Physical Security – physical threats to integrity and availability of resources
Introduction
Digital information is at the heart of every Internet transaction. The confidentiality, integrity, and availability of that information depend on the security of the following physical constituents of any computing environment:
- Hardware, in the broadest sense—machines, storage media, and transmission media;
- The physical expression of the zeroes and ones that represent digital information (data and programs);
- Electricity, without which no digital information could change, move, or incite action; and
- Humans and the information they possess to run the system.
Internet security can be divided into two distinct areas: cyber security and physical security. The former term pertains to threats and defenses mounted via the same channels as legitimate exchanges of digital information. Encryption of information falls into this category. The role of physical security is to guard the four physical ingredients just outlined in two ways.
Basic Environmental Threats to Computing Resources
Four basic threats to the physical health of computing equipment are inappropriate temperature, inappropriate humidity, foreign particles, and water.
Temperature and Humidity
The internal temperature of equipment can be significantly higher than that of the room air. Although increasing densities have brought decreasing currents at the integrated circuit level, dissipation of heat is still a major concern. If a cooling system fails, a vent is blocked, or moving parts create abnormal friction, temperature levels can rise rapidly.
Foreign Particles
Foreign particles, in the broad sense intended here, range from insects down to molecules that are not native to the atmosphere. The most prevalent threat is dust. Even fibers from fabric and paper are abrasive and slightly conductive. Worse are finer, granular dirt particles. Manufacturing by-products, especially metal particles with jagged shapes, are worse yet.
A residue of dust can interfere with the process of reading from media. Dirty magnetic tape can actually stick and break. Rotating media can be ground repeatedly by a single particle; a head crash is a possible outcome. A massive influx of dust (such as occurred near the World Trade Center) or volcanic ash can overwhelm the air-filtering capability of HVAC (heating, ventilation, and air-conditioning) systems.
Fire
Throughout history, fire has been one of the most important threats to human life, property, and activity when measured in terms of frequency, potential magnitude, and rapidity of spread. Fire presents a bundle of the previously mentioned environmental threats. By definition, combustion involves chemical and physical changes in matter, in other words, destruction of what was. Even away from the site of actual combustion, heat can do damage, as detailed earlier. Smoke can damage objects far from the site of combustion.
Computing Infrastructure Problems
Hardware failures will still occur unexpectedly despite the best efforts to control the computing environment. Harddrive crashes are one of the most infamous malfunctions, but any electronic or mechanical device in the computing environment can fail. In this regard, critical support equipment, such as HVAC, must not be overlooked. After the attack on the Pentagon Building, continued computer operations hinged on stopping the hemorrhage of chilled water for climate control.
Conclusion
Physical security tends to receive less attention than it deserves. Yet cyber security depends on it. The two pillars of security must be balanced to defeat malicious insiders and outsiders. Ultimately, physical security is the greater challenge, because nature can be the biggest foe. Physical security involves a broad range of topics outside the normal sphere of IT expertise. Consequently, to obtain the best protection, professionals in other fields should be consulted with regard to fire detection and suppression, power maintenance and conditioning, access to and monitoring of buildings and rooms, forensic science, managerial science, and disaster recovery.
