What physical security risks are created by an organization’s implementation of a PHYSBITS solution? What mitigations would you recommend to lesson them?
Use this link for the reference to Physical Security Bridge to IT Security PHYSBITS
Reader Interactions
Comments
Leave a Reply
You must be logged in to post a comment.
Deploying a PHYSBITS solution by an organization introduces several physical security risks. Here are the risks that may arise:
• Data breaches: If data is not secured correctly, it may be accessed by unauthorized parties, exposing sensitive data, or stealing intellectual property.
• Data loss or damage: Physical devices that are not adequately safeguarded run the risk of being destroyed or damaged, which would cause the failure of crucial data or the impossibility of accessing important information.
• Device failure: In the event of a physical device failure, data that has not been adequately backed up may be lost forever.
• Security flaws: If PHYSBITS solutions are improperly designed, they may lead to security flaws that bad actors may exploit.
• Disruptions to operations: If PHYSBITS solutions are not properly maintained, they may malfunction and result in disarray.
Organizations must ensure the PHYSBITS system is appropriately configured, maintained, and monitored to reduce these risks. Also, Organizations should employ the proper security measures, such as data encryption, device security, and regular backups.
• Data encryption: Data stored on physical devices should be encrypted.
• Device security: Physical devices need to be guarded against theft and vandalism.
• Consistent backups: Data should be constantly backed up.
• Security assessments: Organizations should frequently evaluate their physical security posture to find potential vulnerabilities.
• Incident response strategy: Organizations should have a data breach or hardware failure incident response strategy.
By implementing these procedures, organizations can protect their data and reduce the risks of using PHYSBITS systems
This is a clear look at the possible problems when using PHYSBITS. It’s good to see the focus on taking steps ahead of time and doing things right to keep data safe. This advice can really help organizations strengthen their security.
This is a well-detailed analysis of the risks and mitigation controls for the implementation of the PHYSBITS solutions. In addition, I will suggest the exploration of alternative operational centres in the event of a failure of the primary physical location and its devices. An operational alternative location which is tested for functionality will ensure business operations in the event of a failure, breach or any form of compromise.
Physical Security Risks Caused by Implementing PHYSBITS.
Compatibility Issues: Sometimes there are mismatches, between the access cards or tokens we use to enter buildings and the ones we use for IT logins.
Logging Discrepancies: It can be challenging to relate the logs of access with IT logs for analyzing trends and conducting investigations.
Monitoring Limitations: We don’t always have a view of attacks that may target both physical and IT systems.
Access Problems: There could be delays or errors in granting building access to new employees and potential security risks if access is not revoked promptly when an employee leaves.
Recommendations to Mitigate these Risks.
Unified Tokens: Consider adopting a system that serves both our physical access needs as our IT login requirements.
Integrated Logging System: It would be beneficial to have a centralized logging system that can correlate the logs of physical access, with our IT logs.
Enhanced Monitoring: Upgrade our systems to better detect threats that span across both physical. Its domains.
Automated Provisioning: Implement automated user provisioning and deprovisioning processes that are integrated with HR and business operations.
Yannick,
Your recommendations to mitigate the physical security are sound and can help improve overall safety and operational efficiency. However, ensuring the security of these unified tokens is crucial, as compromising one can lead to access to both physical and IT systems.
A centralized logging system would be extremely helpful in the event of a data breach as well. Allowing IS professionals to see exactly where the breach occurred and how it was perpetrated.
A logging and monitoring system is a good security implementation although, without proper rules and policies configured on the central logging tool, some important indicators of breaches could be unnoticed and ignored until the breach materialises hence, adequate training of analysts would reduce this risk.
PHYSBITS solutions can also introduce certain physical security risks. Here are a few risks and potential ways to lessen them:
Risk: Physical devices might be accessed by unauthorized individuals, potentially leading to a of sensitive data breach.
Mitigation: Implement strict access control mechanisms, including biometric authentication, card readers, and surveillance cameras. Additionally, secure devices in locked cabinets or rooms accessible only to authorized personnel.
Risk: Devices can be physically stolen, leading to potential data breaches or system compromise.
Mitigation: Use security cables and locks to tether devices to desks or other immovable objects. Implement GPS tracking and remote wipe capabilities for mobile devices if possible.
Risk: Devices can be damaged due to environmental factors such as water, heat, or dust, .
Mitigation: Store devices in climate-controlled environments. Use protective casings or covers to shield devices from environmental hazards. Regularly inspect and maintain devices for signs of wear or damage.
Risk: A device can fail or other wise become unusable.
Mitigation: Create frequent data backups and store them in a secure manner.
Nicholas, you make an interesting point about the mitigation for physical devices being stolen. It would make it difficult for someone to steal the device itself if it were tied down and they would potentially have to damage the cabling or bring some type of equipment to cut the cabling. It would make someone look suspicious if they were bringing some type of cutters to an office.
In the same way we enable 2-factor authentication or multi-factor authentication in information systems as a way of secure access control, we can implement the same with physical security to ensure adequate security in this context.
Physical risks: Cards can be lost and stolen, and others can use them for unauthorized operations. Damage to the device can result in loss of data stored in it, such as sudden power outages and natural disasters that can damage the device.
Risk mitigation measures: In addition to the card verification system, add a secondary verification such as security code, fingerprint, facial recognition, etc. Backup the stored data to a device elsewhere, so that even if one location is damaged, a backup in another location is available.
Bo, having additional physical security features is a valid point and that I was something that I did not think about. Even though the cards can be stolen it would be difficult to get into the building or department with a fingerprint scan. I also think that RFID cards could be beneficial so the company could track their id cards when they step on the premises.
A holistic approach to physical security architecture based on the physical conditions of the site/location, the criticality of the assets in the location and the acceptable risk level fo the organisation can be significant input to determine the controls and mitigation measures implemented for physical security to avoid an isolated approach to use of controls.
Potential different risks that come with using PHYSBITS solutions:
Loss of device
Can lead to unauthorized users having access to sensitive data
MITAGATION: GPS tracking, make sure there is a backup of the information stored elsewhere, the capability to remotely wipe the device
Unauthorized users accessing device
MITAGATION : Require multiple authentication factors to access the device, this could be things like a password along with a biometric scan ( a fingerprint for example)
Failure/ Destruction of device
MITAGATION: Frequent backups of information on device that are stored at a secure alternative location
This is apt and straightforward. A simple and concise approach to physical security could make performance monitoring simple to determine. However, simplicity should not erode adequacy which should be commensurate with the value, and criticality of assets and data.
A risk could be an employee at a company losing or someone stealing their badge which would give the person access to the building. All they would need to do then is know where is their workstation and they could then locate what devices to steal to get the information they want. The reduction in physical security could benefit the person who is trying to impersonate an employee to steal equipment, download information, or upload malware. To combat this risk having a photo on the badge when on the badge or the company could issue RFID badges so they could track the employee where they are heading to. RFID badges can mitigate a risk where if someone steals a badge but they are just looking to get into the building they can head to another department where their true motives are.
The concern you’ve raised about the risk of an employee losing their badge or someone stealing it is valid and highlights the importance of effective physical security measures. Adding a photo to the badge or implementing RFID badges can indeed be valuable mitigation strategies.
You made a good point about security weaknesses. Using photos and RFID tags are smart ideas that can help make places safer. It’s always best to think ahead and fix problems before they happen.
Hi Jon, I like how you point out that the RFID badge could be used to impersonate someone with little security unless there is additional security implemented like a photo on the badge. I think it’s an interesting demonstration of how a physical security control can be used against your organization if not properly implemented.
I’ve actually thought about this a lot while working at my previous job. Yes, while there was security at the front gates, and we had badges on our car and on a keychain, there was nothing stopping someone from getting the tags on my car, stealing my ID and using all of those to break into the company building. I wonder if there are any other additional measures we can add to help mitigate people from breaking in despite having a physical ID.
Having a physical form of security can have it’s benefits. If I have something such as a person ID card to get me in the building, or a two factor verification token, these are physical tangible uses for company security that I wouldn’t have to worry about someone accessing through a phishing email. That being said, there are still risks associated with it. The link also mentions things such as User provisioning, Policy Management, Security Reporting, Log management, and system monitoring. One specific issue with system monitoring, is that someone could change the location they have set, so a hacker could be located in Canada, but the system shows as it being in the US. Not just internal hacking, but physical forms of security such as ID and verification token are subject to being stolen. Some institutions have their security set up where so long as you have an ID, you get in. By having a physical security guard present, they will be able to detect if the ID is being presented by someone different.
Hashem, a two factor verification token can eliminate a lot of possibilities when it comes to having a badge stolen. A random authentication code could be helpful because it can give a random number to access whatever you are trying to get into and it is all on the device which would be protected by another password.
Risks:
– Building entry cards might not work well with computer login cards.
– Keeping track of building and computer logs could not be so easy, so they might not be good enough for evidence.
– The system might not notice if someone tries to break in physically or digitally.
– It could be a security risk if there is no way to manage properly access for new and leaving workers.
Mitigations
– Make sure building entry cards work with computer login systems.
– Built a system that can easily match building entry and computer login records.
– Use a common method to track both building and computer logs so they can be used as evidence.
– Improve the system to notice any trying break in attempts.
– Using automatic systems to manage building access for new and leaving workers.
Eyup,
The proposed mitigations you mentioned will provide a comprehensive approach to addressing the risks mentioned above.
Automatic management is a good point, which makes it easier for organizations to deal with turnover.
By an organisation’s implementation of a PHYSBITS solution, some physical security risks created include but are not limited to:
1. Data breach/Data loss/exfiltration which leads to the unavailability, confidentiality, and integrity of data through human error, weaknesses in security configurations and access controls, unauthorized or compromised access etc.
This can be mitigated through the following controls:
– Data backups for redundancy
– Tested disaster recovery and business continuity plans
– Data encryption
2. Physical device failure and the risk of unavailability of data
This can be mitigated through the following controls:
– Documented and functional business continuity plans
– Alternative operational locations
3. Risk of malware, ransomware etc.
Mitigation:
– Tested incident (data breach) response strategy
– Use of updated anti-malware solutions
4. Physical device security
Mitigation:
– Biometric locks which reduce the risk of compromise, monitoring, and alarm systems for alerting for intrusion detection.