Physical Security of Computers

Why the need for physical security of computers?

Firewall and Intrusion Detection Systems (IDS) play their roles in computer security but they are not enough. A firewall might keep a system user from being able to send proprietary information out of an organisation network system by simply not allowing a connection. However, this same user could easily copy the data onto a diskette, CD, paper or tape and then carry it out in his bag or briefcase without being detected.

From the example above, it is obvious that firewalls offer excellent protection against network threats and Intrusion Detection System, if properly implemented quickly reveal any strange access, but they aren’t a complete security solution. Certain threats like the one given above are outside the control of the firewall or intrusion detection system. It is therefore the responsibility of the organisation or the owner of the computer to figure out other ways to protect against malicious insiders and unwanted outsiders. Physical security of computers is therefore to the rescue.

Physical access controls are very critical to ensuring the safety and security of:-

1) the facilities

2) the systems in these facilities and also

3) the human resources (people) working with these facilities.

Physical controls involve restricting the entry and exit of people from areas such as – office building, rooms where the network servers are located, the wiring system and where they are channelled through, communication equipment, the equipment used in controlling the atmospheric condition like the air conditioning and heating systems, back up media e.t.c

Available Physical Controls you can implement

a) Location of computer and facilities must be such that it will not be openned to direct physical attack.

b) In the building where the computer and facilities are located:

i) provide good gate at the entrance of the building,

ii) provide secure locks

iii) provide security guards

c) Within the building where the facilities are installed

i) provide swipe card (as shown below) or personnel identification cards (the two could be for employees in some cases).

ii) install closed-circuit television (CCTV)

iii) provide equipment which can prevent natural hazards like fire (smoke detector like the example shown below) and flood

iv) install intruders alarms where necessary.

v) provide against power failure by installing an uninterrupted power supply (UPS) or power surge (power stabiliser).

d) Provide protection against the cables and communication systems by:-

i) implementing concealed installation

ii) armoured conduit

iii) avoid routes which is exposed or through public access areas

iv) alternative feeds or routing in case of any incident.

e) Desktops and Laptops and their components should be protected against theft by using physical locks.