Chapter 28 — Physical security
Lesson map
Lesson 28 published. Map, example, EX082.
flowchart TD
N0["Learning outcomes"]
N1["28.1 Premises"]
N2["28.2 Paper and media"]
N3["28.3 Equipment"]
N4["28.4 Environment"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX082"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["28.1 Premises"]
N2["28.2 Paper and media"]
N3["28.3 Equipment"]
N4["28.4 Environment"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX082"]
[Learning outcomes]
|
v
[28.1 Premises]
|
v
[28.2 Paper and media]
|
v
[28.3 Equipment]
|
v
[28.4 Environment]
|
v
[Worked example] --> [Exercise EX082]
Learning outcomes
You will (1) protect premises and equipment; (2) secure paper and removable media; (3) consider environmental threats.
28.1 Premises
Physical security protects buildings, rooms and equipment. Aisha walks through a synthetic Ashfield branch. The public area is separated from the staff area by a locked door, but the door is propped open on busy days. The server cupboard has a lock, but the key hangs beside it. She recommends a self-closing door and a key safe. Dr. Carrow notes that physical weaknesses often defeat technical controls, because an attacker with physical access can bypass much of the network protection. The branch manager agrees.
28.2 Paper and media
Ashfield still handles paper: loan applications, identity copies and printed reports. Aisha finds printed member lists left on a printer overnight. She recommends secure printing, where documents release only when the user is at the printer, and locked confidential waste bins. She also finds unencrypted memory sticks used to move files between branches and recommends encrypted devices or secure file transfer instead. The IT manager orders encrypted memory sticks for the branches and sets the printers to secure release. Staff adjust within a week, and the confidential waste bins are emptied by a certified shredding company.
28.3 Equipment
Laptops leave the building. Aisha recommends full-disk encryption, screen locks and a register of who holds each laptop. When a synthetic laptop is reported lost on a train, the IT manager confirms it was encrypted and disables its accounts remotely, so no member data are exposed. She learns that encryption turns a potential data breach into a simple equipment loss, which matters for both members and regulators. The laptop register is updated each time a laptop is issued or returned, and the IT manager checks it every month.
28.4 Environment
Physical threats include fire, flood, power loss and overheating. The head office server room sits in a basement. Aisha checks flood risk and finds the building has flooded once in twenty years. She recommends raising equipment off the floor and keeping backups at another site. Dr. Carrow notes that environmental threats are usually low likelihood but high impact, so cheap preventive measures are often worthwhile. The IT manager arranges for the equipment to be moved onto raised racks during the next maintenance window and adds a water sensor to the room.
Worked example
Aisha finds a propped door and a hanging key, recommends secure printing and encrypted media, shows encryption limits a lost laptop's impact and raises basement equipment.
Synthetic case. Premises are synthetic.
Errors and limits
A key hanging beside its lock offers no protection.
Exercises
- EX082 — Door problem. What weakens the staff-area door? Rubric: 3 = propped open on busy days;; 2 = partly correct;; 1 = vague;; 0 = none.
- EX083 — Lost laptop. Why were no data exposed from the lost laptop? Rubric: 3 = it was encrypted;; 2 = partly correct;; 1 = vague;; 0 = none.
- EX084 — Basement measure. What is recommended for basement equipment? Rubric: 3 = raise it off the floor;; 2 = partly correct;; 1 = vague;; 0 = none.
Continue studying — lesson 28 (chapter 28 of 40)
← Chapter 27 · Course chapter index · Chapter 29 →
Continue to the next authored lesson.