1
00:00:06,640 --> 00:00:08,430
- In this lesson 2.3,

2
00:00:08,430 --> 00:00:11,040
we're gonna focus in on physical security.

3
00:00:11,040 --> 00:00:14,340
So often, I've heard from
cybersecurity practitioners,

4
00:00:14,340 --> 00:00:16,650
it's like, "Oh physical
security, that's not my job.

5
00:00:16,650 --> 00:00:18,090
That's what building maintenance does

6
00:00:18,090 --> 00:00:19,470
or building security does."

7
00:00:19,470 --> 00:00:21,570
And I disagree.

8
00:00:21,570 --> 00:00:24,210
I think physical security
and environmental security,

9
00:00:24,210 --> 00:00:26,100
that we're gonna talk
about in the next lesson,

10
00:00:26,100 --> 00:00:28,680
absolutely are our responsibility.

11
00:00:28,680 --> 00:00:30,630
Because if our intruder, right?

12
00:00:30,630 --> 00:00:32,820
Our threat actor, our adversary,

13
00:00:32,820 --> 00:00:34,560
can get into secure areas,

14
00:00:34,560 --> 00:00:35,970
into our wiring closets,

15
00:00:35,970 --> 00:00:37,500
into our data centers

16
00:00:37,500 --> 00:00:40,860
or manipulate our environmental systems

17
00:00:40,860 --> 00:00:44,220
they can effectively own
us or even destroy us.

18
00:00:44,220 --> 00:00:47,193
So physical security, really important.

19
00:00:49,170 --> 00:00:50,790
So we define physical security

20
00:00:50,790 --> 00:00:52,800
as a protection of people, property

21
00:00:52,800 --> 00:00:55,413
and physical assets from actions or events

22
00:00:55,413 --> 00:00:57,401
that can cause damage, loss

23
00:00:57,401 --> 00:01:00,572
or unauthorized activity.

24
00:01:00,572 --> 00:01:02,250
Now, physical security is based

25
00:01:02,250 --> 00:01:03,900
upon a layered defensive model

26
00:01:03,900 --> 00:01:06,450
or defense in depth
like we've talked about.

27
00:01:06,450 --> 00:01:09,360
Now, the premise of a layered
defense model is that,

28
00:01:09,360 --> 00:01:12,720
if an intruder can bypass
one layer of controls,

29
00:01:12,720 --> 00:01:14,040
the next layer of controls

30
00:01:14,040 --> 00:01:16,560
should provide additional deterrence

31
00:01:16,560 --> 00:01:18,420
or detection capabilities.

32
00:01:18,420 --> 00:01:19,530
So this should sound familiar.

33
00:01:19,530 --> 00:01:21,120
Because it's very much
what we talked about

34
00:01:21,120 --> 00:01:25,020
in terms of control,
categories and classifications.

35
00:01:25,020 --> 00:01:26,070
In the physical world,

36
00:01:26,070 --> 00:01:28,770
we have obstacles, detective controls

37
00:01:28,770 --> 00:01:30,690
and response mechanisms.

38
00:01:30,690 --> 00:01:32,160
Obstacles, which really think of them

39
00:01:32,160 --> 00:01:33,570
as deterrent controls

40
00:01:33,570 --> 00:01:35,970
are used to frustrate trivial attackers

41
00:01:35,970 --> 00:01:38,010
and delay serious ones.

42
00:01:38,010 --> 00:01:40,170
Detective controls make it likely

43
00:01:40,170 --> 00:01:41,760
that an attack will be noticed

44
00:01:41,760 --> 00:01:44,940
and response mechanisms are used to catch

45
00:01:44,940 --> 00:01:46,893
or to impede attackers.

46
00:01:48,681 --> 00:01:50,460
Now, physical security really starts

47
00:01:50,460 --> 00:01:52,590
all the way back in the design phase.

48
00:01:52,590 --> 00:01:55,500
Now we can always retrofit
for physical security

49
00:01:55,500 --> 00:01:58,560
but that's a little bit challenging
and it can be expensive.

50
00:01:58,560 --> 00:02:00,540
But if we keep physical security in mind

51
00:02:00,540 --> 00:02:01,800
right from the very beginning,

52
00:02:01,800 --> 00:02:03,480
we'll have a better outcome.

53
00:02:03,480 --> 00:02:04,620
So I want to introduce you

54
00:02:04,620 --> 00:02:09,480
to a really interesting premise
called CPTED, C-P-T-E-D,

55
00:02:09,480 --> 00:02:10,320
which stands for

56
00:02:10,320 --> 00:02:13,380
Crime Prevention through
Environmental Design.

57
00:02:13,380 --> 00:02:16,380
And that's the idea that proper design

58
00:02:16,380 --> 00:02:18,900
and effective use of a
physical environment,

59
00:02:18,900 --> 00:02:22,920
can lead to a reduction in
the incident and fear of crime

60
00:02:22,920 --> 00:02:24,270
and an increased safety.

61
00:02:24,270 --> 00:02:28,290
And the CPTED concepts
are extremely applicable

62
00:02:28,290 --> 00:02:30,063
to physical cybersecurity.

63
00:02:31,200 --> 00:02:32,400
Now, CPTED relies

64
00:02:32,400 --> 00:02:36,000
on psychological and
sociological responses

65
00:02:36,000 --> 00:02:38,940
and there are really three constructs.

66
00:02:38,940 --> 00:02:41,010
One, that people protect territory

67
00:02:41,010 --> 00:02:42,510
that they feel is their own

68
00:02:42,510 --> 00:02:44,520
and people have a certain respect

69
00:02:44,520 --> 00:02:46,740
for the territory of others.

70
00:02:46,740 --> 00:02:49,770
Second is that, intruders
do not wanna be seen.

71
00:02:49,770 --> 00:02:53,580
And third, limiting access
discourages intruders

72
00:02:53,580 --> 00:02:55,920
or marks them as intruders.

73
00:02:55,920 --> 00:02:57,690
So when we're doing our physical design,

74
00:02:57,690 --> 00:02:59,760
we wanna keep these things in mind, right?

75
00:02:59,760 --> 00:03:01,980
The people will protect
territory they feel as their own.

76
00:03:01,980 --> 00:03:03,420
So if this is my space,

77
00:03:03,420 --> 00:03:04,950
I'm gonna protect it.

78
00:03:04,950 --> 00:03:06,330
And innately, right?

79
00:03:06,330 --> 00:03:07,590
People have a certain respect

80
00:03:07,590 --> 00:03:09,330
for the territory of others.

81
00:03:09,330 --> 00:03:10,980
Insures definitely don't wanna be seen.

82
00:03:10,980 --> 00:03:13,650
So we don't wanna give them a
lot of hiding spaces, right?

83
00:03:13,650 --> 00:03:15,187
And limiting access says,

84
00:03:15,187 --> 00:03:17,829
"Okay well if you got in,

85
00:03:17,829 --> 00:03:19,620
we know who you are."

86
00:03:19,620 --> 00:03:21,180
And it marks them as intruders

87
00:03:21,180 --> 00:03:24,300
if we haven't seen maybe
that they have a badge on.

88
00:03:24,300 --> 00:03:25,855
It's a really interesting area

89
00:03:25,855 --> 00:03:28,532
if you go out and just to do
a little research on CPTED,

90
00:03:28,532 --> 00:03:30,090
I just think it's so interesting

91
00:03:30,090 --> 00:03:31,290
how we have this convergence

92
00:03:31,290 --> 00:03:33,900
between architecture and design

93
00:03:33,900 --> 00:03:37,593
and physical security and
ultimately cybersecurity.

94
00:03:39,400 --> 00:03:40,410
Now, there are two modes

95
00:03:40,410 --> 00:03:42,720
for physical security structure controls.

96
00:03:42,720 --> 00:03:46,410
We have fail-safe and fail-secure.

97
00:03:46,410 --> 00:03:50,700
Fail-safe implies that in an
emergency or a fault situation,

98
00:03:50,700 --> 00:03:54,000
controls will default to open or unlocked.

99
00:03:54,000 --> 00:03:56,040
So if there was a problem in the building

100
00:03:56,040 --> 00:03:57,270
all doors would open.

101
00:03:57,270 --> 00:04:00,063
That would be a good example of fail-safe.

102
00:04:01,080 --> 00:04:04,290
Fail-secure implies that
an emergency controls

103
00:04:04,290 --> 00:04:06,720
will default to closed or locked.

104
00:04:06,720 --> 00:04:08,970
Again, emergency of some
kind in the building.

105
00:04:08,970 --> 00:04:10,290
Every door gets locked.

106
00:04:10,290 --> 00:04:12,240
That's fail-secure versus fail-safe.

107
00:04:12,240 --> 00:04:13,650
And we're gonna use these same terms

108
00:04:13,650 --> 00:04:15,600
a little bit later on when we're talking

109
00:04:15,600 --> 00:04:18,240
about some technical security components.

110
00:04:18,240 --> 00:04:19,350
But for now, I want you to make sure

111
00:04:19,350 --> 00:04:22,110
you know fail safe says
the emergency or fault

112
00:04:22,110 --> 00:04:25,320
all controls default to open
whatever the open posture is

113
00:04:25,320 --> 00:04:27,450
fail secure, they all will default

114
00:04:27,450 --> 00:04:29,853
to closed or the locked posture.

115
00:04:34,170 --> 00:04:35,003
Now, as I mentioned already

116
00:04:35,003 --> 00:04:36,690
and I really wanna emphasize,

117
00:04:36,690 --> 00:04:38,490
there is significant overlap

118
00:04:38,490 --> 00:04:41,100
in physical and cybersecurity controls.

119
00:04:41,100 --> 00:04:42,930
And here's an example for you.

120
00:04:42,930 --> 00:04:44,310
Using picture ID badge

121
00:04:44,310 --> 00:04:46,680
to identify oneself to security guards,

122
00:04:46,680 --> 00:04:49,470
then we use the same card
to swipe into the building.

123
00:04:49,470 --> 00:04:51,150
And then that same card might lock,

124
00:04:51,150 --> 00:04:54,210
log me into my computer
with proximity technology

125
00:04:54,210 --> 00:04:56,520
that automatically locks down the computer

126
00:04:56,520 --> 00:04:58,320
when we walk away from the desk

127
00:04:58,320 --> 00:05:00,090
and produces an audit trail

128
00:05:00,090 --> 00:05:02,040
of your whereabouts and activities.

129
00:05:02,040 --> 00:05:03,510
So more and more,

130
00:05:03,510 --> 00:05:06,180
we're using a lot of the
same tools and techniques,

131
00:05:06,180 --> 00:05:07,530
we're having this convergence

132
00:05:07,530 --> 00:05:10,710
of our cyber and physical
security controls.

133
00:05:10,710 --> 00:05:12,900
My preference in an organization is that,

134
00:05:12,900 --> 00:05:15,780
both cybersecurity and
physical security ultimately

135
00:05:15,780 --> 00:05:18,540
report up to the same management structure

136
00:05:18,540 --> 00:05:22,500
because we want to really
encourage a working relationship,

137
00:05:22,500 --> 00:05:25,533
a close working relationship
between those departments.

138
00:05:28,080 --> 00:05:31,440
So let's circle back to
some design considerations.

139
00:05:31,440 --> 00:05:33,060
Structural design can be used

140
00:05:33,060 --> 00:05:37,380
to deter, prevent and
detect unauthorized access.

141
00:05:37,380 --> 00:05:39,870
So for example, in our data center, right?

142
00:05:39,870 --> 00:05:41,700
When we cite our data center,

143
00:05:41,700 --> 00:05:43,860
assuming it's not its own
physical building, right?

144
00:05:43,860 --> 00:05:45,360
It's inside another building,

145
00:05:45,360 --> 00:05:47,880
we wanna it located in
the center of a facility

146
00:05:47,880 --> 00:05:50,220
with no external doors or windows, why?

147
00:05:50,220 --> 00:05:52,830
Because we're trying to
limit access control.

148
00:05:52,830 --> 00:05:55,230
We want it located on floors
other than the basement.

149
00:05:55,230 --> 00:05:56,880
'Cause basement might be damp,

150
00:05:56,880 --> 00:05:58,980
we might get flooding in the basement,

151
00:05:58,980 --> 00:06:00,990
might be some access
to the basement, right?

152
00:06:00,990 --> 00:06:02,130
There's gonna be other equipment

153
00:06:02,130 --> 00:06:03,930
for interference in the basement.

154
00:06:03,930 --> 00:06:04,763
The first floor,

155
00:06:04,763 --> 00:06:06,840
because the first floor
is extremely accessible.

156
00:06:06,840 --> 00:06:08,460
And the top floor, right?

157
00:06:08,460 --> 00:06:09,660
We don't wanna be at the top floor

158
00:06:09,660 --> 00:06:11,910
because we might get
access from the ceiling

159
00:06:11,910 --> 00:06:16,260
or we might get things like
leaks or damage from storms.

160
00:06:16,260 --> 00:06:17,940
We wanna make sure we have full walls,

161
00:06:17,940 --> 00:06:21,030
they extend right from the floor
all the way to the ceiling.

162
00:06:21,030 --> 00:06:23,673
And we wanna have non partition ceilings.

163
00:06:25,710 --> 00:06:27,420
Think about our elevators and stairwells

164
00:06:27,420 --> 00:06:29,730
how we move around the building.

165
00:06:29,730 --> 00:06:31,650
We can restrict access in a number of ways

166
00:06:31,650 --> 00:06:33,600
including having a keypad code.

167
00:06:33,600 --> 00:06:34,560
So you go up a stairway

168
00:06:34,560 --> 00:06:37,080
and then to get into a particular floor,

169
00:06:37,080 --> 00:06:39,090
you'd have to punch in the code

170
00:06:39,090 --> 00:06:42,240
or an RFID card in an elevator, right?

171
00:06:42,240 --> 00:06:46,020
Which the card access in which
call buttons won't register

172
00:06:46,020 --> 00:06:48,633
until that authorized card is detected.

173
00:06:50,760 --> 00:06:52,170
And then the site level,

174
00:06:52,170 --> 00:06:54,480
we have a whole array
of security controls,

175
00:06:54,480 --> 00:06:58,110
lighting signs, barriers and guards.

176
00:06:58,110 --> 00:07:01,980
Lighting for personnel safety
and for intruder deterrence

177
00:07:01,980 --> 00:07:06,300
because intruders are less
likely to enter a well-lit area.

178
00:07:06,300 --> 00:07:10,320
We have signs for personnel
safety and intruder deterrence.

179
00:07:10,320 --> 00:07:12,900
Warning signs indicate surveillance

180
00:07:12,900 --> 00:07:15,240
that somebody is paying attention, right?

181
00:07:15,240 --> 00:07:17,760
Our intruders don't wanna be seen

182
00:07:17,760 --> 00:07:20,160
and they don't wanna be found out.

183
00:07:20,160 --> 00:07:21,930
Then we can have barriers such as walls,

184
00:07:21,930 --> 00:07:24,120
fences, gates, bollards,

185
00:07:24,120 --> 00:07:25,650
bollards extensions that you might see

186
00:07:25,650 --> 00:07:26,700
maybe outside a mall

187
00:07:26,700 --> 00:07:28,950
or to direct traffic in a certain way.

188
00:07:28,950 --> 00:07:31,260
And then access control vestibules

189
00:07:31,260 --> 00:07:32,880
to define the perimeter

190
00:07:32,880 --> 00:07:36,150
and can be used to control or
divert the flow of traffic.

191
00:07:36,150 --> 00:07:38,430
Now an access control
vestibules, really interesting

192
00:07:38,430 --> 00:07:40,410
and we'll talk about that a
little bit later on as well.

193
00:07:40,410 --> 00:07:42,180
But just to give you a sense of what it is

194
00:07:42,180 --> 00:07:43,590
I want you to imagine that,

195
00:07:43,590 --> 00:07:44,730
you're trying to get into a building.

196
00:07:44,730 --> 00:07:46,320
You come through the first door,

197
00:07:46,320 --> 00:07:48,510
there's a vestibule that you're in,

198
00:07:48,510 --> 00:07:49,350
you're evaluated,

199
00:07:49,350 --> 00:07:52,110
maybe you have to do your
biometric authentication.

200
00:07:52,110 --> 00:07:53,520
That first door that just came in,

201
00:07:53,520 --> 00:07:54,390
locked behind you,

202
00:07:54,390 --> 00:07:56,070
you can't get into through the second door

203
00:07:56,070 --> 00:07:57,231
which will take you into the building

204
00:07:57,231 --> 00:07:59,400
until you've been authenticated.

205
00:07:59,400 --> 00:08:01,170
We used to refer to those as a man trap.

206
00:08:01,170 --> 00:08:04,470
We now refer to those as an
access control vestibule.

207
00:08:04,470 --> 00:08:07,200
And lastly, security guards or centuries

208
00:08:07,200 --> 00:08:09,210
which may be stationed at checkpoints.

209
00:08:09,210 --> 00:08:10,260
They patrol the area,

210
00:08:10,260 --> 00:08:11,580
they manage surveillance

211
00:08:11,580 --> 00:08:15,180
and they respond to breaches
and or suspicious activity.

212
00:08:15,180 --> 00:08:17,080
Very often there are first responders.

213
00:08:19,170 --> 00:08:20,003
And of course,

214
00:08:20,003 --> 00:08:21,780
every door is going to
have a lock of some kind.

215
00:08:21,780 --> 00:08:23,340
And there are four
different types of locks

216
00:08:23,340 --> 00:08:24,870
that you wanna be able to recognize.

217
00:08:24,870 --> 00:08:29,520
Pick resistant, electronic
smart, and biometric.

218
00:08:29,520 --> 00:08:30,720
Now a pick resistant lock

219
00:08:30,720 --> 00:08:32,850
is gonna have an extra set of tumblers.

220
00:08:32,850 --> 00:08:34,770
So they're resistant to bumping

221
00:08:34,770 --> 00:08:36,900
which is a really common way
to be able to open a door.

222
00:08:36,900 --> 00:08:40,470
And they have complex and
difficult to reproduce keys.

223
00:08:40,470 --> 00:08:41,790
An electronic lock

224
00:08:41,790 --> 00:08:45,090
will either use a keypad or a card system.

225
00:08:45,090 --> 00:08:47,790
And most of the time electronic locks

226
00:08:47,790 --> 00:08:50,520
will automatically lock the
door when they close behind you.

227
00:08:50,520 --> 00:08:52,410
So think about being in a hotel

228
00:08:52,410 --> 00:08:54,000
when you close the door,

229
00:08:54,000 --> 00:08:55,320
that's an automatic lock

230
00:08:55,320 --> 00:08:57,360
that door will close directly behind you

231
00:08:57,360 --> 00:08:58,560
and then you use a card, right?

232
00:08:58,560 --> 00:08:59,823
If you wanna get back in.

233
00:09:00,690 --> 00:09:03,360
Smart locks connect via Bluetooth

234
00:09:03,360 --> 00:09:08,250
or wifi or Z-wave to a
smartphone for access control.

235
00:09:08,250 --> 00:09:09,270
Smart locks can be

236
00:09:09,270 --> 00:09:13,080
a part of a full system of
video and audio monitoring

237
00:09:13,080 --> 00:09:16,260
and a whole bunch of
other cool IoT features.

238
00:09:16,260 --> 00:09:18,420
And lastly, biometric locks.

239
00:09:18,420 --> 00:09:21,240
Biometric locks are
designed to grant access

240
00:09:21,240 --> 00:09:23,460
based on a physiological trait.

241
00:09:23,460 --> 00:09:26,940
So a finger scan, retinal
or facial recognition.

242
00:09:26,940 --> 00:09:28,986
And we'll talk more about biometric

243
00:09:28,986 --> 00:09:30,720
little bit later on we'll talk

244
00:09:30,720 --> 00:09:33,215
about the various
different biometric markers

245
00:09:33,215 --> 00:09:34,473
that can be used.

246
00:09:36,780 --> 00:09:38,640
And then we have surveillance sensors.

247
00:09:38,640 --> 00:09:41,880
Now these are sensors
that are physical sensors

248
00:09:41,880 --> 00:09:44,130
that are used to monitor and detect

249
00:09:44,130 --> 00:09:47,760
suspicious, abnormal or unwanted behavior.

250
00:09:47,760 --> 00:09:49,740
And there's just a whole array of them.

251
00:09:49,740 --> 00:09:52,530
Passive infrared, motion, photometric

252
00:09:52,530 --> 00:09:54,990
acoustical, contact, measure,

253
00:09:54,990 --> 00:09:58,110
microwave and ultrasonic.

254
00:09:58,110 --> 00:10:00,270
A passive sensor, sometimes referred to

255
00:10:00,270 --> 00:10:02,680
as an IDS, IPS, a passive sensor

256
00:10:02,680 --> 00:10:05,490
sense changes in heat signatures.

257
00:10:05,490 --> 00:10:08,430
A motion sensor, census
changes in movement,

258
00:10:08,430 --> 00:10:11,700
a photometric change,
sense changes in light.

259
00:10:11,700 --> 00:10:13,680
Acoustical, just what it sounds like.

260
00:10:13,680 --> 00:10:15,840
Census changes in noise.

261
00:10:15,840 --> 00:10:18,300
A contact sense penetration or break

262
00:10:18,300 --> 00:10:20,340
in an electrical circuit.

263
00:10:20,340 --> 00:10:23,880
A pressure sensor changes
in surface weight.

264
00:10:23,880 --> 00:10:25,740
A microwave sensor movement

265
00:10:25,740 --> 00:10:28,050
within an invisible field of energy

266
00:10:28,050 --> 00:10:30,540
between the transmitter and the receiver.

267
00:10:30,540 --> 00:10:34,170
And an ultrasonic is a proximity sensor

268
00:10:34,170 --> 00:10:36,360
that measures the distance of a target

269
00:10:36,360 --> 00:10:38,790
by emitting ultrasonic waves

270
00:10:38,790 --> 00:10:41,010
and converting that reflective sound

271
00:10:41,010 --> 00:10:42,633
into an electronic signal.

272
00:10:43,770 --> 00:10:46,140
So all types of sensors that can be used

273
00:10:46,140 --> 00:10:50,250
to monitor and detect suspicious, abnormal

274
00:10:50,250 --> 00:10:51,813
or unwanted behavior.

275
00:10:52,920 --> 00:10:54,960
That my friends brings us
to a three second challenge.

276
00:10:54,960 --> 00:10:55,793
Are you ready?

277
00:10:55,793 --> 00:10:58,020
We've got five challenge
questions coming right up.

278
00:10:58,020 --> 00:10:59,270
Be sure to shut them out.

279
00:11:00,967 --> 00:11:03,120
"Two-tier barrier with
an entry on one side

280
00:11:03,120 --> 00:11:05,460
and an exit on the opposite side."

281
00:11:05,460 --> 00:11:07,530
I gave you its old name and its new name.

282
00:11:07,530 --> 00:11:08,363
What's it called?

283
00:11:08,363 --> 00:11:10,173
One, two, three.

284
00:11:11,400 --> 00:11:13,410
It's gonna be an access control vestibule.

285
00:11:13,410 --> 00:11:14,550
We used to call it a man trap.

286
00:11:14,550 --> 00:11:16,050
We don't call it that anymore.

287
00:11:17,250 --> 00:11:18,960
Question two, "Sensor that measures

288
00:11:18,960 --> 00:11:21,180
changes in surface weight."

289
00:11:21,180 --> 00:11:24,450
I just showed you all of those
different types of sensors.

290
00:11:24,450 --> 00:11:26,763
One, two, three,

291
00:11:27,990 --> 00:11:29,590
it's gonna be a pressure sensor.

292
00:11:31,980 --> 00:11:33,660
Number three, "Optimal location

293
00:11:33,660 --> 00:11:35,997
within a building for a data center."

294
00:11:37,260 --> 00:11:38,520
So where do we want that?

295
00:11:38,520 --> 00:11:41,613
Optimal location within a
building for a data center.

296
00:11:43,020 --> 00:11:47,546
One, two, three, centered
right in the building, right?

297
00:11:47,546 --> 00:11:49,110
We want it right in the center,

298
00:11:49,110 --> 00:11:50,319
not in the basement,

299
00:11:50,319 --> 00:11:51,152
not on the first floor.

300
00:11:51,152 --> 00:11:51,985
And then on the top floor,

301
00:11:51,985 --> 00:11:54,000
not having external doors or windows,

302
00:11:54,000 --> 00:11:55,000
right in the middle.

303
00:11:56,880 --> 00:11:59,820
Number four, "Locks are
designed to grant access

304
00:11:59,820 --> 00:12:02,187
based on a physiological trait."

305
00:12:03,360 --> 00:12:05,193
One, two, three.

306
00:12:06,870 --> 00:12:08,820
And that's gonna be biometric.

307
00:12:08,820 --> 00:12:11,587
And our last challenge,
question number five.

308
00:12:11,587 --> 00:12:12,900
"This mode implies that,

309
00:12:12,900 --> 00:12:15,600
in an emergency or fault situation,

310
00:12:15,600 --> 00:12:19,620
controls will default
to open or unlocked."

311
00:12:19,620 --> 00:12:21,210
You have two choices on this one.

312
00:12:21,210 --> 00:12:22,043
What's it gonna be?

313
00:12:22,043 --> 00:12:23,220
Which mode?

314
00:12:23,220 --> 00:12:26,070
One, two, three.

315
00:12:26,070 --> 00:12:29,040
That's gonna be fail-safe, right?

316
00:12:29,040 --> 00:12:30,900
Brings us to a
Security-in-Action case study

317
00:12:30,900 --> 00:12:33,450
where you get to apply
what you have just learned.

318
00:12:33,450 --> 00:12:34,950
Let's read a case study together

319
00:12:34,950 --> 00:12:36,300
then I'm gonna ask you a question

320
00:12:36,300 --> 00:12:37,410
then you should put me on pause

321
00:12:37,410 --> 00:12:38,310
and work through the answer

322
00:12:38,310 --> 00:12:40,980
then come back and we'll do it together.

323
00:12:40,980 --> 00:12:43,050
This is about a workplace intrusion.

324
00:12:43,050 --> 00:12:45,690
An intruder was able to
enter corporate headquarters

325
00:12:45,690 --> 00:12:47,760
through a locked loading dock door

326
00:12:47,760 --> 00:12:50,190
right past a security officer.

327
00:12:50,190 --> 00:12:52,350
Now the intruder was
wearing a delivery uniform

328
00:12:52,350 --> 00:12:56,010
maybe FedEx or UPS or the Postal Service.

329
00:12:56,010 --> 00:12:57,300
Now, outside of a clean room,

330
00:12:57,300 --> 00:13:00,750
she unsuccessfully attempted
to disable the CCTV camera.

331
00:13:00,750 --> 00:13:03,390
That's a closed circuit TV camera.

332
00:13:03,390 --> 00:13:05,670
Now, none of the IDS motion centers

333
00:13:05,670 --> 00:13:08,553
indicated anything amiss in the hallway.

334
00:13:09,480 --> 00:13:12,720
But a suspicious employee
notified security

335
00:13:12,720 --> 00:13:16,170
who initiated a fail-safe order.

336
00:13:16,170 --> 00:13:18,420
What is your analysis of this situation?

337
00:13:18,420 --> 00:13:19,500
So all of this happened.

338
00:13:19,500 --> 00:13:20,333
What do you think?

339
00:13:20,333 --> 00:13:21,166
What went wrong?

340
00:13:21,166 --> 00:13:22,020
What went right?

341
00:13:22,020 --> 00:13:23,340
What was good, what was bad?

342
00:13:23,340 --> 00:13:24,810
What could have been improved?

343
00:13:24,810 --> 00:13:27,783
Go ahead and put me on pause
and write up your analysis.

344
00:13:32,130 --> 00:13:32,963
Well, first of all,

345
00:13:32,963 --> 00:13:35,040
there were several control failures.

346
00:13:35,040 --> 00:13:37,980
The intruder successfully
got into the building.

347
00:13:37,980 --> 00:13:39,240
Now my guess is, right?

348
00:13:39,240 --> 00:13:41,490
They used social engineering techniques,

349
00:13:41,490 --> 00:13:43,980
they dressed as that delivery person.

350
00:13:43,980 --> 00:13:46,200
Maybe they were carrying
a lot of boxes, right?

351
00:13:46,200 --> 00:13:48,480
So someone said, "Oh, that's UPS or FedEx

352
00:13:48,480 --> 00:13:50,370
or the Postal Service,
we gotta let them in."

353
00:13:50,370 --> 00:13:52,170
And came and opened the door for them.

354
00:13:52,170 --> 00:13:53,730
'Cause maybe they were
carrying a lot of boxes

355
00:13:53,730 --> 00:13:55,230
or they were wheeling them in.

356
00:13:55,230 --> 00:13:56,820
So the intruder successfully used

357
00:13:56,820 --> 00:13:59,770
those social engineering
techniques to get in the building.

358
00:14:00,930 --> 00:14:03,180
There was a CCTV system,

359
00:14:03,180 --> 00:14:05,190
but it wasn't being monitored

360
00:14:05,190 --> 00:14:07,080
because if it was being monitored,

361
00:14:07,080 --> 00:14:10,950
the fact that the intruder was
trying to disable that camera

362
00:14:10,950 --> 00:14:12,423
somebody would've seen it.

363
00:14:13,950 --> 00:14:17,580
Now, IDS motion centers in
public spaces like a hallway

364
00:14:17,580 --> 00:14:19,710
are generally not in use
during business hours

365
00:14:19,710 --> 00:14:21,630
because they would go
off all the time, right?

366
00:14:21,630 --> 00:14:24,120
So they should not have
ever been relied upon

367
00:14:24,120 --> 00:14:26,043
in this particular situation.

368
00:14:27,600 --> 00:14:29,340
And fail safe, right?

369
00:14:29,340 --> 00:14:31,680
Would've unlocked all exit doors

370
00:14:31,680 --> 00:14:34,653
making it easy for the intruder to escape.

371
00:14:35,550 --> 00:14:36,720
Now, on the other hand, right?

372
00:14:36,720 --> 00:14:38,850
Maybe we didn't wanna
go into fail-secure mode

373
00:14:38,850 --> 00:14:40,440
'cause we locked everything down.

374
00:14:40,440 --> 00:14:42,600
Maybe our intruder
would've panicked, right?

375
00:14:42,600 --> 00:14:45,540
And maybe there could have
been some additional danger.

376
00:14:45,540 --> 00:14:47,820
But fail safe opened every door

377
00:14:47,820 --> 00:14:49,920
which means that made it easy to escape

378
00:14:49,920 --> 00:14:51,420
but also maybe made it easy

379
00:14:51,420 --> 00:14:54,630
for that intruder to
get into secure places.

380
00:14:54,630 --> 00:14:56,193
So it wasn't a very good idea.

381
00:14:57,600 --> 00:14:59,340
Okay, so what was the
good news in all this?

382
00:14:59,340 --> 00:15:02,340
The good news was that an employee, right?

383
00:15:02,340 --> 00:15:04,080
Saw something going on.

384
00:15:04,080 --> 00:15:06,750
So saw something, said something, right?

385
00:15:06,750 --> 00:15:09,060
The employee reported
the suspicious activity.

386
00:15:09,060 --> 00:15:10,110
And that's awesome.

387
00:15:10,110 --> 00:15:11,760
And that's the thing we try to teach a lot

388
00:15:11,760 --> 00:15:13,710
in our security awareness classes.

389
00:15:13,710 --> 00:15:16,260
See something, say something.

390
00:15:16,260 --> 00:15:19,020
So being able to analyze
situations like this

391
00:15:19,020 --> 00:15:21,870
and come to conclusions
that will allow you

392
00:15:21,870 --> 00:15:23,760
to have continuous improvement,

393
00:15:23,760 --> 00:15:26,210
that my friends is definitely
Security-in-Action.

394
00:15:27,210 --> 00:15:28,680
All right, there's your word cloud.

395
00:15:28,680 --> 00:15:30,000
You know what to do.

396
00:15:30,000 --> 00:15:32,250
No moving on, until you can recognize

397
00:15:32,250 --> 00:15:34,980
all of these terms on this word cloud.

398
00:15:34,980 --> 00:15:36,060
And when you're ready,

399
00:15:36,060 --> 00:15:37,643
I'll see you in the next lesson.