There should be perimeter security mechanisms in place that meet the organization's specific needs while deterring, detecting, denying, delaying, and defending facilities from physical security threats.
Control Type: Physical/Technical
Control Function: Preventive/Detective/Deterrent
It is important to keep highlighting the concept of defense in depth throughout this framework. In the increasingly hostile digital landscape of the 2020s, there is no one and done security control that protects an asset. Security needs to be layered in at multiple levels, considering all possible avenues of attack. Thus, an organization’s information security program needs to start in the physical world, and start right at the exact point where the organization’s property starts.
Perimeter security is a business necessity that is often a larger issue than just cybersecurity alone. However good perimeter security needs to be accounted for when creating an information security program. Good perimeter security starts by understanding what the perimeter is. Organizations should clearly understand their property lines, traffic levels around the property, local crime trends, and environmental hazards. All of these metrics should be continuously monitored, and revisions to the organization’s information security program should include improvements to perimeter security.
To better define requirements for good perimeter security, organizations should use the Five D’s model:
1. Deter adversaries from initiating attacks.
2. Detect adversaries before their attacks can inflict damage.
3. Deny adversaries access to important assets.
4. Delay adversaries from reaching business critical assets after initial compromise.
5. Defend critical assets from adversaries if all else fails.
Perimeter security is not one size fits all. As discussed earlier, organizations need to understand their physical environment to choose the best security controls for their case. Regardless, there are still many standard techniques and tools used by organizations of all sizes to enhance perimeter security.
Barriers: large obstructions placed at strategic points around the outskirts of a facility to keep adversaries out, and sometimes halt them as they try to flee. Fences, locked gates, bollards, and turnstiles are all examples of physical barriers.
Access Controls: the standard lock and key is the classic form of access control. However larger organizations with many employees cannot constantly keep track of who is coming and ongoing. An unbiased, constantly functioning digital system should be used in such cases. Smaller facilities can implement keypads that are programmed with PINs only known to one or a small group of employees. This form of physical access control works well for individual doors in smaller, less targeted environments. Nowadays however, most medium to large organizations use physical access controls in the form of digital scanners programmed according to a role based or attribute based access control scheme. Employees use badges or cards to identify themselves at entrances, with their credentials pre-programmed onto a card and authenticated against the access control system using technologies like NFC or RFID. Physical access control systems continue to grow and improve, however they are still not at all foolproof and deserve the same attention, review, and fine tuning as do digital access control systems.
Deterrence Mechanisms: some facilities are high value enough to warrant ongoing, 24/7 human supervision. We typically see this in military bases and government agencies, but it can apply to the private sector as well. An organization might justify paying one or more security guards to supervise the facilities. These individuals are tasked with detecting, deterring, and reporting attempted breaches of physical security. Dogs are another classic deterrent, offering a loud and menacing solution for quick thinking adversaries. Security cameras are probably the most common technical deterrence mechanism. Security cameras are carefully placed at important points around the perimeter, their very presence indicating to attackers that they are under surveillance and will be noticed should they try anything. There are many different brands and models of security cameras, with quality differing heavily between them. Some brands include useful features such as overhead lights that illuminate surrounding areas and further deter human adversaries. Depending on the size, sensitivity, and budget of the organization, human security guards may be tasked with continually monitoring the feeds on security cameras to quickly notice and respond to intrusion attempts.
Intrusion Detection & Alerting: it is not enough to implement a bunch of perimeter security controls with the hopes that they alone will ward off penetration attempts. Every organization in a decently populated area is bound to have an active attack at one point or another. To ensure that such attacks are met appropriately, there should be detection and alerting mechanisms in place. Motion detection sensors come in a variety of forms, and can be configured to send out notifications when activated. This may be in the form of a text message sent to security staff, a notification on the NVR system, or an audible noise in the area where the movement is detected. Other forms of sensors can also be used, such as fence mounted vibration sensors and infrared beams. Regardless of the specific physical intrusion detection solutions implemented, organizations need to regularly test and upkeep the selected technology, and ensure that alerts can always get to human users. Without a quick succession from detection to notification, the justification for intrusion detection mechanisms is gone.