-: Physical Security. 2 2
In this lesson, we're going to discuss 3 3
the importance of physical security to our network security. 4 4
After all, 5 5
if an attacker can touch your networking equipment, 6 6
such as your switches, your routers, 7 7
your firewalls and other devices, 8 8
they could change your configurations 9 9
or completely bypass the devices 10 10
by patching around them with patch cables. 11 11
So, as we move through this lesson, 12 12
we're going to cover both detection and prevention mechanisms 13 13
that you can use to protect your network 14 14
and its critical equipment. 15 15
First, we're going to start with detection mechanisms, 16 16
things like cameras, motion detectors, 17 17
asset tags, and tamper detection. 18 18
When it comes to detection mechanisms 19 19
and detective controls, 20 20
we're going to be talking about security controls 21 21
that are used during an event 22 22
to find out whether or not something malicious 23 23
may have happened. 24 24
Detection controls are going to be useful 25 25
in determining if something happened, 26 26
but only after the fact. 27 27
These types of controls won't stop something from happening, 28 28
but they can provide a method to log it 29 29
or identify if a piece of networking equipment 30 30
has remained under your control the entire time. 31 31
When it comes to cameras, 32 32
these are often mounted inside 33 33
and outside of rooms that contain your networking gear. 34 34
For example, you should have a camera 35 35
point at the entrance door to your main distribution frame, 36 36
your intermediate distribution frames, 37 37
your data center, and your telecommunication closets. 38 38
When it comes to placing your cameras, 39 39
it's really important to understand 40 40
where your high value targets are, 41 41
and that way you can understand what you need to protect. 42 42
If you're pointing the cameras at the entrance or exit, 43 43
you'll be able to see when people enter 44 44
or leave a data center 45 45
or your various telecommunication closets. 46 46
In addition to this, 47 47
you may wish to have cameras covering the entrance 48 48
and exits to your building and your parking lot 49 49
to detect if anyone is out there 50 50
parked for a long period of time, 51 51
trying to connect to your wireless network 52 52
and be able to remotely access you from there. 53 53
By utilizing a closed-circuit TV system or CCTV, 54 54
you can either actively monitor these doors 55 55
with a security guard 56 56
or you record the video feeds 57 57
and play them back after a suspected incident. 58 58
This way you can verify if anyone entered 59 59
or left the rooms containing your network equipment. 60 60
Surveillance cameras are going to come in many different types, 61 61
including both wired and wireless versions. 62 62
A wired camera allows the device to physically be cabled 63 63
from the camera all the way to a central monitoring station, 64 64
usually using a coaxial cable for analog solutions 65 65
or unshielded twisted pair for digital solutions. 66 66
If you're instead using a wireless camera solution, 67 67
you don't have to run physical cables. 68 68
Instead, they're going to be easier to install, 69 69
but you do have some things you have to worry about, 70 70
such as interference with other wireless systems 71 71
like 802.11 wireless networks. 72 72
Also, if they're wireless and an attacker could jam 73 73
or break those signals, 74 74
they could prevent them 75 75
from communicating with the central monitoring station, 76 76
and that way you won't be able to see the video feed. 77 77
In addition to wired and wireless varieties, 78 78
there's also indoor 79 79
and outdoor versions of surveillance cameras. 80 80
If you're going to be monitoring the parking lot 81 81
or external door, 82 82
you need to use an outdoor camera 83 83
that can withstand the elements like snow, 84 84
wind and rain. 85 85
If instead, you're going to be monitoring things 86 86
contained inside your building, 87 87
then you can choose an indoor camera 88 88
because they're going to be a little bit lighter, 89 89
cheaper, and easier to install. 90 90
Normally, when a camera is mounted, 91 91
it's going to be put in one location 92 92
with a fixed field of view. 93 93
On some higher end models though, 94 94
you can purchase what's known as a PTZ camera. 95 95
Now PTZ means pan, tilt and zoom. 96 96
If you've watch any bank heist movies, 97 97
you've probably seen these PTZ cameras used. 98 98
With these systems, 99 99
a security guard can move the camera 100 100
from a central monitoring station by panning, 101 101
moving it left or right, 102 102
tilting, moving it up or down, 103 103
or zooming by getting closer 104 104
or further with the field of vision, 105 105
all from a joystick at the control panel. 106 106
Another option to consider 107 107
is whether or not to purchase an infrared camera system. 108 108
Now an infrared camera system will display images 109 109
based on the amount of heat in a room. 110 110
These are really helpful inside our data centers 111 111
and telecommunication closets for two reasons. 112 112
First, you can quickly and easily identify where a person is 113 113
inside a given room. 114 114
If an attacker manages to get themselves 115 115
into the data center, 116 116
they're not going to be able to hide from you, 117 117
because their body heat will create a bright orange 118 118
or red glow on an infrared camera. 119 119
Second, even if no one is in the room, 120 120
you can use an infrared camera 121 121
to identify hotspots in the room, 122 122
such as when a fan in a server rack isn't working anymore, 123 123
and therefore heat starts building up. 124 124
Using this type of camera could be a way to detect gear 125 125
that may overheat before it actually overheats. 126 126
The final type of surveillance camera you can purchase 127 127
is known as an ultrasonic camera, 128 128
which is going to use sound-based detection. 129 129
If you've ever watched the Mission Impossible movies, 130 130
they had an ultrasonic system 131 131
that would sit there and listen. 132 132
Even if a pin was dropped on the floor, 133 133
it would be detected by the camera 134 134
and its super sensitive microphones. 135 135
Then the guards could come and arrest the attacker. 136 136
Another detection mechanism that we use in our organizations 137 137
is going to be related 138 138
to maintaining our configuration baseline 139 139
and an inventory of all of our equipment. 140 140
This is going to use asset tags on all of our equipment, 141 141
both the equipment currently in our network closets 142 142
and the equipment sitting on the shelf 143 143
as spares or replacements in our closets. 144 144
Now an asset tag 145 145
is a label that identifies a piece of equipment 146 146
using a unique serial number, code or barcode. 147 147
This asset tag 148 148
is going to be physically attached to the device, 149 149
things like your switches, your routers, 150 150
your firewalls, and other network devices. 151 151
And it contains information 152 152
such as a unique identification code, 153 153
the manufacturing date of the device, 154 154
and the date it was placed into use on the network. 155 155
By having a unique asset tag on an asset, 156 156
you can increase the security 157 157
by decreasing the risk of theft, 158 158
since each of these devices is going to be accounted for 159 159
and tracked by your organization. 160 160
Also, this asset tag can be used 161 161
to uniquely identify the device 162 162
for the purposes of configuration management 163 163
and supply chain management. 164 164
In conjunction with that asset tag, 165 165
you should also use a tamper detection method. 166 166
After all, how can you ensure 167 167
that nobody has modified the switch or router 168 168
once you place it into the supply closet, 169 169
or into that rack of gear in a telecommunications closet 170 170
that nobody is watching 24 hours a day? 171 171
One of the ways you can do this 172 172
is by using anti-tamper techniques. 173 173
This can be as simple as a sticker 174 174
or fixed to the corner of a switch. 175 175
And if that sticker is removed or broken, 176 176
it would indicate that somebody unscrewed the chassis 177 177
and add or remove something 178 178
from the inner components of that switch. 179 179
Some of our networking devices 180 180
also have an eFuse built into them 181 181
to help with this detection. 182 182
This eFuse is an electronic detection mechanism 183 183
that can record the version of the iOS 184 184
being used by a switch, 185 185
and if you attempt to downgrade it to a lower 186 186
or more insecure version, 187 187
the eFuse would trip 188 188
and indicate the firmware has been modified 189 189
and can no longer be trusted, 190 190
and then it would refuse to boot up the device. 191 191
On the other side of physical security, 192 192
we also have controls we put in place 193 193
to prevent things from happening. 194 194
Some prevention methods that we use 195 195
are things like: access control hardware, 196 196
like badge readers and biometrics; 197 197
access control vestibules, 198 198
like a mantrap; smart lockers; 199 199
locking racks; locking cabinets; 200 200
and employee training. 201 201
When it comes to access control hardware, 202 202
we usually are going to rely on either a badge reader 203 203
or a biometric reader to control access 204 204
to a secure telecommunications closet or data center. 205 205
A badge reader is going to rely on either a magnetic strip, 206 206
like a credit card, a chip card, 207 207
like a smart card 208 208
or RFID or radio-frequency ID card. 209 209
In general, it's going to be a great practice 210 210
to require all your employees 211 211
to wear an identification badge within your buildings. 212 212
This badge is then used to unlock an electronic lock 213 213
on the different doors of your data center 214 214
or other secured spaces, 215 215
in combination with some kind of a knowledge factor, 216 216
like a pin number, 217 217
that's unique to that employee. 218 218
By doing this, 219 219
we now have a two factor authentication system, 220 220
something you have, your badge 221 221
and something you know, your pin. 222 222
Some of these locks 223 223
can also choose to use a biometric authentication 224 224
instead of a badge. 225 225
For example, I've seen some data centers 226 226
protected by a fingerprint reader, 227 227
a retina scan, or a voiceprint and a pin. 228 228
Again, by adding the pin to the biometric factor, 229 229
we're gaining two factor authentication, 230 230
and making our data center much more secure. 231 231
In high security facilities, 232 232
they also use an access control vestibule, 233 233
in combination with an access control hardware or lock. 234 234
An access control vestibule is also known as a mantrap. 235 235
An access control vestibule or mantrap 236 236
is an area between two doorways that holds people 237 237
until they're identified and authenticated. 238 238
Sometimes these are automated, 239 239
like using an electronic badge and pin system 240 240
that we just discussed. 241 241
But sometimes they're actually manned 242 242
by a security personnel 243 243
who's going to physically look at your badge 244 244
to verify you are who you claim to be. 245 245
The most common placement of a mantrap 246 246
is actually the entrance to your office building. 247 247
So as you enter the building, 248 248
there might be an open lobby that anyone can access. 249 249
But then there's this set of turnstiles 250 250
where you're going to scan your badge 251 251
and enter your pin number. 252 252
This will allow you to go past those turnstiles 253 253
and get into the building. 254 254
This area between the front door and the turnstiles, 255 255
that is considered the access control vestibule or mantrap. 256 256
Once you get past that turnstile, 257 257
you're now in the secure area 258 258
and you've already been authenticated, 259 259
and now you can be trusted. 260 260
In some organizations, 261 261
they instead opt to have less security at the main floor, 262 262
and instead they're going to use access control vestibules 263 263
located at key choke points throughout the building, 264 264
as you go into certain 265 265
higher security areas of the building. 266 266
Sometimes you may have both a mantrap 267 267
at the entrance of the building that everyone goes in, 268 268
who works in that facility, 269 269
but then you have an additional mantrap 270 270
or access control vestibule 271 271
going into a higher security area, 272 272
such as your data center. 273 273
In this case, the first access control vestibule 274 274
at the main entrance of the building gives you access 275 275
to a generic level of organizational security. 276 276
But then you need to go into a top secret area, 277 277
you need to go through a second verification 278 278
at another access control vestibule. 279 279
Next let's talk about personal electronic devices. 280 280
A lot of organizations 281 281
prevent the use of personal electronic devices 282 282
like cell phones, smartphones, and tablets 283 283
inside their office spaces. 284 284
This is done as a form of data loss prevention. 285 285
After all, if I can simply carry my smartphone with me 286 286
into a top-secret building, 287 287
I could take pictures of some highly classified documents 288 288
from my computer screen, 289 289
and then those documents could walk 290 290
right out the front door with me on my cell phone. 291 291
This would not be very secure. 292 292
So in these organizations, 293 293
they're usually going to be located 294 294
in something like a government or military building, 295 295
and they're going to place a smart locker in the entrance 296 296
right before the access control vestibule. 297 297
This way you can drop off your cell phone 298 298
and lock it up securely in the smart locker. 299 299
Now a smart locker is a fully integrated system 300 300
that looks a lot like a large vending machine. 301 301
Basically, you're going to scan your employee badge 302 302
at the smart locker on a digital badge reader. 303 303
Then you pick an open locker from the display screen, 304 304
and once you select it, 305 305
that is going to unlock and open up that locker. 306 306
You then put in your laptop, 307 307
your tablet, your smartphone, 308 308
your smartwatch, or other valuables inside the locker. 309 309
And once you shut the door to the locker, 310 310
it automatically is going to lock 311 311
and you can go about the rest of your day. 312 312
Whenever you need to get your things back, 313 313
you go back to the display screen, 314 314
click Open Locker, and scan your badge. 315 315
At that point, the locker will unlock again, 316 316
and you can retrieve your items from the locker. 317 317
Next, let's talk about protecting the things 318 318
that are inside of our data center. 319 319
Now, once we get inside of our data center 320 320
or telecommunication closets, 321 321
you're going to see racks or cabinets 322 322
that contain the different networking equipment 323 323
and servers that we're going to use. 324 324
A standard server and networking equipment rack 325 325
is about 48 units high, 326 326
also known as 48U. 327 327
This is also about 50 inches deep 328 328
and about 20 inches wide. 329 329
These can house networking equipment 330 330
like switches and routers, 331 331
patch panels, servers, 332 332
rack mounted uninterrupted power supplies, 333 333
and much more. 334 334
To protect these devices from being tampered with, 335 335
these racks and cabinets may contain a small key lock. 336 336
By locking these racks and cabinets, 337 337
you can control physical access to your equipment. 338 338
Generally, one person will be the key custodian 339 339
for the data center, 340 340
and that person will also maintain a log 341 341
of who has which keys and when, 342 342
in case that information is needed 343 343
during an incident response. 344 344
Finally, we need to talk about 345 345
the most beneficial prevention mechanism that you have 346 346
that you can invest in. 347 347
And this is employee training, 348 348
according to a study by Forrester Research, 349 349
providing employee cyber security awareness training 350 350
produced a 69% return on investment 351 351
for small to medium-sized companies, 352 352
and a 248% return on investment 353 353
for large enterprise organizations. 354 354
The data supports it. 355 355
Employee training is a great investment. 356 356
This is particularly true 357 357
because the biggest weakness in our networks is our users 358 358
and the administrators, 359 359
because both of these people 360 360
are going to use and run our networks. 361 361
And they're going to cause a lot of problems for us 362 362
if they're not trained properly. 363 363
If an administrator misconfigures a device, for example, 364 364
that creates a vulnerability 365 365
that could be exploited by an attacker. 366 366
If an end user clicks on a link in a phishing email, 367 367
they can cause the organization to get infected with malware 368 368
and spend a lot of time and effort cleaning up this mess 369 369
during an incident response. 370 370
When you're your employee training, 371 371
it's important to stress the proper policies 372 372
and procedures that the employees need to follow 373 373
in regards to both their physical security, 374 374
such as challenging personnel 375 375
to show their employee badges 376 376
or questioning why certain people 377 377
are trying to access certain areas, 378 378
and technical security such as malware prevention 379 379
and anti-phishing training.