single person
would have access to any particular asset
in the building, for example, to enter
a locked area may require two separate security
guards to be present.
And in some facilities we can replace a human who's
doing rounds and checking things periodically with a robot,
this is an emerging technology but it's
one that allows us to replace the human with something that
is much more automated and then have our human guards perform
much more important tasks.
If you've ever gained access to a room
or through a locked door using a fingerprint or handprint then
you were using biometrics.
Biometrics can also be used for retinas, and voice prints
or anything that might be associated with an individual.
This is usually storing a mathematical representation
of something you are, so this might
store a mathematical representation
of your fingerprint and not the actual picture
of your fingerprint.
But of course your fingerprint is
something that is very difficult to change
and it's something that's also very difficult for someone else
to duplicate.
This means that, that particular mathematical representation
is something that could only be associated with you.
These biometrics are powerful physical controls
but they aren't foolproof.
We very commonly would combine biometrics
with some other type of authentication.
This particular biometric system requires
you to put in a biometric fingerprint
and then also include a personal identification number.
The secondary bit of authentication
is one that makes sure that the person is providing
the biometrics is the person who really should gain access
into that room.
And indeed there are many different ways
to control access through a door,
for example, a traditional lock and key is
one of the most common and well-known ways of locking
a facility.
This door might include a deadbolt
for additional security.
And if this is an office you may be using an electronic lock,
this could be a keyless lock like the one shown here
or it may require you to put in a personal identification
number.
There might also be locks that are based on a token,
this would be one that's associated with an RFID badge
like this one.
It could be a magnetic swipe card
or it might be a key fob that's connected to your key ring.
We've already seen that biometrics
can be used for door locks especially handprints
or fingerprints and in some cases,
you might even use a smart card with a personal identification
number to gain access through a locked door.
Here's the inside of one of those RFID badges,
you can see the antenna around the outside that
receives the power for the RFID and is able to send and receive
signals and on the inside of this is the RFID chip itself.
Cable locks are often used to prevent a piece of equipment
from being stolen in an area, these are usually
temporary locks but they're ones that
can be connected to almost anything around you.
For example, you may connect a cable lock to a laptop
and then connect the other end of that cable
to something sturdy that can't be moved
such as the leg of a table.
This is a standard type of connector
that has a reinforced notch and if you look at your laptop
you'll probably see on the side of it
that there is a notch that is perfectly sized to fit
one of these cable locks.
This is obviously not something that
is built for long-term protection
and you can see by the size of this cable
that it would not be very difficult for someone
to cut through with the right equipment.
But if you're in an area temporarily
and you simply want to prevent a piece of equipment
from being stolen while you happen to be working this
might be a great way to provide that level of security.
In a previous video we talked about an exploit
called Juice jacking--
this is where you're connecting your mobile device
like a mobile phone to a USB charging port.
That USB charging port is also transferring information
over the data lines as well.
And if your device is susceptible to this juice
jacking you may be unknowingly providing your data
to a third party.
This is why some people will use a USB data blocker
like this small cable here, which
connects to the USB interface but only connects to the power
lines of the USB connection and not the data connections.
And if you are someone who is traveling or needs access
to power in an area where normally you would not
be working it may be worth your while to bring along
your own power adapter and avoid this problem entirely.
Providing proper lighting is one of the best security
controls you can have, especially
in environments that need to be monitored 24 hours a day.
The attackers avoid any place that
may be lit, because they don't want to be seen.
It's easier to see exactly who might be in a particular area
if there's plenty of lighting and if you're
using cameras that don't use infrared then you'll
want as much lighting as possible to get
the best possible picture.
There are many different kinds of lighting
and many different ways to install these lights,
so you want to make sure that the lighting for an area
matches the requirements that you have for security.
You want to make sure you're providing enough light
levels for the cameras or the people who need
to be monitoring that area.
You also have to think about the lighting angles
especially if there are shadows and you're
doing some type of facial recognition.
This can be especially useful for cameras
that need to avoid any shadows and glare to be able to get
the best possible picture.
Although fences are very good ways to prevent someone
from gaining access to an area they
might also advertise that you have something in this area
that you don't want people to gain access to.
And it may be that you have to use different types of fences
depending on the security that you need.
If it's OK for people to be able to see into a particular area,
then you may want a fence that you're able to look through.
This of course also means that you're
able to look out to see who may be
on the other side of the fence.
But there may be times when people shouldn't have access
to be able to see what's on the inside and in those cases
you may want to use an opaque fence.
With the right kind of fence you have a very solid security
barrier, this is usually a fence that
might be very difficult to cut through
and usually they're tall enough to prevent somebody
from climbing over the fence especially
if you add razor wire or some other method
to prevent somebody from gaining access over this fence.
When we're putting together plans for physical security,
we're planning for the worst possible scenario.
And one of those scenarios might involve a fire, especially
a fire in an area with lots of electronics.
In that situation you wouldn't necessarily
want to use water but instead use some other type of fire
suppressant.
You'll first want some type of warning or alarm
that the potential for fire exists,
there may be a smoke detector, flame detector,
or heat detector that can tell you when this situation may
be occurring.
You may want to use water where appropriate,
especially if there isn't a lot of electronics.
But if there is something that is plugged into the wall
you may want to use chemicals.
We used to use halon for this method
but these days we use something that's a little better
for the environment, such as DuPont's FM-100
and this is a chemical fire suppression
that would be able to put out the fire in a data center
without completely destroying all of the electronics.
It's usually useful for the security team
to be informed or get an alert if something
is occurring in an area that they aren't actively watching.
We would commonly want to have sensors
that are deployed that provide us
with this type of information.
For example, you may want a motion detection sensor,
so that you could tell if anyone else happens
to be in a particular area.
This might also be combined with noise detection,
so that you could see if there are any noises occurring
in an area and recognize if any increase or decrease in sound
is occurring.
If you need to gain access to a room
there may be an electronic code reader
which has a sensor inside of that,
that recognizes the RFID chip that's in your access card.
You might also want to include moisture detection which
might tell you if there is a water
pipe that breaks and water begins flowing out
onto the floor.
You might be able to get a heads up very quickly
and prevent any further water damage.
If you're in a data center, one common sensor to have
is a temperature sensor especially when
you have all of this equipment that can very quickly heat up
the room.
It's nice to know if there happens
to be a spike or an increase in that temperature, which
may show you that there is a problem with the cooling
system in the data center.
Some security teams have started to use
drones to be able to monitor large areas especially
when those areas are places that would not be easy to access
through a car or by walking.
This might be a situation where there are multiple buildings,
and you could have a drone quickly cover a very large area
in a very short period of time.
These drones may not be used for constant security
but may be used for very specific situations.
For example, if you need to perform a site survey
or be able to assess the damage that may have occurred already
at a facility, a drone would be a great way to deploy
and be able to get a wide view of a particular area.
Mini drones include sensors that may show us
motion or any type of heat in an area and mini drones
include high resolution video, so that you're
able to get a recorded view of exactly what the drone was
able to see.
Some specialized environments may have a Faraday cage,
this is a method of signal suppression
that was originally created by Michael Faraday in 1836.
This is a mesh of conductive material
that either restricts or prevents
radio signals from traversing through this particular cage.
A good example of this is the window
on a microwave oven, which allows you to see in
but prevents any of those microwaves from getting out.
This is not a solution that blocks every type of radio
signal and there are some types of radio signals
that can't be blocked by a Faraday cage.
You also have to keep in mind that if you're blocking radio
signals you could be blocking the ability for someone
to call for help or call 911 on their mobile device.
So there always needs to be a way for someone to gain access
to a proper emergency service, even if you're
blocking those signals.
If you're working on an internal network
and you realize you have something
you need to provide access to people on the internet
you may not want those people getting
into the internal network of your organization.
In those cases, you may want to build
a separate physical network called a screen subnet.
We used to call this a demilitarized zone or a DMZ,
this is a network that does have controlled access usually
through a firewall and people coming in through the internet
would have access to the services that
are on the screen subnet.
But this would also prevent these people from the internet
from gaining access to your internal network.
So you can still keep all of your private resources private
and still provide access and resources
to the people that might need it from the internet.
In some very secure facilities we
have to think about the access that people
might have to the cabling and the fiber that
are running our networks.
This is a protected distribution system or PDS
and it usually requires that you have all of your network cables
and infrastructure behind some type of protected environment.
This means that all of your cables and fibers
that are on your networks may be inside
of a metal conduit, which would effectively prevent somebody
from gaining physical access to those cables.
This also means that someone wouldn't
be able to break a cable apart and put their own tap
in the middle effectively allowing them
access to all of the data that flows over that cable.
This might also prevent a denial of service,
because if you've got all of your cables
inside of this metal conduit no one
would be able to cut or modify any of those cables or fibers.
And to ensure the ongoing security of your protected
distribution system, it's very common
to have periodic audits to make sure
that nobody can gain access to your networking infrastructure.