Chapter 20 — Physical and device security

Chapter 20 — Physical and device security

Lesson map

Lesson 20 published. Map, example, EX058.

flowchart TD
  N0["Learning outcomes"]
  N1["20.1 Equipment rooms"]
  N2["20.2 Tills and terminals"]
  N3["20.3 Cameras"]
  N4["20.4 Disposal"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX058"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["20.1 Equipment rooms"]
  N2["20.2 Tills and terminals"]
  N3["20.3 Cameras"]
  N4["20.4 Disposal"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX058"]

[Learning outcomes]
    |
    v
[20.1 Equipment rooms]
    |
    v
[20.2 Tills and terminals]
    |
    v
[20.3 Cameras]
    |
    v
[20.4 Disposal]
    |
    v
[Worked example] --> [Exercise EX058]

Learning outcomes

You will (1) secure equipment rooms and devices; (2) protect tills and cameras physically; (3) dispose of equipment safely.

20.1 Equipment rooms

Jamal visits network cupboards at three centres. One is unlocked and used to store cleaning supplies. Another has the key hanging on a hook beside it. He recommends locks with keys held by the centre manager and IT, and removal of other items. Ms. Grant explains that someone with physical access to network equipment can bypass many controls, for example by plugging in their own device. The centre managers agree, and the cleaning supplies are moved. Jamal checks the cupboards again a month later and finds all three locked.

20.2 Tills and terminals

Card terminals can be tampered with by criminals who add devices to capture card details. Jamal helps write a simple daily check: reception staff compare each terminal with a photo, check seals and report anything unusual. He also checks that terminals are fixed to counters. Ms. Grant notes that daily checks by the people who use equipment are often the best detection for physical tampering. He prepares the photos and a one-page checklist for each centre. Reception staff complete the check at opening time and initial a sheet.

20.3 Cameras

Cameras protect people and property but also record members, including children at pools. Jamal checks that camera recorders are in locked rooms, footage is kept for a defined period and access to footage is limited and logged. He finds that one centre's recorder screen is visible from reception. He recommends moving it. He learns that physical security and privacy often meet in camera systems. The centre manager moves the screen into the office, and Jamal adds footage access logging to the monthly checks for each centre.

20.4 Disposal

Old computers and recorders contain data. Jamal finds three old reception computers in a storeroom awaiting disposal. He recommends wiping drives with a recognised method or using a certified disposal company that provides certificates. He records each disposed device in the inventory. Ms. Grant notes that disposal failures have caused many data exposures, because discarded devices often still hold readable data. The IT manager chooses a certified company, which collects the computers and provides a certificate for each drive. Jamal files the certificates with the inventory records.

Worked example

Jamal secures network cupboards, writes a daily terminal tampering check, limits camera footage access and arranges certified disposal of old computers.

Synthetic case. Sites are synthetic.

Errors and limits

Discarded devices often still hold readable data.

Exercises

• EX058 — Cupboard misuse. How was one network cupboard misused? Rubric: 3 = storing cleaning supplies;; 2 = partly correct;; 1 = vague;; 0 = none.
• EX059 — Terminal check. How do staff check terminals daily? Rubric: 3 = compare with a photo and check seals;; 2 = partly correct;; 1 = vague;; 0 = none.
• EX060 — Recorder screen. What problem did one recorder screen have? Rubric: 3 = visible from reception;; 2 = partly correct;; 1 = vague;; 0 = none.

Continue studying — lesson 20 (chapter 20 of 30)

← Chapter 19 · Course chapter index · Chapter 21 →

Continue to the next authored lesson.