O'Reilly - Practical UNIX & Internet Sec... 7015KB

[Chapter 12] Physical Security
as different organizations running the identical system software might have dramatically different
physical-security needs. (Many popular books on UNIX system security do not even mention physical
security.) Because physical security must inherently be installed on-site, it cannot be pre-installed by the
operating system vendor, sold by telemarketers, or FTP'ed over the Internet as part of a free set of
security tools.
Anything that we can write about physical security must therefore be broadly stated and general. Because
every site is different, this chapter can't give you a set of specific recommendations. It can only give you
a starting point, a list of issues to consider, and a procedure for formulating your plan.
12.1.1 The Physical Security Plan
The first step to physically securing your installation is to formulate a written plan addressing your
current physical security needs and your intended future direction - something we discussed in Chapter 2,
Policies and Guidelines. Ideally, such a plan should be part of the site security policy, and should
include:
●
●
●
●
●
●
Description of the physical assets that you are protecting
Description of the physical area where the assets are located
Description of your security perimeter (the boundary between the rest of the world and your
secured area), and the holes in the perimeter
Threats you are protecting against
Your security defenses, and ways of improving them
Estimated cost of any improvements, the cost of the information that you are protecting, and the
likelihood of an attack, accident, or disaster
If you are managing a particularly critical installation, you should take great care in formulating this plan.
Have it reviewed by an outside firm that specializes in disaster recovery planning and risk assessment.
You should also consider your security plan a sensitive document: by its very nature, it contains detailed
information on your defenses' weakest points.
Smaller businesses, many educational institutions, and home systems will usually not need anything so
formal; some preparation and common sense is all that is usually necessary, although even a day of a
consultant's time may be money well spent.
Some organizations may consider that many of the ideas described in the following sections are overkill.
Before you come to this conclusion, ask yourself five questions:
1.
2.
3.
Does anybody other than you have physical access to your computer?
What would happen if that person had a breakdown or an angry outburst, and tried to smash your
system with a hammer?
What would happen if someone in the employ of your biggest competitor were to come into the
building unnoticed?
file:///C|/Oreilly Unix etc/O'Reilly Reference Library/networking/puis/ch12_01.htm (2 of 3) [2002-04-12 10:45:43]