Information Security Chapter 9 Review Questions

What is a mantrap? When should it be used?

A man trap is a small enclosure that has separate entry and exit points with electronic and biometric keys. It should be used for high security areas for employees to gain access to facilities.

What is considered the most serious threat within the realm of physical security? Why is it valid to consider this threat the most serious?

Fire is the most serious physical security concern to the safety of the people who work in the organization. Fire accounts for more property damage, personal injury, and death than any other threat to physical security.

Why are guards considered the most effective form of control for situations that require decisive action in the face of unfamiliar stimuli? Why are they usually most expensive control to deploy? When should dogs be used for physical security?

Guards are considered most effective form of physical control because they possess the ability to apply human reasoning, unlike fences and walls that are specifically unresponsive to action or certain stimuli. They are educated with certain security procedures when a threat elevates. They are most expensive form of security because unlike technologies that only need technological maintenance and upgrade, they are required to be payed weekly. Dogs should be used when an organization is protecting valuable resources.

What is physical security? What are the primary threats to physical security? How are they manifested in attacks against the organization?

Physical security addresses the design, implementation, and maintenance of countermeasures that protect the physical resources of an organization. This means the physical protection of the people, hardware, and the supporting system elements and resources associated with the management of information in all its states: transmission, storage, and processing. The primary threats to physical security include the following: Inadvertent acts, potential acts of human error or failure, potential deviations in quality of service by service providers, and power irregularities. Deliberate acts - acts of espionage or trespass, acts of information extortion, acts of sabotage or vandalism, acts of theft, software attacks, and compromises to intellectual property; acts of God, forces of nature; technical failures technical hardware failures or errors and technical software failures or errors; and management failures In the physical environment, a potential act of human error or failure can be represented by an employee accidentally spilling coffee on his or her laptop computer. A compromise to intellectual property can include an employee without an appropriate security clearance copying a classified marketing plan. A deliberate act of espionage or trespass could be exemplified by a competitor sneaking into a facility with a camera. Deliberate acts of sabotage or vandalism can be physical attacks on individuals or property with the intent to sabotage or deface; deliberate acts of theft are perhaps the most common of these threats. Examples include employees stealing computer equipment, credentials, passwords, and laptops. Acts of God include lightning hitting a building and causing a fire. Quality of service deviations from service providers, especially power and water, also represent physical security threats. Technical hardware failures or errors and technological obsolescence both have common examples in physical security.

How does physical access control differ from the logical access control described in earlier chapters? How is it similar?

The difference between a logical and a physical control is that logical controls use software and data to monitor and control access to information and computing systems such as passwords, network and horde based firewalls and network invasion recognition systems. Physical controls monitor and control the atmosphere of the work place and computing services such as doors, locks, heating and air conditioning and video cameras. Both logical and physical controls are expressions of administrative controls in information security.

What is the most common form of alarm? What does it detect? What type of sensors are commonly used in this type of alarm system?

The most common form of alarm are burglar alarms that detect intrusions into unauthorized areas and notify either a local or remote security agency to react. The types of alarms used in this type of alarm system are motion detectors, thermal detectors, glass breakage detectors, weight sensors, and contact sensors.

What three elements must be present for a fire to ignite and continue to burn? How do fire suppression systems manipulate the three elements to quell fires?

The three elements required to spark up a potential fire are temperature (source of ignition), fuel and oxygen. Fire suppression systems manipulate this danger by detecting and responding to a fire, potential fire, or a combustion danger by denying the environment of any of the three elements required to ignite a fire.

Define a secure facility. What is the primary objective of the design of such a facility? What are some of the secondary objectives of the design of a secure facility?

A secure facility is a physical location that has in place controls to minimize the risk of attacks from physical threats. Primary objective of a secure facility is its location so it can use its natural terrain, local traffic flow, and surrounding development to enhance its physical security. A secondary objective would require protection with mechanisms such as fences, gates, walls, guards, and alarms.

List and describe the four categories of locks. In which situation is each type of lock preferred?

Manual Locks (Mechanical) - Most common form of locks that requires a physical key to unlock and gain access to. These locks can only be changed by highly trained locksmiths. Programmable Locks (Mechanical) - Requires a combination of buttons in order to unlock. This form of lock allows the owner to change this lock whenever he or she would like, allowing upgrade in security to be much faster. Electronic Locks (Electromechanical) - A kind of lock that can be integrated into alarm systems, sensors, and combined with other building management systems. The require battery back-ups to power the keypad to avoid power failure. Biometric Locks (Electromechanical) - The most sophisticated lock that requires the employee to scan their hand, face, finger print, face, etc.

Describe a physical firewall that is used in buildings. List the reasons you can think of for why an organization might need a firewall for physical security controls?

Physical firewalls isolate the physical spaces of the organization's offices.

What are the two possible modes that locks use when they fail? What implications does this have for human safety? In which situation is each more preferred?

The two possible modes that locks use when they fail are: Fail-safe lock - When the door lock fails and the door becomes unlocked. Usually used to secure an exit, where it is essential that in the event of, for instance, a fire, the door is unlocked. Fail-secure lock - When the door lock fails and the door remains locked. Usually used when human safety in the area being controlled is not the dominant factor. For example, in a situation in which the security of nuclear biological weapons needs security (meaning it is a security issue of greater magnitude) than protecting the lives of the personnel guarding the weapons.

What are the roles of IT, security, and general management with regard to physical security?

Three entities can play a part in physical security. The security department would have the most direct responsibility for the physical security program and would establish security policies, implement physical security systems, enforce security procedures, and investigate security breaches. The IT department is primarily responsible for computer and network security. However, many of today's physical security systems (cameras, card readers, etc.) are now network based and IT plays an increased role in the deployment and maintenance of these systems. The senior management of the company is ultimately responsible for the protection of the company's assets. Both the security department and IT department work to help senior management achieve this goal, but in the end, it is senior management's job to assure that the company's assets are secure.