IT Strategy and Physical Security

IT Strategy has changed significantly in recent years, especially since the pandemic and the associated lockdowns. Remote access to corporate networks is now commonplace, coupled with a move to online e-commerce. Financial pressures have meant outsourcing and colocation is on the increase.

While a focus has been on cybersecurity and its hardware and software needs, physical security must also be a part of the IT Security strategy. As a result, physical security maintenance should never be overlooked in an organisation’s overall IT security strategy. While much of the focus in IT security is on protecting digital assets and data, physical security plays a crucial role in safeguarding those assets and preventing unauthorised access or physical breaches that could compromise sensitive information.

It must be recognised that this is not a one-off exercise. Corporate and IT policies and procedures on physical security need to be continually reviewed and modified to reflect the evolving business environment.

Why Physical Security is Important

Here are several reasons why physical security maintenance is essential. All IT systems rely on physical hardware, such as servers, network equipment, and workstations. Proper physical security measures ensure that these assets are protected. Individual cases include theft, vandalism, or accidental damage. More general physical threats include fire, flood and other environmental issues such as temperature, and power fluctuations and power failures damaging equipment.

Protection of Hardware

How security is implemented will depend on the location of the hardware and potential threats. Core layer data centres will have overall security, but kit in other access and distribution layer locations like network rooms in separate buildings will need specific access control and other physical security measures.

External and accessible equipment, such as outdoor WiFi access points may need to be positioned so that they are tamper-proof.

An organisation will need to carefully consider the physical security arrangements of equipment that they own but is hosted by third parties.

Data Centre Security

Data centres house critical infrastructure and data repositories. Physical security measures, such as access controls, surveillance cameras, and environmental controls, are vital to prevent unauthorised access and environmental hazards that could disrupt operations.

Preventing Unauthorised Access

Physical security helps prevent unauthorised personnel from gaining physical access to sensitive areas or devices. This is especially important in preventing data breaches, as unauthorised access can lead to data theft or tampering.

This is becoming increasingly important as cost savings generate a move to remote management. Software defined and Intent Based networks also reduce the need for physical intervention.  Without regular visits to lights-out remote network rooms or data centres, monitoring physical access to the site coupled with remote video security surveillance becomes even more important.

Other Physical Security Considerations

Insider Threats

Even within an organisation, there may be individuals with malicious intent or employees who unintentionally compromise security. Physical security measures, like access control systems and surveillance, help monitor and restrict employees’ access to only the areas and equipment they need for their roles.

Departing employees working a notice period or those terminated through layoff or misconduct are specific insider threats. They must have all IT rights and privileges removed immediately.

Business Continuity

Physical security also plays a role in ensuring business continuity. In the event of a natural disaster, fire, or other physical threat, proper security measures can protect critical infrastructure and data, allowing the organisation to recover more quickly.

Insurance

Prudent organisations cover their physical infrastructure with insurance policies. The policy conditions may specify specific physical security measures.

Legal and Regulatory Compliance

Many industries and regions have legal and regulatory requirements for physical security. Failure to comply with these regulations can result in significant fines and legal consequences.

Employee Safety

Specific regulatory compliance requirements will follow local employee health and safety regulations. Quite apart from those regulatory requirements, physical security measures also contribute to the safety of employees and visitors by ensuring that only authorised individuals are allowed into secure areas.

Deterrent Effect

Visible physical security measures can act as a deterrent to potential threats. The presence of security cameras, access control systems, and alarms can discourage unauthorised individuals from attempting to breach security.

A physical security presence, or at least a recognition of the need for regular checks on infrastructure by security personnel will help with deterrence.

Incident Response

In the event of a security incident, physical security measures, such as video surveillance footage, can be invaluable for investigating and resolving the incident. They can provide crucial evidence and help identify the individuals involved.
Again, this might be a requirement for insurance coverage, or following up with law enforcement.

Integration with Cybersecurity

Physical security should be integrated with cybersecurity efforts to provide a comprehensive security strategy. For example, access controls should align with user permissions in digital systems, and security policies should cover both physical and digital aspects.

User Education

A final consideration is that of user education into the need for physical security and continual vigilance. Users need to have an awareness of corporate policy on physical security from induction onwards, both the need itself, and what to do if they see or suspect a physical security issue.
There should also be regular reinforcement sessions with users.

In conclusion, physical security maintenance is an integral part of a holistic IT security strategy. Neglecting physical security can leave an organisation vulnerable to a wide range of threats, including theft, data breaches, and disruptions. By implementing and regularly maintaining physical security measures, organisations can better protect their digital assets, data, and overall business operations.