Title: Physical Access Controls
Course: IN 2001 Principle of Information Assurance > Section: Module 9: Chapter Nine

Physical Access Controls
1. A number of physical access controls are uniquely suited to governing the movement of people within an organization’s facilities.
2. These controls include biometrics, smart cards and wireless enabled keycards.
3. Before examining access controls, the concept of a secure facility and its design needs to be understood.
4. From the point of view of facilities management, a secure facility is a physical location that has been engineered with controls designed to minimize the risk of attacks from physical threats.
5. A secure facility can use the natural terrain, traffic flow and urban development to its advantage.
6. A security facility can complement these features with protection mechanisms, such as fences, gates, walls, guards and alarms.

Physical Security Controls

There are a number of physical security controls and issues that the organization’s communities of interest should consider when implementing physical security:

- Walls, fencing and gates
- Guards
- Dogs
- ID cards and badges
- Locks and keys
- Mantraps
- Electronic monitoring
- Alarms and alarm systems
- Computer rooms
- Walls and doors

1. Walls, Fencing and Gates
  - While not every organization needs to implement external perimeter controls, walls and fences with suitably constructed gates are an essential starting point for organizations whose employees require access to the real estate the organization owns or controls.
2. Guards
  - Guards can evaluate each situation as it arises and make reasoned responses.  Most guards have clear standard operating procedures (SOPs) that help them to act decisively in unfamiliar situations.
3. Dogs
  - Guard dogs are useful because their keen sense of smell and hearing can detect intrusions that human guards cannot and they can be placed in harm’s way when necessary to avoid risking the life of a human.
4. ID Cards and Badges
  - One area of access control that ties physical security with information access control is the use of identification cards (ID) and name badges
  - An ID card is typically worn concealed, whereas a name badge is visible
  - These devices are forms of biometrics (facial recognition) that identify and authenticate an authorized individual with access to the facility
  - With the addition of a magnetic strip or radio chip, the ID card can provide access control
  - A name badge or ID should not be the only control for access to restricted areas, as they can be easily duplicated, stolen and modified
  - Tailgating occurs when an authorized individual presents a key and a door is opened, but other individuals, who may or may not be authorized, also enter the unlocked door
5. Locks and Keys
  - There are two types of locks: mechanical and electromechanical
  - The mechanical lock relies on a key that is a carefully shaped piece of metal, which a person rotates to turn tumblers to release secured loops of steel, aluminum or brass (as in, for example, brass padlocks)
  - The electromechanical lock can accept a variety of inputs, including keys that are magnetic strips on ID cards, radio signals from name badges and PINs typed into a keypad
  - Locks are divided into four categories: manual, programmable, electronic and biometric
  - As part of general management’s responsibility for the physical environment, the management of keys and locks is a fundamental concern
  - Sometimes locks fail and facilities need alternative procedures for access
  - Locks fail in one of two ways: when the lock of a door fails and the door becomes unlocked, that is a fail-safe lock; when the lock of a door fails and the door remains locked, this is a fail-secure lock
6. Mantraps
  - A mantrap is a small enclosure that has different entry and exit points
  - The individual entering the facility, area, or room enters the mantrap, requests access through some form of electronic or biometric lock and key, and if verified, exits the mantrap into the facility
  - The enclosure is called a mantrap because if the individual is denied entry, the mantrap does not allow him or her to exit until a security official overrides the automatic locks of the enclosure
7. Electronic Monitoring
  - Electronic monitoring is used to record events within a specific area that guards or dogs might miss or to record events in areas where other types of physical controls are not practical
  - Monitoring frequently uses video cameras that view individuals from odd corners.  On the other end of these cameras are videocassette recorders and related machinery that capture the video feed
  - These video monitoring systems have drawbacks.  For the most part, they are reactive and do not prevent access or prohibited activity
  - They also require an individual to review the information that is collected
8. Alarms and Alarm Systems
  - Alarm systems notify the appropriate individuals when a predetermined event or activity occurs
  - This event or activity could be a fire, a break-in or intrusion, an environmental disturbance, such as flooding or an interruption in services, such as a loss of power
  - Burglar alarm systems detect intrusions into unauthorized areas and notify a local or remote security agency
  - These systems rely on the following sensors to detect the intrusion: motion detectors, thermal detectors, glass breakage detectors, weight sensors and contact sensors.
9. Computer Rooms and Wiring Closets
  - Computer rooms and wiring and communications closets are facilities that require special attention to ensure the confidentiality, integrity and availability of information.  Logical access controls are easily defeated if an attacker gains physical access to the computing equipment
  - Custodial staff members are often the least scrutinized of employees (and nonemployees) who have access to offices.  Yet custodians are given the greatest degree of unsupervised access
10. Interior Walls and Doors
  - The security of information assets can sometimes be compromised by the nature of the construction of the walls and doors of the facility
  - The walls in a facility are typically of two types: standard interior or firewall
    - All high-security areas, such as computer rooms and wiring closets, must have firewall grade walls surrounding them. This provides physical security not only from potential intruders, but also from fires
    - The doors that allow access into these types of secured rooms should also be evaluated.  Computer rooms and wiring closets can have push or crash bars installed.  Such devices meet building codes but provide much higher levels of security than the standard door pull handle