Remerciez-le!

Remerciez @Admin pour avoir partagé cet document gratuitement, de la manière la plus simple, en partageant sur les réseaux sociaux.

EXAM CRAM CISSP PHYSICAL SECURITY PRINCIPLES & CONTROLS INTRODUCTION: CISSP EXA

EXAM CRAM CISSP PHYSICAL SECURITY PRINCIPLES & CONTROLS INTRODUCTION: CISSP EXAM DOMAINSDOMAINSWEIGHT 1. Security and Risk Management 15% 2. Asset Security 10% 3. Security Architecture and Engineering 13% 4. Communication and Network Security 14% 5. Identity and Access Management 13% 6. Security Assessment and Testing 12% 7. Security Operations 13% 8. Software Development Security 10% DOMAIN 3: SECURITY ARCHITECTURE & ENGINEERING 3.8 Apply security principles to site and facility design 3.9 Design site and facility security controls Exam Outline Wiring closets/intermediate distribution facilities Server rooms/data centers Media storage facilities Evidence storage Restricted and work area security Utilities and Heating, Ventilation, and Air Conditioning (HVAC) Environmental issues Fire prevention, detection, and suppression Power (e.g., redundant, backup) functional order of security controls Deterrence Denial Detection Delay physical security controls Physical security controls can be divided into three groups: Administrative also known as management controls and include policies and procedures, like site management, personnel controls, awareness training, and emergency response and procedures. Logical also known as technical controls and are implemented through technology like access controls, intrusion detection, alarms, CCTV, monitoring, HVAC, power supplies, and fire detection and suppression. Physical use physical means to protect objects and includes fencing, lighting, locks, construction materials, mantraps, dogs, and guards. physical security requirements Know the logical controls for physical security Technical controls for physical security include: - access controls - intrusion detection - alarms - CCTV and monitoring - HVAC - power supplies - fire detection and suppression physical security requirements Know administrative controls for physical security Administrative controls for physical security include: - facility construction - facility selection - site management - personnel controls - awareness training - emergency response - emergency procedure physical security requirements Know the physical controls for physical security Physical controls for physical security include: - fencing - lighting - locks - construction materials - mantraps - dogs - guards physical security requirements There is no security without physical security Without control over the physical environment, no amount of administrative or technical/logical access controls can provide adequate security. If a malicious person can gain physical access to your facility or equipment, they can do just about anything they want, from destruction to disclosure and alteration. FENCES 3-4 feet deters the casual trespasser 6-7 feet too difficult to climb easily may block vision (providing additional security) 8-feet (topped with barbed wire) will deter determined intruders Efficacyof fences by height PIDAS (perimeter intrusion detection and assessment system) will detect someone attempting to climb a fence. EXPENSIVE and may generate false positives Fence is a DETERRENT control PIDAS is a DETECTIVE control ELECTRICAL IMPACTS Blackout prolonged loss of power Brownout prolonged low voltage Fault short loss of power Surge prolonged high voltage Spike temporary high voltage Sag temporary low voltage Surge prolonged high voltage Spike temporary high voltage Sag temporary low voltage Brownout prolonged low voltage Fault short loss of power Blackout prolonged loss of power power loss inside the power meter is your responsibility ! lightingElements of effective lighting design should not illuminate the positions of guards, dogs, patrol posts, or other similar security elements. lighting used for perimeter protection should illuminate critical areas with 2 feet of candle power from a height of 8 feet light poles should be placed the same distance apart as the diameter of the illuminated area 20 feet of coverage means poles 20 feet apart TEMPERATURE AND HUMIDITY Humidity 40% – 60% ideal Temperature for computers ideal is 60-75F (15-23C), damage at 175F. Managed storage devices damaged at 100F Know ideal levels as well as effects of temperature and humidity humidity and static electricity Too much humidity can cause corrosion. Too little humidity causes static electricity. Even on nonstatic carpet, low humidity can generate 20,000-volt static discharge! “ fire and suppression agents The three categories of fire detection systems include smoke sensing, flame sensing, and heat sensing. Class A (ASH) fires are common combustibles such as wood, paper, etc. This type of fire is the most common and should be extinguished with water or soda acid. Class B (BOIL) – fires are burning alcohol, oil, and other petroleum products such as gasoline. They are extinguished with gas or soda acid. You should never use water to extinguish a class B fire. Class C (CONDUCTIVE) – fires are electrical fires which are fed by electricity and may occur in equipment or wiring. Electrical fires are conductive fires, and the extinguishing agent must be non-conductive, such as any type of gas. Class D (DILYTHIUM) – fires are burning metals and are extinguished with dry powder. Class K (KITCHEN) – fires are kitchen fires, such as burning oil or grease. Wet chemicals are used to extinguish class K fires. fire extinguisher classes Fire extinguishers and suppression agents Class Type Suppression material A Common combustibles Water, soda acid (a dry powder or liquid chemical) B Liquids CO2, halon, soda acid C Electrical CO2, halon D Metal Dry powder K Kitchen Wet chemicals fire extinguisher classes Class Type Suppression material A Common combustibles Water, soda acid (a dry powder or liquid chemical) B Liquids CO2, halon, soda acid C Electrical CO2, halon D Metal Dry powder K Kitchen Wet chemicals Fire extinguishers and suppression agents use water don’t use water ! damage from fire and fire supression The destructive elements of a fire include smoke and heat but also the suppression medium, such as water or soda acid. Smoke is damaging to most storage devices. Heat can damage any electronic or computer component. Suppression mediums can cause short circuits, initiate corrosion, or otherwise render equipment useless. All of these issues must be addressed when designing a fire response system. #1 concern is ALWAYS human safety! water suppression systems Preaction systems use closed sprinkler heads, and the pipe is charged with compressed air instead of water. The water is held in check by an electrically- operated sprinkler valve and the compressed air. Wet pipe systems are filled with water. Dry pipe systems contain compressed air until fire suppression systems are triggered, and then the pipe is filled with water; and flame activated sprinklers trigger when a predefined temperature is reached. Dry pipe systems also have closed sprinkler heads: the difference is the pipes are filled with compressed air. The water is held back by a valve that remains closed as long as sufficient air pressure remains in the pipes. Often used in areas where water may freeze, such as parking garages. Deluge systems are similar to dry pipes, except the sprinkler heads are open and larger than dry pipe heads. The pipes are empty at normal air pressure; the water is held back by a deluge valve. good for areas with people + computers water and electricity do not mix! gas discharge systems Usually more effective than water discharge systems, but should not be used in environments where people are located, because they work by removing oxygen from the air. Halon is effective, but bad for environment (ozone-depleting), turns to toxic gas at 900F. Suitable replacements include: • FM-200 (HFC-227ea) • CEA-410 or CEA-308 • NAF-S-III (HCFC Blend A) • FE-13 (HCFC-23) • Argon (IG55) or Argonite (IG01) • Inergen (IG541) • Aero-K Electromagnetic interference • Common mode noise. Generated by the difference in power between the hot and ground wires of a power source operating electrical equipment • Traverse mode noise. Generated by a difference in power in the hot and neutral wires of a power source operating electrical equipment Radio frequency interference (RFI) is the source of interference that is generated by electrical appliances, light sources, electrical cables and circuits, and so on. voltage and noise Static Voltage Possible Damage 40 Destruction of sensitive circuits and other components 1,000 Scrambling of monitor displays 1,500 Destruction of hard drive data 2,000 Abrupt system shutdown 4,000 Printer jam or component damage 17,000 Permanent circuit damage lock types Electronic Combination Locks (aka Cipher lock) Something you know Key Card Systems Something you have Biometric Systems Something you are Conventional Locks Easily picked / bumped & keys easily duplicated Pick-and-Bump Resistant Locks Expensive, harder to pick & keys not easily duplicated. Pin-tumbler locks are the world's most popular lock bumping requires no skill site design Site Selection Should be based on the security needs of the organization. Security requirements take precedence over cost and location. Location Proximity to other buildings and businesses? What kind of traffic do they draw? Is it on a hill or in a valley? Is there sufficient drainage? Visibility What is the surrounding terrain? Easy to approach by vehicle or on foot without being seen? be wary of elements that obscure visibility what types of natural disasters occur here? design elements that affect physical security facility design specifications Remember what types of locks can be picked or bumped Remember how high lights and fences need to be Know the different physical controls related to entry mantrapFor the exam… facility design specifications Remember what types of locks can be picked or bumped Remember how high lights and fences need to be Know uploads/Management/ cissp-guide.pdf