Week 3 1) Security’s not how it was like back in the days, where all they did was lock away mainframes in the server room. Times have changed, technology has advanced and now comes in many forms. Security is very crucial to any organization, and physical security is no exception. Organizations are not just prone to cyber attacks, but as well breaking and entering, trespassing, natural disaster, fire, flood and much more. Physical security protects people, data, equipment’s, systems and facilities etc. Facility management is very important to any organization. It protects company assets. CPTED “is a discipline that outlines how the proper design of a physical environment can reduce crime by directly affecting human behavior”. It helps to provide support in loss and crime through proper facility construction and procedures. CPTED provides three main approaches to provide overall security. Which include natural access control, natural surveillance, and natural territorial reinforcement. It’s the best approach to build a facility through the CPTED approach. It’s also best to follow proper maintenance and procedures pertaining to physical security. For examples facility keys should only be assigned by the facility management and should be documented. Procedures should be written out clearly stating, how the keys should be distributed, inventoried or even destroyed given the circumstances. On any facility, it’s imperative to enforce access control, to prevent unauthorized personnel from accessing the facility and its best practice to document the people that enter and leave the facility. The access controls should also be role based, basing people of their responsibilities, and identifying who should be allowed to go where. “Access control points can be classified as external, main, and secondary entrances”. Personnel should enter and leave only through directed entry. Various locks can secure access control such as: mechanical locks, tumbler locks, wafer tumbler, combination locks, cipher locks, and device locks.

2) An organization’s physical security program should address the following goals: deterrence, delay, detection, assessment, and response. Deterrence of criminal activity will most likely reduce by implementing fences, warning signs, security guards, and dogs to keep the unwanted guests away. Using a defense in depth mechanism help delay intruders from breaking in and eventually giving up. The use of various locks and access controls will help delay the intruders as well. Having an external and internal sensors and surveillance helps monitor the company ground of any intrusion. Implementing alarm systems, and smoke detectors will help keep intruders away. Reporting incident assessment helps guards stay on top of things and determine the damage level. Response to intrusion helps keep communication open with the outside security force.

3) Large corporation are always prone to cyber attacks. People are always at risk when they surf the web because there is a possibility their system could be compromised. Improperly securing network devices such: routers, switches, hubs, and bridges could allow you network to sniffed. Missing patches on a server could access to the attacker through a back door. Having weak password makes it easy for intruders to get access. The use of infected thumb drive could contaminate the entire network in an enterprise. Misconfigures firewall could open the doors to intruders with open arms. Hackers would be able to scan for vulnerabilities in an improperly configured firewall. The network is always prone to a dos attack. A denial of service attack would restrict the user from temporarily using the network, by flooding the network with tons of packets. It’s also very important to keep an eye out for social engineering attacks, such as phishing, baiting and pretexting. All of these attacks can compromise a network infrastructure.

Reference

5 Types of Social Engineering Attacks - The Cloud to Cloud Backup Blog. (n.d.). Retrieved from http://blog.backupify.com/2013/06/24/5-types-of-social-engineering-attacks/

The Most Common Network Security Vulnerabilities. (n.d.). Retrieved from https://www.acunetix.com/blog/articles/the-top-5-network-security-vulnerabilities/

Harris, S., Harris, S., & Harris, S. (2013). CISSP boxed set. Emeryville, Calif: McGraw-Hill/Osborne