1 00:00:00,000 --> 00:00:01,560 In this lesson, we're going to explore 2 00:00:01,560 --> 00:00:04,980 the physical security control measures known as door locks. 3 00:00:04,980 --> 00:00:07,080 Now, all of your perimeter physical security defenses 4 00:00:07,080 --> 00:00:08,250 that you're going to be using to protect 5 00:00:08,250 --> 00:00:09,690 your organization's facilities 6 00:00:09,690 --> 00:00:11,880 are going to become useless at some point. 7 00:00:11,880 --> 00:00:13,290 Do you know when that point is? 8 00:00:13,290 --> 00:00:14,250 Well, it's the moment 9 00:00:14,250 --> 00:00:16,110 that somebody has entered your building. 10 00:00:16,110 --> 00:00:16,943 That's right. 11 00:00:16,943 --> 00:00:19,260 We can install a large electrified fence 12 00:00:19,260 --> 00:00:20,790 with barbed wire across the top. 13 00:00:20,790 --> 00:00:23,070 We can install large steel or cement bollards 14 00:00:23,070 --> 00:00:24,600 outside our offices to keep cars 15 00:00:24,600 --> 00:00:26,010 from getting too close to the building. 16 00:00:26,010 --> 00:00:27,390 We can install surveillance cameras 17 00:00:27,390 --> 00:00:29,370 around the perimeter and throughout our parking lots. 18 00:00:29,370 --> 00:00:30,840 We can have roving security guards 19 00:00:30,840 --> 00:00:32,940 with guns walking around the perimeter of the building. 20 00:00:32,940 --> 00:00:34,590 We can install access control vestibules 21 00:00:34,590 --> 00:00:36,240 at the entry point of our buildings. 22 00:00:36,240 --> 00:00:39,060 And we can even place armed security guards in our lobby. 23 00:00:39,060 --> 00:00:41,820 But once that person crosses through our lobby 24 00:00:41,820 --> 00:00:44,010 and is able to access our secure spaces, 25 00:00:44,010 --> 00:00:46,080 they're now roaming freely through our halls 26 00:00:46,080 --> 00:00:48,120 and looking for areas that they can exploit 27 00:00:48,120 --> 00:00:51,450 inside of our organizations to access our sensitive data. 28 00:00:51,450 --> 00:00:53,640 So how do we keep people out of those offices 29 00:00:53,640 --> 00:00:55,320 that can contain sensitive information? 30 00:00:55,320 --> 00:00:56,610 Well, quite simply, 31 00:00:56,610 --> 00:00:58,260 we use door locks. 32 00:00:58,260 --> 00:01:00,390 Now, door locks are physical security controls 33 00:01:00,390 --> 00:01:02,940 that are designed to secure entryways by restricting 34 00:01:02,940 --> 00:01:06,090 and regulating access to a particular space or property. 35 00:01:06,090 --> 00:01:08,400 These door locks can act as a primary barrier 36 00:01:08,400 --> 00:01:10,230 against unauthorized intrusions to ensure 37 00:01:10,230 --> 00:01:12,900 that only individuals with the appropriate key, code, 38 00:01:12,900 --> 00:01:16,110 or access method can open the lock and gain entry. 39 00:01:16,110 --> 00:01:18,720 These door locks really do play a foundational role 40 00:01:18,720 --> 00:01:20,490 in safeguarding your digital assets, 41 00:01:20,490 --> 00:01:22,140 information, and individuals 42 00:01:22,140 --> 00:01:24,900 from potential threats or unauthorized access. 43 00:01:24,900 --> 00:01:26,640 Now, these door locks are often placed 44 00:01:26,640 --> 00:01:28,650 on the outside of the building's main entrance 45 00:01:28,650 --> 00:01:29,880 as well as inside the building 46 00:01:29,880 --> 00:01:32,190 on different server room doors, network closets, 47 00:01:32,190 --> 00:01:35,190 and other areas we want to remain safe and secure. 48 00:01:35,190 --> 00:01:38,160 Unfortunately though, not all door locks are created equal, 49 00:01:38,160 --> 00:01:39,900 and some are going to offer us higher levels 50 00:01:39,900 --> 00:01:41,670 of protection than others. 51 00:01:41,670 --> 00:01:43,710 For example, I've seen many people who use 52 00:01:43,710 --> 00:01:46,710 a simple padlock to try to secure their network closet 53 00:01:46,710 --> 00:01:48,060 that contains sensitive equipment, 54 00:01:48,060 --> 00:01:49,470 like routers and switches, 55 00:01:49,470 --> 00:01:52,290 or to secure a filing cabinet that contains classified 56 00:01:52,290 --> 00:01:54,060 or proprietary information. 57 00:01:54,060 --> 00:01:56,940 The problem is that a skilled attacker can defeat a padlock 58 00:01:56,940 --> 00:01:59,100 in about 15 seconds or less. 59 00:01:59,100 --> 00:01:59,940 Don't believe me. 60 00:01:59,940 --> 00:02:01,950 Let me prove it to you right now. 61 00:02:01,950 --> 00:02:04,440 So to do this demonstration, we're going to use four things. 62 00:02:04,440 --> 00:02:06,030 I have a standard padlock. 63 00:02:06,030 --> 00:02:07,920 I have the keys for that padlock. 64 00:02:07,920 --> 00:02:09,539 I have a lock pick. 65 00:02:09,539 --> 00:02:11,580 In this case, it is a single lock pick 66 00:02:11,580 --> 00:02:12,960 that will have one single tooth 67 00:02:12,960 --> 00:02:14,790 that will try to move the pins up and down. 68 00:02:14,790 --> 00:02:16,260 And I have a tension wrench. 69 00:02:16,260 --> 00:02:18,840 So first I'll show you that the standard padlock, 70 00:02:18,840 --> 00:02:20,190 and you can see this is see-through 71 00:02:20,190 --> 00:02:22,110 so you can actually see inside of it 72 00:02:22,110 --> 00:02:24,780 we're going to put the key in just like we normally would, 73 00:02:24,780 --> 00:02:27,600 we will open it, and you can see it's just a standard lock, 74 00:02:27,600 --> 00:02:28,920 it opens to the right. 75 00:02:28,920 --> 00:02:31,920 And if we take the key out, we can lock it again. 76 00:02:31,920 --> 00:02:34,860 So now what we're going to do is we're going to take 77 00:02:34,860 --> 00:02:37,320 the tension wrench and we're going to place it 78 00:02:37,320 --> 00:02:39,093 into the keyhole at the bottom. 79 00:02:43,050 --> 00:02:44,640 Now when we go to open the lock, 80 00:02:44,640 --> 00:02:46,410 we want to be able to turn it to the right. 81 00:02:46,410 --> 00:02:48,750 So I'm going to constantly apply just a little bit of pressure 82 00:02:48,750 --> 00:02:51,390 with my pinky to hold that in place. 83 00:02:51,390 --> 00:02:52,740 And then I'm going to use the lock pick 84 00:02:52,740 --> 00:02:55,500 and I'm going to pick each of those six pins 85 00:02:55,500 --> 00:02:57,570 to find the right place for them. 86 00:02:57,570 --> 00:03:00,720 And once we get them right, the lock will open. 87 00:03:00,720 --> 00:03:02,010 You can see just how quickly 88 00:03:02,010 --> 00:03:05,940 and easily it is to be able to pick a lock in this manner. 89 00:03:05,940 --> 00:03:07,650 All right, so as you can probably guess by now, 90 00:03:07,650 --> 00:03:09,180 I'm not a big fan of padlocks 91 00:03:09,180 --> 00:03:11,550 because they are not very good for our security. 92 00:03:11,550 --> 00:03:14,400 These padlocks use a basic pin and tumbler system 93 00:03:14,400 --> 00:03:17,220 that is really easy to defeat if you know what you're doing. 94 00:03:17,220 --> 00:03:19,620 But many door locks simply aren't much better. 95 00:03:19,620 --> 00:03:20,820 Because most door locks, 96 00:03:20,820 --> 00:03:22,950 like the one on your bedroom or bathroom door, 97 00:03:22,950 --> 00:03:24,450 you can simply defeat that by sticking 98 00:03:24,450 --> 00:03:27,270 a long and slender rod or needle into that hole, 99 00:03:27,270 --> 00:03:28,920 and it'll simply pop open. 100 00:03:28,920 --> 00:03:30,840 If you have a lock with a flat slot on it 101 00:03:30,840 --> 00:03:32,520 then you can actually use a flathead screwdriver 102 00:03:32,520 --> 00:03:34,140 or a coin from your pocket to unlock 103 00:03:34,140 --> 00:03:35,700 those simple door locks. 104 00:03:35,700 --> 00:03:38,340 But most of us are going to use a more complicated door lock, 105 00:03:38,340 --> 00:03:39,990 like the one on the front of your house. 106 00:03:39,990 --> 00:03:40,920 And if you look at that one, 107 00:03:40,920 --> 00:03:44,100 it uses a traditional key to lock and unlock the door. 108 00:03:44,100 --> 00:03:45,900 Well, these are a little bit more complicated 109 00:03:45,900 --> 00:03:46,980 than a standard padlock, 110 00:03:46,980 --> 00:03:49,410 but they can still be defeated using the same techniques 111 00:03:49,410 --> 00:03:53,040 in about 30 to 60 seconds by most skilled attackers. 112 00:03:53,040 --> 00:03:55,470 Thankfully though, more complex types of door locks 113 00:03:55,470 --> 00:03:57,060 are also available to us. 114 00:03:57,060 --> 00:03:59,370 And many of the door locks on the markets these days 115 00:03:59,370 --> 00:04:02,160 use electronic mechanisms to provide better protection, 116 00:04:02,160 --> 00:04:04,950 such as using an identification number, a wireless signal, 117 00:04:04,950 --> 00:04:08,250 or some kind of biometric to unlock or lock that door. 118 00:04:08,250 --> 00:04:09,540 Now, one of the most commonly used 119 00:04:09,540 --> 00:04:12,633 electronic door locks you're going to find is ones 120 00:04:12,633 --> 00:04:13,920 that rely on an identification number. 121 00:04:13,920 --> 00:04:15,960 For example, at my recording studio 122 00:04:15,960 --> 00:04:17,670 we have an electronic door lock that uses 123 00:04:17,670 --> 00:04:19,980 an eight digit personal identification number 124 00:04:19,980 --> 00:04:23,070 to allow our instructors to go into or out of our studios. 125 00:04:23,070 --> 00:04:24,780 Since it uses an eight digit number 126 00:04:24,780 --> 00:04:26,850 there's a 1 in 100 million chance 127 00:04:26,850 --> 00:04:30,120 that somebody could randomly guess my identification number. 128 00:04:30,120 --> 00:04:32,310 Also, these locks can also be configured 129 00:04:32,310 --> 00:04:33,690 so that each person is using 130 00:04:33,690 --> 00:04:37,110 their own unique identification number to access our studio. 131 00:04:37,110 --> 00:04:39,570 This way, we can actually log all of that access 132 00:04:39,570 --> 00:04:41,580 into our entry log as a form of auditing 133 00:04:41,580 --> 00:04:43,620 and accounting so we know who is in the studio 134 00:04:43,620 --> 00:04:45,300 and at what time. 135 00:04:45,300 --> 00:04:46,590 Another commonly used technology 136 00:04:46,590 --> 00:04:48,870 with door locks is wireless signals. 137 00:04:48,870 --> 00:04:50,130 For example, at my home 138 00:04:50,130 --> 00:04:52,320 I can open my front door using my smartphone 139 00:04:52,320 --> 00:04:54,570 by tapping it to the front door to unlock it 140 00:04:54,570 --> 00:04:57,750 and sending out a NFC, or Near Field Communication signal, 141 00:04:57,750 --> 00:04:59,100 and the door will then unlock, 142 00:04:59,100 --> 00:05:01,440 based on the fact that I have my smartphone. 143 00:05:01,440 --> 00:05:04,170 Alternatively, I also have seen locks that use wifi, 144 00:05:04,170 --> 00:05:08,190 Bluetooth, and RFID to be able to lock or unlock your doors. 145 00:05:08,190 --> 00:05:09,960 Another commonly used form of authentication 146 00:05:09,960 --> 00:05:12,480 with modern door locks is the use of biometrics, 147 00:05:12,480 --> 00:05:13,980 like facial recognition scans 148 00:05:13,980 --> 00:05:16,350 or fingerprint identification scans. 149 00:05:16,350 --> 00:05:18,900 In fact, my server room door here at the offices 150 00:05:18,900 --> 00:05:21,840 actually uses a biometric lock that allows me to lock 151 00:05:21,840 --> 00:05:24,990 or unlock that door simply using my index finger. 152 00:05:24,990 --> 00:05:27,120 Similarly to a personal identification number, 153 00:05:27,120 --> 00:05:28,710 we can also configure this lock 154 00:05:28,710 --> 00:05:30,630 to use each person's own fingerprint, 155 00:05:30,630 --> 00:05:33,180 and then each entry or exit is logged for accounting 156 00:05:33,180 --> 00:05:35,970 and auditing purposes based on that fingerprint. 157 00:05:35,970 --> 00:05:38,550 Now, biometrics relies on your physical characteristics 158 00:05:38,550 --> 00:05:40,230 to identify a person properly, 159 00:05:40,230 --> 00:05:41,670 and this is most commonly done using 160 00:05:41,670 --> 00:05:42,990 something like a fingerprint, 161 00:05:42,990 --> 00:05:44,880 scanning the retina inside of your eye, 162 00:05:44,880 --> 00:05:46,680 or by measuring the distance between different parts 163 00:05:46,680 --> 00:05:49,770 of your face when conducting a facial recognition scan. 164 00:05:49,770 --> 00:05:52,020 All these are considered to be an inherence factor 165 00:05:52,020 --> 00:05:53,970 or something you are in terms 166 00:05:53,970 --> 00:05:56,220 of the five factors of authentication. 167 00:05:56,220 --> 00:05:57,810 Now, when we talk about biometrics 168 00:05:57,810 --> 00:05:59,400 what we're really focusing on here is 169 00:05:59,400 --> 00:06:01,920 that something you are, because this is a part of you, 170 00:06:01,920 --> 00:06:03,600 it's your eye, it's your fingerprint, 171 00:06:03,600 --> 00:06:05,580 it's your voice, it's something that is innately 172 00:06:05,580 --> 00:06:08,940 a part of your ability and part of you as a person. 173 00:06:08,940 --> 00:06:10,470 Now, when we talk about fingerprints, 174 00:06:10,470 --> 00:06:12,151 fingerprints have become 175 00:06:12,151 --> 00:06:13,470 a really common identification system. 176 00:06:13,470 --> 00:06:15,420 And at this point it's gone beyond door locks 177 00:06:15,420 --> 00:06:17,460 and now it's integrated into most of our smartphones, 178 00:06:17,460 --> 00:06:19,110 tablets, and laptops as well 179 00:06:19,110 --> 00:06:21,210 for us to be able to log into our devices. 180 00:06:21,210 --> 00:06:23,010 For example, if you have an iPhone 181 00:06:23,010 --> 00:06:25,290 that's between a 5s model all the way up through 182 00:06:25,290 --> 00:06:29,460 the 8 series, those used a thumbprint login called Touch ID. 183 00:06:29,460 --> 00:06:30,780 Whenever you press your index finger 184 00:06:30,780 --> 00:06:33,030 or your thumb to the sensor, it's going to be able to read that 185 00:06:33,030 --> 00:06:35,250 and then identify you and log you in. 186 00:06:35,250 --> 00:06:36,600 Now in newer iPhones though, 187 00:06:36,600 --> 00:06:38,070 they've done away with touch ID 188 00:06:38,070 --> 00:06:40,440 and instead they're now using face ID. 189 00:06:40,440 --> 00:06:42,840 So if you have an iPhone 10 or newer 190 00:06:42,840 --> 00:06:44,580 they actually have a front facing camera 191 00:06:44,580 --> 00:06:47,010 that will scan your face and measure the distance between 192 00:06:47,010 --> 00:06:50,190 different areas of your face to uniquely identify you. 193 00:06:50,190 --> 00:06:51,270 This allows you to just hold up 194 00:06:51,270 --> 00:06:52,520 the phone in front of you 195 00:06:53,389 --> 00:06:54,390 and then log you in automatically by identifying 196 00:06:54,390 --> 00:06:57,150 that it is you who's holding that particular phone. 197 00:06:57,150 --> 00:06:59,490 Now, these types of devices are also being integrated 198 00:06:59,490 --> 00:07:02,460 into our door locks and physical access control systems too, 199 00:07:02,460 --> 00:07:04,650 like our access control vestibules. 200 00:07:04,650 --> 00:07:07,380 I used to work in one high security area where every day 201 00:07:07,380 --> 00:07:08,760 I had to use a retinal scanner 202 00:07:08,760 --> 00:07:10,920 to gain access to that facility. 203 00:07:10,920 --> 00:07:12,480 I've also worked in places that simply used 204 00:07:12,480 --> 00:07:13,860 a fingerprint or a PIN that allowed me 205 00:07:13,860 --> 00:07:16,110 to get through that access control vestibule. 206 00:07:16,110 --> 00:07:18,748 It really does depend on how your system wants 207 00:07:18,748 --> 00:07:20,940 to be set up and how much security your organization needs 208 00:07:20,940 --> 00:07:23,250 based on the information it's trying to protect. 209 00:07:23,250 --> 00:07:24,720 Now, when it comes to biometrics, 210 00:07:24,720 --> 00:07:27,360 we do have a couple of challenges that we need to focus on, 211 00:07:27,360 --> 00:07:28,800 and namely this comes down 212 00:07:28,800 --> 00:07:31,140 to the acceptance and rejection rates. 213 00:07:31,140 --> 00:07:33,090 Obviously, since we're using biometrics 214 00:07:33,090 --> 00:07:34,410 as a form of authentication, 215 00:07:34,410 --> 00:07:37,060 we should be worried about its False Acceptance Rate. 216 00:07:37,971 --> 00:07:40,980 The False Acceptance Rate, also known as the FAR, 217 00:07:40,980 --> 00:07:43,830 is the rate that the system authenticates a user as valid, 218 00:07:43,830 --> 00:07:46,110 even though that person should not have been granted access 219 00:07:46,110 --> 00:07:47,160 to the system. 220 00:07:47,160 --> 00:07:49,800 For example, if you walked up to the fingerprint reader, 221 00:07:49,800 --> 00:07:50,730 placed your finger on it, 222 00:07:50,730 --> 00:07:53,670 and it accepts you because the system thought you were me, 223 00:07:53,670 --> 00:07:56,010 that would be considered a false acceptance. 224 00:07:56,010 --> 00:07:57,150 To prevent unauthorized people 225 00:07:57,150 --> 00:07:59,280 from entering the building or using our systems, 226 00:07:59,280 --> 00:08:01,680 we want to ideally get that False Acceptance Rate 227 00:08:01,680 --> 00:08:05,460 down to zero by increasing the sensitivity of our scanners. 228 00:08:05,460 --> 00:08:06,900 Now, on the other side of the spectrum 229 00:08:06,900 --> 00:08:08,850 we also have a false rejection. 230 00:08:08,850 --> 00:08:09,990 Now, a lot of people think 231 00:08:09,990 --> 00:08:11,760 that a false rejection is not a problem, 232 00:08:11,760 --> 00:08:13,920 but this is actually just as big of a problem for us 233 00:08:13,920 --> 00:08:15,600 as a false acceptance. 234 00:08:15,600 --> 00:08:17,430 Let's go back to that last example. 235 00:08:17,430 --> 00:08:18,960 Let's say I increase the sensitivity 236 00:08:18,960 --> 00:08:20,970 of the fingerprint scanner to attempt to eliminate 237 00:08:20,970 --> 00:08:23,283 all of the False Acceptance Rates, or FAR, 238 00:08:24,343 --> 00:08:25,890 that we were getting so that way 239 00:08:25,890 --> 00:08:26,723 I can make sure nobody's getting in the system 240 00:08:26,723 --> 00:08:28,800 except those who are authorized to do it. 241 00:08:28,800 --> 00:08:30,780 The problem with this is that I may inadvertently 242 00:08:30,780 --> 00:08:34,049 also increase my False Rejection Rate, or FRR, 243 00:08:34,049 --> 00:08:36,419 because the scanner is now too sensitive. 244 00:08:36,419 --> 00:08:38,010 A false rejection is going to occur 245 00:08:38,010 --> 00:08:40,500 anytime the biometric system denies a user 246 00:08:40,500 --> 00:08:42,780 who should have been allowed access to the system. 247 00:08:42,780 --> 00:08:45,510 So using the login with the finger as an example, 248 00:08:45,510 --> 00:08:47,310 let's assume you're able to log in as me 249 00:08:47,310 --> 00:08:48,870 using your fingerprint. 250 00:08:48,870 --> 00:08:51,600 Now I increase the sensitivity up to the highest level. 251 00:08:51,600 --> 00:08:53,970 Now when you try to log in, it's going to reject you 252 00:08:53,970 --> 00:08:56,550 and there are no more false acceptances happening. 253 00:08:56,550 --> 00:08:59,190 But about half the time when I try to log in 254 00:08:59,190 --> 00:09:00,690 I'm also being rejected, 255 00:09:00,690 --> 00:09:02,940 even though I'm supposed to be authorized. 256 00:09:02,940 --> 00:09:05,100 Now, this is the idea of a false rejection 257 00:09:05,100 --> 00:09:07,470 and why it's also considered to be a big problem for us, 258 00:09:07,470 --> 00:09:09,030 because it's failing to allow me 259 00:09:09,030 --> 00:09:10,530 to authenticate half of the time, 260 00:09:10,530 --> 00:09:12,750 which means half of the time I can't get into the building 261 00:09:12,750 --> 00:09:14,190 to do my job. 262 00:09:14,190 --> 00:09:16,260 So how can I perfectly tune the system 263 00:09:16,260 --> 00:09:19,200 to eliminate the false acceptance and the false rejections? 264 00:09:19,200 --> 00:09:21,060 Well, we try to achieve a good balance 265 00:09:21,060 --> 00:09:23,850 between these by where we find the False Acceptance Rate 266 00:09:23,850 --> 00:09:26,400 and the False Rejection Rate becoming equal. 267 00:09:26,400 --> 00:09:28,950 This equal point is known as the Equal Error Rate, 268 00:09:28,950 --> 00:09:31,170 or EER, but most commonly you'll hear people 269 00:09:31,170 --> 00:09:33,150 call this the Crossover Error Rate, 270 00:09:33,150 --> 00:09:36,480 or CER, out in the cybersecurity industry. 271 00:09:36,480 --> 00:09:38,400 This is because your False Acceptance Rate 272 00:09:38,400 --> 00:09:40,830 and your False Rejection Rate are intersecting 273 00:09:40,830 --> 00:09:42,780 at that specific point where they're equal, 274 00:09:42,780 --> 00:09:45,030 which is the Crossover Error Rate. 275 00:09:45,030 --> 00:09:46,920 This Crossover Error Rate is really important 276 00:09:46,920 --> 00:09:48,120 because it's used as a measure 277 00:09:48,120 --> 00:09:50,940 as the effectiveness of a given biometric system. 278 00:09:50,940 --> 00:09:52,500 So if you're going out there looking 279 00:09:52,500 --> 00:09:54,810 to purchase a fingerprint enabled lock, 280 00:09:54,810 --> 00:09:56,100 you want to make sure you're checking 281 00:09:56,100 --> 00:09:57,900 what is the Crossover Error Rate, 282 00:09:57,900 --> 00:10:00,750 and you can use this as a factor in your decision making. 283 00:10:00,750 --> 00:10:02,520 The lower the Crossover Error Rate 284 00:10:02,520 --> 00:10:04,440 the better that lock is going to be. 285 00:10:04,440 --> 00:10:06,000 You don't want one that has a huge error 286 00:10:06,000 --> 00:10:08,010 to the positive side or the negative side. 287 00:10:08,010 --> 00:10:10,470 Instead, we want to have a good Crossover Error Rate 288 00:10:10,470 --> 00:10:11,940 so that we are letting the people in 289 00:10:11,940 --> 00:10:13,440 that are supposed to be authenticated 290 00:10:13,440 --> 00:10:15,330 and rejecting those who should not be allowed 291 00:10:15,330 --> 00:10:16,620 into our system. 292 00:10:16,620 --> 00:10:18,570 Now, many of these modern electronic door locks 293 00:10:18,570 --> 00:10:21,120 will also combine multiple authentication factors 294 00:10:21,120 --> 00:10:23,100 to give you additional security to be able 295 00:10:23,100 --> 00:10:24,450 to protect that area. 296 00:10:24,450 --> 00:10:27,030 For example, my server room door can be configured 297 00:10:27,030 --> 00:10:29,280 to use an eight digit personal identification number 298 00:10:29,280 --> 00:10:31,050 and your fingerprint together 299 00:10:31,050 --> 00:10:33,030 as a multi-factor authentication system 300 00:10:33,030 --> 00:10:35,130 before you're allowed into that room. 301 00:10:35,130 --> 00:10:36,390 For more complex setups, 302 00:10:36,390 --> 00:10:38,280 such as trying to gain entry to your office building 303 00:10:38,280 --> 00:10:40,289 through an access control vestibule 304 00:10:40,289 --> 00:10:41,760 that uses an electronic access system. 305 00:10:41,760 --> 00:10:43,770 You'll also find that some of these are going to 306 00:10:43,770 --> 00:10:45,990 be fully automated using an electronic badge 307 00:10:45,990 --> 00:10:48,600 and PIN system to validate the person's authorization 308 00:10:48,600 --> 00:10:50,010 to go into that building. 309 00:10:50,010 --> 00:10:52,650 So you may find that as you enter into an office building 310 00:10:52,650 --> 00:10:55,020 there's an open lobby that anybody can access, 311 00:10:55,020 --> 00:10:56,850 but then there's a set of turnstiles 312 00:10:56,850 --> 00:10:57,960 and you'll have to scan your badge 313 00:10:57,960 --> 00:11:00,227 and input your PIN number to be able 314 00:11:00,227 --> 00:11:01,140 to go past those turnstiles. 315 00:11:01,140 --> 00:11:03,510 That area between the front door and the turnstiles, 316 00:11:03,510 --> 00:11:06,180 well, that's considered an access control vestibule, 317 00:11:06,180 --> 00:11:08,280 under the design of that particular lobby. 318 00:11:08,280 --> 00:11:09,900 Once you get past those turnstiles 319 00:11:09,900 --> 00:11:11,790 you're now in the secure area because you've now 320 00:11:11,790 --> 00:11:14,610 been authenticated using multifactor authentication 321 00:11:14,610 --> 00:11:16,860 by having a token, your identification badge, 322 00:11:16,860 --> 00:11:18,690 and a PIN that you entered in, 323 00:11:18,690 --> 00:11:21,360 which is something you have and something you know. 324 00:11:21,360 --> 00:11:23,550 Now, the final type of door lock you should aware of 325 00:11:23,550 --> 00:11:26,310 is an older type of lock known as a cipher lock. 326 00:11:26,310 --> 00:11:28,470 A cipher lock provides excellent protection 327 00:11:28,470 --> 00:11:30,450 using a mechanical locking mechanism 328 00:11:30,450 --> 00:11:32,040 with push buttons that are numbered 329 00:11:32,040 --> 00:11:34,320 and require a person to enter the correct combination 330 00:11:34,320 --> 00:11:36,000 in order to open that door. 331 00:11:36,000 --> 00:11:38,370 These are often used on server rooms, network closets, 332 00:11:38,370 --> 00:11:40,290 and other high security locations. 333 00:11:40,290 --> 00:11:41,730 They do tend to cost a little bit more 334 00:11:41,730 --> 00:11:43,200 than a traditional office lock, 335 00:11:43,200 --> 00:11:44,760 but they do have the ability to give you 336 00:11:44,760 --> 00:11:46,500 a higher level of protection too. 337 00:11:46,500 --> 00:11:48,510 In fact, the Dion Training offices 338 00:11:48,510 --> 00:11:50,940 uses a mechanical cipher lock on our front door 339 00:11:50,940 --> 00:11:52,710 to our building and requires that you enter 340 00:11:52,710 --> 00:11:54,390 an eight eight digit identification number 341 00:11:54,390 --> 00:11:56,220 in order to unlock our door. 342 00:11:56,220 --> 00:11:57,870 Now remember, door locks are 343 00:11:57,870 --> 00:11:59,880 an important physical security control measure 344 00:11:59,880 --> 00:12:01,320 that you're going to be able to use to protect 345 00:12:01,320 --> 00:12:03,990 your sensitive data and systems out in the real world. 346 00:12:03,990 --> 00:12:05,490 While organizations invest heavily 347 00:12:05,490 --> 00:12:08,370 in external security measures, such as electrified fences, 348 00:12:08,370 --> 00:12:10,620 surveillance cameras, and security personnel, 349 00:12:10,620 --> 00:12:12,780 the actual moment of vulnerability arises 350 00:12:12,780 --> 00:12:14,760 when unauthorized individuals gain access 351 00:12:14,760 --> 00:12:16,110 to the building's interior. 352 00:12:17,260 --> 00:12:19,110 Door locks can serve as a primary defense mechanism 353 00:12:19,110 --> 00:12:20,460 to restrict unauthorized access 354 00:12:20,460 --> 00:12:22,200 to your most sensitive of spaces. 355 00:12:22,200 --> 00:12:23,910 However, not all door locks offer 356 00:12:23,910 --> 00:12:25,320 the same protection levels. 357 00:12:25,320 --> 00:12:26,340 Traditional padlocks 358 00:12:26,340 --> 00:12:28,710 and basic door locks can easily be defeated 359 00:12:28,710 --> 00:12:30,600 in about 60 seconds or less. 360 00:12:30,600 --> 00:12:32,220 Whereas modern electronic door locks, 361 00:12:32,220 --> 00:12:34,710 which rely on identification numbers, wireless signals, 362 00:12:34,710 --> 00:12:38,100 or biometrics, can offer more robust forms of security. 363 00:12:38,100 --> 00:12:40,650 The effectiveness of the biometric systems is measured 364 00:12:40,650 --> 00:12:43,410 by their False Acceptance Rate and the False Rejection Rate, 365 00:12:43,410 --> 00:12:44,243 and you should aim 366 00:12:44,243 --> 00:12:46,980 for a balanced Crossover Error Rate to achieve the best mix 367 00:12:46,980 --> 00:12:49,740 of security and convenience for your organization 368 00:12:49,740 --> 00:12:51,990 when using a biometric powered lock. 369 00:12:51,990 --> 00:12:54,150 The combination of multiple authentication factors, 370 00:12:54,150 --> 00:12:56,370 such as using a fingerprint and a PIN 371 00:12:56,370 --> 00:12:58,050 or an access card and a PIN, 372 00:12:58,050 --> 00:13:00,690 can also increase your physical security posture. 373 00:13:00,690 --> 00:13:02,760 We also talked about various types of door locks 374 00:13:02,760 --> 00:13:04,260 including mechanical cipher locks, 375 00:13:04,260 --> 00:13:05,970 sophisticated vestibule systems, 376 00:13:05,970 --> 00:13:07,860 and other forms of electronic door locks 377 00:13:07,860 --> 00:13:10,200 that authenticate individuals before granting them access 378 00:13:10,200 --> 00:13:12,723 to your secure areas to better protect your data.