Identifying Basic Physical Security Vulnerabilities
Whatever your computer- and network-security technology, practically any hack is possible if an attacker is in your building or data center. That’s why looking for physical security vulnerabilities and fixing them before they’re exploited is so important.
In small companies, some physical security issues might not be a problem. Many physical security vulnerabilities depend on such factors as:
- Size of the building
- Number of buildings or office locations
- Number of employees
- Location and number of building entrance and exit points
- Placement of server rooms, wiring closets, and data centers
Literally thousands of possible physical security weaknesses exist. The bad guys are always on the lookout for them — so you should look for these issues first. Here are some examples of physical security vulnerabilities I’ve found when performing security assessments for my clients:
- No receptionist in a building to monitor who’s coming and going
- No visitor sign-in or escort required for building access
- Employees overly trusting of visitors because they wear vendor uniforms or say they’re in the building to work on the copier or computers
- No access controls on doors or the use of traditional keys that can be duplicated with no accountability
- Doors propped open
- IP-based video, access control, and data center management systems accessible via the network with vendor default user IDs and passwords
- Publicly accessible computer rooms
- Unsecured backup media such as tapes, hard drives, and CDs/DVDs
- Sensitive information stored in hard-copy format lying around cubicles rather than being stored in locking filing cabinets
- Unsecured computer hardware, especially routers, switches, and unencrypted laptops
- Sensitive information being thrown away in trash cans rather than being shredded or placed in a shred container
When these physical security vulnerabilities are uncovered, bad things can happen. All it takes to exploit these weaknesses is an unauthorized individual entering your building.
