Physical Security

Physical Security

Physical security involves safekeeping systems from theft or physical damage and preventing unauthorized access to those systems. If unauthorized users are given physical access to a system, it is a simple matter for them to break in and gain access to important business data. All employees and contractors should be held responsible (and accountable) for taking every reasonable precaution to ensure the physical security of their IT hardware and related peripherals, including mobile devices, from theft, abuse, avoidable hazards, or unauthorized use. Company servers, routers, and other communications hardware essential for maintaining the operability of the systems and their connectivity to the Internet should be placed in a controlled-access location (i.e., behind locked doors).

Managers must ensure that the nodes that comprise the network (such as file servers, Web servers, mail servers, and any other equipment that forms the basis of the network) are secured in an area where access is controlled. Only authorized personnel should have access to network equipment. Ensure that users' systems are as secure as is practical. This includes securing the systems from casual use by installing password-protected screensavers. Provide the ability for users to lock their workstations when they leave their area. The responsibility to safeguard IT assets should not include company employees or contractors endangering themselves or others by attempting to physically prevent the unauthorized removal or destruction of IT hardware, accessories, or supplies. In such a case, employees should notify law enforcement and follow their guidance.

The following section displays a template for creating policies. Appendix A contains samples of policies for some of the more difficult topics to manage in security. A thorough understanding of these policies is essential to all of the employees in any organization. Such understanding will provide better overall security to an organization and prevent unnecessary loss of intellectual property or physical assets. The reader is also encouraged to consult the SANS Reading Room Web site [10] for more information on a wide variety of security policies.

   January 21, 2004

   Change made by
   Chief Security Officer

   Generic Policy Template

   

   1.0 Purpose
   The purpose of this policy is to provide guidance ...

   2.0 Scope
   This policy applies to all < Company Name > employees and
   affiliates.

   3.0 Policy
   Term
   Definition

   4.0 Enforcement
   Any employee found to have violated this policy may be subject
   to disciplinary action,  up to and including tennination  of
   employment.

   5.0 Definitions

   6.0 Revision History

   Date of last change
   Summary of change

   7.0. Signature(s)
   Date ___________________________
   Date ___________________________

   Chief Executive Officer