1 1 00:00:00,240 --> 00:00:01,830 Physical Security. 2 2 00:00:01,830 --> 00:00:03,370 In this lesson, we're going to discuss 3 3 00:00:03,370 --> 00:00:06,360 the importance of physical security to our network security. 4 4 00:00:06,360 --> 00:00:07,193 After all, 5 5 00:00:07,193 --> 00:00:09,260 if an attacker can touch your networking equipment, 6 6 00:00:09,260 --> 00:00:10,930 such as your switches, your routers, 7 7 00:00:10,930 --> 00:00:12,690 your firewalls and other devices, 8 8 00:00:12,690 --> 00:00:14,080 they could change your configurations 9 9 00:00:14,080 --> 00:00:16,050 or completely bypass the devices 10 10 00:00:16,050 --> 00:00:18,130 by patching around them with patch cables. 11 11 00:00:18,130 --> 00:00:19,940 So, as we move through this lesson, 12 12 00:00:19,940 --> 00:00:22,930 we're going to cover both detection and prevention mechanisms 13 13 00:00:22,930 --> 00:00:24,630 that you can use to protect your network 14 14 00:00:24,630 --> 00:00:26,180 and its critical equipment. 15 15 00:00:26,180 --> 00:00:28,610 First, we're going to start with detection mechanisms, 16 16 00:00:28,610 --> 00:00:30,850 things like cameras, motion detectors, 17 17 00:00:30,850 --> 00:00:32,980 asset tags, and tamper detection. 18 18 00:00:32,980 --> 00:00:34,740 When it comes to detection mechanisms 19 19 00:00:34,740 --> 00:00:36,010 and detective controls, 20 20 00:00:36,010 --> 00:00:37,790 we're going to be talking about security controls 21 21 00:00:37,790 --> 00:00:39,130 that are used during an event 22 22 00:00:39,130 --> 00:00:41,110 to find out whether or not something malicious 23 23 00:00:41,110 --> 00:00:42,450 may have happened. 24 24 00:00:42,450 --> 00:00:43,940 Detection controls are going to be useful 25 25 00:00:43,940 --> 00:00:45,570 in determining if something happened, 26 26 00:00:45,570 --> 00:00:47,340 but only after the fact. 27 27 00:00:47,340 --> 00:00:49,640 These types of controls won't stop something from happening, 28 28 00:00:49,640 --> 00:00:51,820 but they can provide a method to log it 29 29 00:00:51,820 --> 00:00:54,080 or identify if a piece of networking equipment 30 30 00:00:54,080 --> 00:00:56,900 has remained under your control the entire time. 31 31 00:00:56,900 --> 00:00:58,180 When it comes to cameras, 32 32 00:00:58,180 --> 00:00:59,680 these are often mounted inside 33 33 00:00:59,680 --> 00:01:02,320 and outside of rooms that contain your networking gear. 34 34 00:01:02,320 --> 00:01:03,980 For example, you should have a camera 35 35 00:01:03,980 --> 00:01:06,650 point at the entrance door to your main distribution frame, 36 36 00:01:06,650 --> 00:01:08,270 your intermediate distribution frames, 37 37 00:01:08,270 --> 00:01:11,010 your data center, and your telecommunication closets. 38 38 00:01:11,010 --> 00:01:12,490 When it comes to placing your cameras, 39 39 00:01:12,490 --> 00:01:13,810 it's really important to understand 40 40 00:01:13,810 --> 00:01:15,460 where your high value targets are, 41 41 00:01:15,460 --> 00:01:18,100 and that way you can understand what you need to protect. 42 42 00:01:18,100 --> 00:01:20,360 If you're pointing the cameras at the entrance or exit, 43 43 00:01:20,360 --> 00:01:21,760 you'll be able to see when people enter 44 44 00:01:21,760 --> 00:01:22,860 or leave a data center 45 45 00:01:22,860 --> 00:01:25,400 or your various telecommunication closets. 46 46 00:01:25,400 --> 00:01:26,410 In addition to this, 47 47 00:01:26,410 --> 00:01:28,380 you may wish to have cameras covering the entrance 48 48 00:01:28,380 --> 00:01:30,670 and exits to your building and your parking lot 49 49 00:01:30,670 --> 00:01:32,240 to detect if anyone is out there 50 50 00:01:32,240 --> 00:01:33,750 parked for a long period of time, 51 51 00:01:33,750 --> 00:01:35,580 trying to connect to your wireless network 52 52 00:01:35,580 --> 00:01:37,740 and be able to remotely access you from there. 53 53 00:01:37,740 --> 00:01:41,110 By utilizing a closed-circuit TV system or CCTV, 54 54 00:01:41,110 --> 00:01:42,940 you can either actively monitor these doors 55 55 00:01:42,940 --> 00:01:44,020 with a security guard 56 56 00:01:44,020 --> 00:01:45,650 or you record the video feeds 57 57 00:01:45,650 --> 00:01:48,110 and play them back after a suspected incident. 58 58 00:01:48,110 --> 00:01:49,970 This way you can verify if anyone entered 59 59 00:01:49,970 --> 00:01:52,770 or left the rooms containing your network equipment. 60 60 00:01:52,770 --> 00:01:55,490 Surveillance cameras are going to come in many different types, 61 61 00:01:55,490 --> 00:01:57,930 including both wired and wireless versions. 62 62 00:01:57,930 --> 00:02:00,670 A wired camera allows the device to physically be cabled 63 63 00:02:00,670 --> 00:02:03,470 from the camera all the way to a central monitoring station, 64 64 00:02:03,470 --> 00:02:06,290 usually using a coaxial cable for analog solutions 65 65 00:02:06,290 --> 00:02:09,010 or unshielded twisted pair for digital solutions. 66 66 00:02:09,010 --> 00:02:11,230 If you're instead using a wireless camera solution, 67 67 00:02:11,230 --> 00:02:13,030 you don't have to run physical cables. 68 68 00:02:13,030 --> 00:02:15,300 Instead, they're going to be easier to install, 69 69 00:02:15,300 --> 00:02:17,290 but you do have some things you have to worry about, 70 70 00:02:17,290 --> 00:02:19,450 such as interference with other wireless systems 71 71 00:02:19,450 --> 00:02:21,920 like 802.11 wireless networks. 72 72 00:02:21,920 --> 00:02:24,860 Also, if they're wireless and an attacker could jam 73 73 00:02:24,860 --> 00:02:26,130 or break those signals, 74 74 00:02:26,130 --> 00:02:26,963 they could prevent them 75 75 00:02:26,963 --> 00:02:29,220 from communicating with the central monitoring station, 76 76 00:02:29,220 --> 00:02:31,910 and that way you won't be able to see the video feed. 77 77 00:02:31,910 --> 00:02:34,050 In addition to wired and wireless varieties, 78 78 00:02:34,050 --> 00:02:34,940 there's also indoor 79 79 00:02:34,940 --> 00:02:36,980 and outdoor versions of surveillance cameras. 80 80 00:02:36,980 --> 00:02:38,460 If you're going to be monitoring the parking lot 81 81 00:02:38,460 --> 00:02:39,620 or external door, 82 82 00:02:39,620 --> 00:02:41,340 you need to use an outdoor camera 83 83 00:02:41,340 --> 00:02:43,470 that can withstand the elements like snow, 84 84 00:02:43,470 --> 00:02:44,750 wind and rain. 85 85 00:02:44,750 --> 00:02:46,270 If instead, you're going to be monitoring things 86 86 00:02:46,270 --> 00:02:47,750 contained inside your building, 87 87 00:02:47,750 --> 00:02:49,400 then you can choose an indoor camera 88 88 00:02:49,400 --> 00:02:51,010 because they're going to be a little bit lighter, 89 89 00:02:51,010 --> 00:02:52,970 cheaper, and easier to install. 90 90 00:02:52,970 --> 00:02:54,550 Normally, when a camera is mounted, 91 91 00:02:54,550 --> 00:02:56,290 it's going to be put in one location 92 92 00:02:56,290 --> 00:02:58,010 with a fixed field of view. 93 93 00:02:58,010 --> 00:02:59,630 On some higher end models though, 94 94 00:02:59,630 --> 00:03:02,390 you can purchase what's known as a PTZ camera. 95 95 00:03:02,390 --> 00:03:05,320 Now PTZ means pan, tilt and zoom. 96 96 00:03:05,320 --> 00:03:07,070 If you've watch any bank heist movies, 97 97 00:03:07,070 --> 00:03:09,610 you've probably seen these PTZ cameras used. 98 98 00:03:09,610 --> 00:03:10,640 With these systems, 99 99 00:03:10,640 --> 00:03:12,330 a security guard can move the camera 100 100 00:03:12,330 --> 00:03:14,610 from a central monitoring station by panning, 101 101 00:03:14,610 --> 00:03:15,980 moving it left or right, 102 102 00:03:15,980 --> 00:03:17,650 tilting, moving it up or down, 103 103 00:03:17,650 --> 00:03:19,300 or zooming by getting closer 104 104 00:03:19,300 --> 00:03:21,210 or further with the field of vision, 105 105 00:03:21,210 --> 00:03:23,630 all from a joystick at the control panel. 106 106 00:03:23,630 --> 00:03:24,770 Another option to consider 107 107 00:03:24,770 --> 00:03:27,640 is whether or not to purchase an infrared camera system. 108 108 00:03:27,640 --> 00:03:29,910 Now an infrared camera system will display images 109 109 00:03:29,910 --> 00:03:31,720 based on the amount of heat in a room. 110 110 00:03:31,720 --> 00:03:33,640 These are really helpful inside our data centers 111 111 00:03:33,640 --> 00:03:36,190 and telecommunication closets for two reasons. 112 112 00:03:36,190 --> 00:03:39,020 First, you can quickly and easily identify where a person is 113 113 00:03:39,020 --> 00:03:40,490 inside a given room. 114 114 00:03:40,490 --> 00:03:42,020 If an attacker manages to get themselves 115 115 00:03:42,020 --> 00:03:43,170 into the data center, 116 116 00:03:43,170 --> 00:03:44,620 they're not going to be able to hide from you, 117 117 00:03:44,620 --> 00:03:46,920 because their body heat will create a bright orange 118 118 00:03:46,920 --> 00:03:49,540 or red glow on an infrared camera. 119 119 00:03:49,540 --> 00:03:51,610 Second, even if no one is in the room, 120 120 00:03:51,610 --> 00:03:53,100 you can use an infrared camera 121 121 00:03:53,100 --> 00:03:55,070 to identify hotspots in the room, 122 122 00:03:55,070 --> 00:03:57,810 such as when a fan in a server rack isn't working anymore, 123 123 00:03:57,810 --> 00:04:00,020 and therefore heat starts building up. 124 124 00:04:00,020 --> 00:04:02,580 Using this type of camera could be a way to detect gear 125 125 00:04:02,580 --> 00:04:05,440 that may overheat before it actually overheats. 126 126 00:04:05,440 --> 00:04:07,660 The final type of surveillance camera you can purchase 127 127 00:04:07,660 --> 00:04:09,630 is known as an ultrasonic camera, 128 128 00:04:09,630 --> 00:04:11,900 which is going to use sound-based detection. 129 129 00:04:11,900 --> 00:04:14,010 If you've ever watched the Mission Impossible movies, 130 130 00:04:14,010 --> 00:04:15,640 they had an ultrasonic system 131 131 00:04:15,640 --> 00:04:17,270 that would sit there and listen. 132 132 00:04:17,270 --> 00:04:19,160 Even if a pin was dropped on the floor, 133 133 00:04:19,160 --> 00:04:20,760 it would be detected by the camera 134 134 00:04:20,760 --> 00:04:22,620 and its super sensitive microphones. 135 135 00:04:22,620 --> 00:04:25,580 Then the guards could come and arrest the attacker. 136 136 00:04:25,580 --> 00:04:28,370 Another detection mechanism that we use in our organizations 137 137 00:04:28,370 --> 00:04:29,220 is going to be related 138 138 00:04:29,220 --> 00:04:31,330 to maintaining our configuration baseline 139 139 00:04:31,330 --> 00:04:33,370 and an inventory of all of our equipment. 140 140 00:04:33,370 --> 00:04:36,380 This is going to use asset tags on all of our equipment, 141 141 00:04:36,380 --> 00:04:38,607 both the equipment currently in our network closets 142 142 00:04:38,607 --> 00:04:40,320 and the equipment sitting on the shelf 143 143 00:04:40,320 --> 00:04:42,950 as spares or replacements in our closets. 144 144 00:04:42,950 --> 00:04:43,910 Now an asset tag 145 145 00:04:43,910 --> 00:04:45,900 is a label that identifies a piece of equipment 146 146 00:04:45,900 --> 00:04:48,940 using a unique serial number, code or barcode. 147 147 00:04:48,940 --> 00:04:49,840 This asset tag 148 148 00:04:49,840 --> 00:04:51,830 is going to be physically attached to the device, 149 149 00:04:51,830 --> 00:04:53,590 things like your switches, your routers, 150 150 00:04:53,590 --> 00:04:55,710 your firewalls, and other network devices. 151 151 00:04:55,710 --> 00:04:57,120 And it contains information 152 152 00:04:57,120 --> 00:04:59,110 such as a unique identification code, 153 153 00:04:59,110 --> 00:05:00,530 the manufacturing date of the device, 154 154 00:05:00,530 --> 00:05:03,600 and the date it was placed into use on the network. 155 155 00:05:03,600 --> 00:05:06,060 By having a unique asset tag on an asset, 156 156 00:05:06,060 --> 00:05:07,230 you can increase the security 157 157 00:05:07,230 --> 00:05:09,050 by decreasing the risk of theft, 158 158 00:05:09,050 --> 00:05:11,280 since each of these devices is going to be accounted for 159 159 00:05:11,280 --> 00:05:13,650 and tracked by your organization. 160 160 00:05:13,650 --> 00:05:15,430 Also, this asset tag can be used 161 161 00:05:15,430 --> 00:05:17,020 to uniquely identify the device 162 162 00:05:17,020 --> 00:05:18,910 for the purposes of configuration management 163 163 00:05:18,910 --> 00:05:20,590 and supply chain management. 164 164 00:05:20,590 --> 00:05:22,220 In conjunction with that asset tag, 165 165 00:05:22,220 --> 00:05:24,760 you should also use a tamper detection method. 166 166 00:05:24,760 --> 00:05:26,370 After all, how can you ensure 167 167 00:05:26,370 --> 00:05:28,260 that nobody has modified the switch or router 168 168 00:05:28,260 --> 00:05:30,400 once you place it into the supply closet, 169 169 00:05:30,400 --> 00:05:33,310 or into that rack of gear in a telecommunications closet 170 170 00:05:33,310 --> 00:05:35,660 that nobody is watching 24 hours a day? 171 171 00:05:35,660 --> 00:05:36,900 One of the ways you can do this 172 172 00:05:36,900 --> 00:05:39,070 is by using anti-tamper techniques. 173 173 00:05:39,070 --> 00:05:40,420 This can be as simple as a sticker 174 174 00:05:40,420 --> 00:05:41,880 or fixed to the corner of a switch. 175 175 00:05:41,880 --> 00:05:43,890 And if that sticker is removed or broken, 176 176 00:05:43,890 --> 00:05:46,000 it would indicate that somebody unscrewed the chassis 177 177 00:05:46,000 --> 00:05:47,400 and add or remove something 178 178 00:05:47,400 --> 00:05:49,520 from the inner components of that switch. 179 179 00:05:49,520 --> 00:05:50,840 Some of our networking devices 180 180 00:05:50,840 --> 00:05:52,750 also have an eFuse built into them 181 181 00:05:52,750 --> 00:05:54,360 to help with this detection. 182 182 00:05:54,360 --> 00:05:57,070 This eFuse is an electronic detection mechanism 183 183 00:05:57,070 --> 00:05:58,780 that can record the version of the iOS 184 184 00:05:58,780 --> 00:05:59,970 being used by a switch, 185 185 00:05:59,970 --> 00:06:01,700 and if you attempt to downgrade it to a lower 186 186 00:06:01,700 --> 00:06:03,200 or more insecure version, 187 187 00:06:03,200 --> 00:06:04,500 the eFuse would trip 188 188 00:06:04,500 --> 00:06:06,300 and indicate the firmware has been modified 189 189 00:06:06,300 --> 00:06:07,840 and can no longer be trusted, 190 190 00:06:07,840 --> 00:06:10,660 and then it would refuse to boot up the device. 191 191 00:06:10,660 --> 00:06:12,260 On the other side of physical security, 192 192 00:06:12,260 --> 00:06:13,990 we also have controls we put in place 193 193 00:06:13,990 --> 00:06:15,770 to prevent things from happening. 194 194 00:06:15,770 --> 00:06:17,410 Some prevention methods that we use 195 195 00:06:17,410 --> 00:06:19,320 are things like: access control hardware, 196 196 00:06:19,320 --> 00:06:21,270 like badge readers and biometrics; 197 197 00:06:21,270 --> 00:06:22,570 access control vestibules, 198 198 00:06:22,570 --> 00:06:24,780 like a mantrap; smart lockers; 199 199 00:06:24,780 --> 00:06:26,530 locking racks; locking cabinets; 200 200 00:06:26,530 --> 00:06:27,870 and employee training. 201 201 00:06:27,870 --> 00:06:29,700 When it comes to access control hardware, 202 202 00:06:29,700 --> 00:06:31,740 we usually are going to rely on either a badge reader 203 203 00:06:31,740 --> 00:06:33,970 or a biometric reader to control access 204 204 00:06:33,970 --> 00:06:37,010 to a secure telecommunications closet or data center. 205 205 00:06:37,010 --> 00:06:39,440 A badge reader is going to rely on either a magnetic strip, 206 206 00:06:39,440 --> 00:06:41,410 like a credit card, a chip card, 207 207 00:06:41,410 --> 00:06:42,460 like a smart card 208 208 00:06:42,460 --> 00:06:45,370 or RFID or radio-frequency ID card. 209 209 00:06:45,370 --> 00:06:47,340 In general, it's going to be a great practice 210 210 00:06:47,340 --> 00:06:48,520 to require all your employees 211 211 00:06:48,520 --> 00:06:51,330 to wear an identification badge within your buildings. 212 212 00:06:51,330 --> 00:06:54,270 This badge is then used to unlock an electronic lock 213 213 00:06:54,270 --> 00:06:55,840 on the different doors of your data center 214 214 00:06:55,840 --> 00:06:57,330 or other secured spaces, 215 215 00:06:57,330 --> 00:06:59,660 in combination with some kind of a knowledge factor, 216 216 00:06:59,660 --> 00:07:00,610 like a pin number, 217 217 00:07:00,610 --> 00:07:02,260 that's unique to that employee. 218 218 00:07:02,260 --> 00:07:03,093 By doing this, 219 219 00:07:03,093 --> 00:07:05,420 we now have a two factor authentication system, 220 220 00:07:05,420 --> 00:07:07,010 something you have, your badge 221 221 00:07:07,010 --> 00:07:09,040 and something you know, your pin. 222 222 00:07:09,040 --> 00:07:09,940 Some of these locks 223 223 00:07:09,940 --> 00:07:12,460 can also choose to use a biometric authentication 224 224 00:07:12,460 --> 00:07:13,730 instead of a badge. 225 225 00:07:13,730 --> 00:07:15,510 For example, I've seen some data centers 226 226 00:07:15,510 --> 00:07:17,120 protected by a fingerprint reader, 227 227 00:07:17,120 --> 00:07:19,850 a retina scan, or a voiceprint and a pin. 228 228 00:07:19,850 --> 00:07:22,450 Again, by adding the pin to the biometric factor, 229 229 00:07:22,450 --> 00:07:24,290 we're gaining two factor authentication, 230 230 00:07:24,290 --> 00:07:26,980 and making our data center much more secure. 231 231 00:07:26,980 --> 00:07:28,490 In high security facilities, 232 232 00:07:28,490 --> 00:07:30,790 they also use an access control vestibule, 233 233 00:07:30,790 --> 00:07:33,730 in combination with an access control hardware or lock. 234 234 00:07:33,730 --> 00:07:37,080 An access control vestibule is also known as a mantrap. 235 235 00:07:37,080 --> 00:07:39,240 An access control vestibule or mantrap 236 236 00:07:39,240 --> 00:07:41,770 is an area between two doorways that holds people 237 237 00:07:41,770 --> 00:07:43,930 until they're identified and authenticated. 238 238 00:07:43,930 --> 00:07:45,580 Sometimes these are automated, 239 239 00:07:45,580 --> 00:07:47,460 like using an electronic badge and pin system 240 240 00:07:47,460 --> 00:07:48,570 that we just discussed. 241 241 00:07:48,570 --> 00:07:49,960 But sometimes they're actually manned 242 242 00:07:49,960 --> 00:07:51,210 by a security personnel 243 243 00:07:51,210 --> 00:07:52,970 who's going to physically look at your badge 244 244 00:07:52,970 --> 00:07:55,130 to verify you are who you claim to be. 245 245 00:07:55,130 --> 00:07:56,830 The most common placement of a mantrap 246 246 00:07:56,830 --> 00:07:58,930 is actually the entrance to your office building. 247 247 00:07:58,930 --> 00:08:00,460 So as you enter the building, 248 248 00:08:00,460 --> 00:08:02,880 there might be an open lobby that anyone can access. 249 249 00:08:02,880 --> 00:08:04,520 But then there's this set of turnstiles 250 250 00:08:04,520 --> 00:08:05,610 where you're going to scan your badge 251 251 00:08:05,610 --> 00:08:07,000 and enter your pin number. 252 252 00:08:07,000 --> 00:08:09,030 This will allow you to go past those turnstiles 253 253 00:08:09,030 --> 00:08:10,640 and get into the building. 254 254 00:08:10,640 --> 00:08:13,110 This area between the front door and the turnstiles, 255 255 00:08:13,110 --> 00:08:16,500 that is considered the access control vestibule or mantrap. 256 256 00:08:16,500 --> 00:08:18,000 Once you get past that turnstile, 257 257 00:08:18,000 --> 00:08:19,410 you're now in the secure area 258 258 00:08:19,410 --> 00:08:20,780 and you've already been authenticated, 259 259 00:08:20,780 --> 00:08:22,390 and now you can be trusted. 260 260 00:08:22,390 --> 00:08:23,570 In some organizations, 261 261 00:08:23,570 --> 00:08:26,090 they instead opt to have less security at the main floor, 262 262 00:08:26,090 --> 00:08:28,260 and instead they're going to use access control vestibules 263 263 00:08:28,260 --> 00:08:30,540 located at key choke points throughout the building, 264 264 00:08:30,540 --> 00:08:31,390 as you go into certain 265 265 00:08:31,390 --> 00:08:33,670 higher security areas of the building. 266 266 00:08:33,670 --> 00:08:35,430 Sometimes you may have both a mantrap 267 267 00:08:35,430 --> 00:08:37,830 at the entrance of the building that everyone goes in, 268 268 00:08:37,830 --> 00:08:39,060 who works in that facility, 269 269 00:08:39,060 --> 00:08:40,680 but then you have an additional mantrap 270 270 00:08:40,680 --> 00:08:42,060 or access control vestibule 271 271 00:08:42,060 --> 00:08:43,690 going into a higher security area, 272 272 00:08:43,690 --> 00:08:45,110 such as your data center. 273 273 00:08:45,110 --> 00:08:47,390 In this case, the first access control vestibule 274 274 00:08:47,390 --> 00:08:49,650 at the main entrance of the building gives you access 275 275 00:08:49,650 --> 00:08:52,100 to a generic level of organizational security. 276 276 00:08:52,100 --> 00:08:54,731 But then you need to go into a top secret area, 277 277 00:08:54,731 --> 00:08:56,970 you need to go through a second verification 278 278 00:08:56,970 --> 00:08:59,230 at another access control vestibule. 279 279 00:08:59,230 --> 00:09:02,040 Next let's talk about personal electronic devices. 280 280 00:09:02,040 --> 00:09:03,070 A lot of organizations 281 281 00:09:03,070 --> 00:09:05,100 prevent the use of personal electronic devices 282 282 00:09:05,100 --> 00:09:07,280 like cell phones, smartphones, and tablets 283 283 00:09:07,280 --> 00:09:08,910 inside their office spaces. 284 284 00:09:08,910 --> 00:09:11,340 This is done as a form of data loss prevention. 285 285 00:09:11,340 --> 00:09:13,910 After all, if I can simply carry my smartphone with me 286 286 00:09:13,910 --> 00:09:15,200 into a top-secret building, 287 287 00:09:15,200 --> 00:09:17,600 I could take pictures of some highly classified documents 288 288 00:09:17,600 --> 00:09:18,850 from my computer screen, 289 289 00:09:18,850 --> 00:09:20,490 and then those documents could walk 290 290 00:09:20,490 --> 00:09:22,760 right out the front door with me on my cell phone. 291 291 00:09:22,760 --> 00:09:24,550 This would not be very secure. 292 292 00:09:24,550 --> 00:09:26,270 So in these organizations, 293 293 00:09:26,270 --> 00:09:27,310 they're usually going to be located 294 294 00:09:27,310 --> 00:09:29,590 in something like a government or military building, 295 295 00:09:29,590 --> 00:09:32,080 and they're going to place a smart locker in the entrance 296 296 00:09:32,080 --> 00:09:34,410 right before the access control vestibule. 297 297 00:09:34,410 --> 00:09:36,450 This way you can drop off your cell phone 298 298 00:09:36,450 --> 00:09:38,870 and lock it up securely in the smart locker. 299 299 00:09:38,870 --> 00:09:41,240 Now a smart locker is a fully integrated system 300 300 00:09:41,240 --> 00:09:43,550 that looks a lot like a large vending machine. 301 301 00:09:43,550 --> 00:09:45,540 Basically, you're going to scan your employee badge 302 302 00:09:45,540 --> 00:09:47,730 at the smart locker on a digital badge reader. 303 303 00:09:47,730 --> 00:09:50,260 Then you pick an open locker from the display screen, 304 304 00:09:50,260 --> 00:09:51,530 and once you select it, 305 305 00:09:51,530 --> 00:09:53,880 that is going to unlock and open up that locker. 306 306 00:09:53,880 --> 00:09:55,130 You then put in your laptop, 307 307 00:09:55,130 --> 00:09:56,608 your tablet, your smartphone, 308 308 00:09:56,608 --> 00:09:59,310 your smartwatch, or other valuables inside the locker. 309 309 00:09:59,310 --> 00:10:01,030 And once you shut the door to the locker, 310 310 00:10:01,030 --> 00:10:02,290 it automatically is going to lock 311 311 00:10:02,290 --> 00:10:04,120 and you can go about the rest of your day. 312 312 00:10:04,120 --> 00:10:05,530 Whenever you need to get your things back, 313 313 00:10:05,530 --> 00:10:07,070 you go back to the display screen, 314 314 00:10:07,070 --> 00:10:09,320 click Open Locker, and scan your badge. 315 315 00:10:09,320 --> 00:10:11,450 At that point, the locker will unlock again, 316 316 00:10:11,450 --> 00:10:13,550 and you can retrieve your items from the locker. 317 317 00:10:13,550 --> 00:10:15,530 Next, let's talk about protecting the things 318 318 00:10:15,530 --> 00:10:17,440 that are inside of our data center. 319 319 00:10:17,440 --> 00:10:19,420 Now, once we get inside of our data center 320 320 00:10:19,420 --> 00:10:20,990 or telecommunication closets, 321 321 00:10:20,990 --> 00:10:22,450 you're going to see racks or cabinets 322 322 00:10:22,450 --> 00:10:24,100 that contain the different networking equipment 323 323 00:10:24,100 --> 00:10:25,820 and servers that we're going to use. 324 324 00:10:25,820 --> 00:10:27,870 A standard server and networking equipment rack 325 325 00:10:27,870 --> 00:10:29,850 is about 48 units high, 326 326 00:10:29,850 --> 00:10:31,720 also known as 48U. 327 327 00:10:31,720 --> 00:10:33,220 This is also about 50 inches deep 328 328 00:10:33,220 --> 00:10:34,870 and about 20 inches wide. 329 329 00:10:34,870 --> 00:10:36,270 These can house networking equipment 330 330 00:10:36,270 --> 00:10:37,660 like switches and routers, 331 331 00:10:37,660 --> 00:10:39,110 patch panels, servers, 332 332 00:10:39,110 --> 00:10:41,050 rack mounted uninterrupted power supplies, 333 333 00:10:41,050 --> 00:10:42,180 and much more. 334 334 00:10:42,180 --> 00:10:44,430 To protect these devices from being tampered with, 335 335 00:10:44,430 --> 00:10:47,880 these racks and cabinets may contain a small key lock. 336 336 00:10:47,880 --> 00:10:49,630 By locking these racks and cabinets, 337 337 00:10:49,630 --> 00:10:52,200 you can control physical access to your equipment. 338 338 00:10:52,200 --> 00:10:54,460 Generally, one person will be the key custodian 339 339 00:10:54,460 --> 00:10:55,510 for the data center, 340 340 00:10:55,510 --> 00:10:57,390 and that person will also maintain a log 341 341 00:10:57,390 --> 00:10:59,270 of who has which keys and when, 342 342 00:10:59,270 --> 00:11:00,550 in case that information is needed 343 343 00:11:00,550 --> 00:11:02,000 during an incident response. 344 344 00:11:02,000 --> 00:11:03,250 Finally, we need to talk about 345 345 00:11:03,250 --> 00:11:05,920 the most beneficial prevention mechanism that you have 346 346 00:11:05,920 --> 00:11:06,990 that you can invest in. 347 347 00:11:06,990 --> 00:11:08,830 And this is employee training, 348 348 00:11:08,830 --> 00:11:10,920 according to a study by Forrester Research, 349 349 00:11:10,920 --> 00:11:13,180 providing employee cyber security awareness training 350 350 00:11:13,180 --> 00:11:15,760 produced a 69% return on investment 351 351 00:11:15,760 --> 00:11:17,480 for small to medium-sized companies, 352 352 00:11:17,480 --> 00:11:19,980 and a 248% return on investment 353 353 00:11:19,980 --> 00:11:22,000 for large enterprise organizations. 354 354 00:11:22,000 --> 00:11:23,140 The data supports it. 355 355 00:11:23,140 --> 00:11:25,760 Employee training is a great investment. 356 356 00:11:25,760 --> 00:11:27,260 This is particularly true 357 357 00:11:27,260 --> 00:11:30,240 because the biggest weakness in our networks is our users 358 358 00:11:30,240 --> 00:11:31,340 and the administrators, 359 359 00:11:31,340 --> 00:11:32,790 because both of these people 360 360 00:11:32,790 --> 00:11:34,600 are going to use and run our networks. 361 361 00:11:34,600 --> 00:11:36,340 And they're going to cause a lot of problems for us 362 362 00:11:36,340 --> 00:11:38,070 if they're not trained properly. 363 363 00:11:38,070 --> 00:11:40,470 If an administrator misconfigures a device, for example, 364 364 00:11:40,470 --> 00:11:41,760 that creates a vulnerability 365 365 00:11:41,760 --> 00:11:43,490 that could be exploited by an attacker. 366 366 00:11:43,490 --> 00:11:45,870 If an end user clicks on a link in a phishing email, 367 367 00:11:45,870 --> 00:11:48,370 they can cause the organization to get infected with malware 368 368 00:11:48,370 --> 00:11:50,960 and spend a lot of time and effort cleaning up this mess 369 369 00:11:50,960 --> 00:11:52,610 during an incident response. 370 370 00:11:52,610 --> 00:11:54,350 When you're your employee training, 371 371 00:11:54,350 --> 00:11:56,370 it's important to stress the proper policies 372 372 00:11:56,370 --> 00:11:58,480 and procedures that the employees need to follow 373 373 00:11:58,480 --> 00:12:00,480 in regards to both their physical security, 374 374 00:12:00,480 --> 00:12:01,690 such as challenging personnel 375 375 00:12:01,690 --> 00:12:03,090 to show their employee badges 376 376 00:12:03,090 --> 00:12:04,290 or questioning why certain people 377 377 00:12:04,290 --> 00:12:05,880 are trying to access certain areas, 378 378 00:12:05,880 --> 00:12:08,490 and technical security such as malware prevention 379 379 00:12:08,490 --> 00:12:09,913 and anti-phishing training.