Chapter 3 — Physics for computing

Chapter 3 — Physics for computing

Lesson map

Lesson 03 published. Map, example, EX007.

flowchart TD
  N0["Learning outcomes"]
  N1["3.1 Physical scope"]
  N2["3.2 Heat and power"]
  N3["3.3 Substations"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX007"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["3.1 Physical scope"]
  N2["3.2 Heat and power"]
  N3["3.3 Substations"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX007"]

[Learning outcomes]
    |
    v
[3.1 Physical scope]
    |
    v
[3.2 Heat and power]
    |
    v
[3.3 Substations]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX007]

Learning outcomes

You will (1) relate physical infrastructure to governance scope; (2) reason about energy, heat and failure in data rooms; (3) include physical controls in risk analysis.

3.1 Physical scope

Ardwell's information systems run in physical places: a data room at headquarters, substations with control equipment and a backup site. Nadia learns that governance scope must include these places, because ISO/IEC 27002:2022 groups physical controls such as secure areas, equipment protection and supporting utilities alongside organisational and technological ones. Physics helps her reason about why. Electrical power, heat and vibration all affect whether equipment works, and a security programme that ignores them leaves availability risks unmanaged. Nadia adds each site to the scope statement with a named owner.

3.2 Heat and power

Every watt drawn by servers becomes heat that cooling must remove. Nadia calculates that if cooling fails in the data room, temperature rises steadily until equipment shuts itself down. The time to shutdown depends on the room's heat load and thermal mass. She shows that Ardwell's monitoring should alert well before that time, and that a risk register entry for cooling failure needs an owner in facilities, not only in IT. Physics thus links an engineering calculation to a governance decision about ownership and response.

3.3 Substations

At substations, equipment sits in harsh environments with limited physical security. Nadia notes that a locked cabinet resists casual tampering but not a determined attacker with tools. Physical controls therefore need detection, such as door sensors, as well as delay. She records substation access as a separate risk because it combines physical and digital paths into the control system. Her lecturer stresses that physical risk is easy to miss in desk-based assessments, so site visits remain part of good governance practice.

Worked example

Nadia includes data rooms and substations in scope, links cooling physics to a risk owner and pairs physical delay with detection.

Synthetic case. Ardwell's sites are synthetic; ISO/IEC 27002:2022 is real.

Errors and limits

Simple heat models ignore airflow. Physical controls degrade without inspection.

Exercises

• EX007 — Control groups. Which control group in ISO/IEC 27002:2022 covers secure areas? Rubric: 3 = physical controls;; 2 = physical;; 1 = vague;; 0 = none.
• EX008 — Cooling owner. Who should own the cooling-failure risk entry? Rubric: 3 = facilities, not only IT;; 2 = facilities;; 1 = vague;; 0 = none.
• EX009 — Delay and detection. Why do substations need door sensors as well as locks? Rubric: 3 = locks delay but do not detect a determined attacker;; 2 = detection;; 1 = vague;; 0 = none.

Synthesis

Physical infrastructure is part of governance scope and its risks need owners and controls.

Continue studying — chapter 03 of 50

← Chapter 02 (draft) · Course chapter index · Chapter 04 (draft) →