Module 12

Information Security
Maintenance

Michael E. Whitman and Herbert J. Mattord, Principles of Information Security, 7th Edition. © 2022 Cengage. All Rights Reserved. May not be
scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part. 1
 Module Objectives

Upon completion of this material, you should be able to:

12.1 Discuss the need for ongoing maintenance of the information security program
12.2 Describe recommended security management models
12.3 Define a model for a full maintenance program
12.4 Identify the key factors involved in monitoring the external and internal
environment
12.5 Describe how planning, risk assessment, vulnerability assessment, and
remediation tie into information security maintenance
12.6 Explain how to build readiness and review procedures into information security
maintenance
12.7 Discuss physical security controls
Michael E. Whitman and Herbert J. Mattord, Principles of Information Security, 7th Edition. © 2022 Cengage. All Rights Reserved. May not be
scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part. 2
 Introduction To
Information Security Maintenance
• Organizations should avoid overconfidence after improving their information
security profile.
• Organizational changes that may occur include acquisition of new assets,
emergence of new vulnerabilities, shifting business priorities, dissolution and
formation of partnerships, and employee hire and turnover
• If a program is not adequately adjusting, it may be necessary to begin the cycle
again.
• If an organization creates adjustable procedures and systems, the existing
security improvement program can continue to work well.

Michael E. Whitman and Herbert J. Mattord, Principles of Information Security, 7th Edition. © 2022 Cengage. All Rights Reserved. May not be
scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part. 3
 Security Management Maintenance Models

• Management models must be adopted to manage and operate ongoing security

programs.
• Management models are frameworks that structure the tasks of managing a
particular set of activities or business functions on an ongoing basis.
• Coupled with a strategic plan to move the status of any project toward its goal
by closing the “gap,” improvements become more than just change: they
provide real progress toward making the security program better.
• Remember “Good now is better than perfect never.”

Michael E. Whitman and Herbert J. Mattord, Principles of Information Security, 7th Edition. © 2022 Cengage. All Rights Reserved. May not be
scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part. 4
 NIST SP 800-100 Information Security
Handbook: A Guide for Managers (1 of 5)
• Provides managerial guidance for establishing and implementing an information
security program.
• Provides 13 areas of information security management.
− Specific monitoring activities for each task
− Tasks should be done on an ongoing basis.
− Not all issues are negative.

Michael E. Whitman and Herbert J. Mattord, Principles of Information Security, 7th Edition. © 2022 Cengage. All Rights Reserved. May not be
scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part. 5
 NIST SP 800-100 Information Security
Handbook: A Guide for Managers (2 of 5)
• Information security governance
− Agencies should monitor the status of their programs to ensure
 Ongoing information security activities providing appropriate support.
 Policies and procedures are current.
 Controls are accomplishing their intended purpose.
• System Development Life Cycle is the overall process of developing, implementing,
and retiring information systems through a multistep process.
• Awareness and training
− Tracking system should capture key information on program activities.
− Tracking compliance involves assessing the status of the program.
− Security policies must continue to evolve.
Michael E. Whitman and Herbert J. Mattord, Principles of Information Security, 7th Edition. © 2022 Cengage. All Rights Reserved. May not be
scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part. 6
 NIST SP 800-100 Information Security
Handbook: A Guide for Managers (3 of 5)
• Capital planning and investment control
− Departments required to allocate funding toward highest-priority investments
− Designed to facilitate the expenditure of agency funds
• Interconnecting systems
− The direct connection of two or more information systems for sharing data and other
information resources
− Can expose the participating organizations to risk
− If one of the connected systems is compromised, interconnection could be used as conduit.
• Performance measures
− Metrics should be used for monitoring the performance of information security controls.
− Six-phase iterative process
Michael E. Whitman and Herbert J. Mattord, Principles of Information Security, 7th Edition. © 2022 Cengage. All Rights Reserved. May not be
scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part. 7
Information Security Measures Development

Michael E. Whitman and Herbert J. Mattord, Principles of Information Security, 7th Edition. © 2022 Cengage. All Rights Reserved. May not be
scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part. 8
Implementing the Information Security
Measurement Program

Michael E. Whitman and Herbert J. Mattord, Principles of Information Security, 7th Edition. © 2022 Cengage. All Rights Reserved. May not be
scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part. 9
 NIST SP 800-100 Information Security
Handbook: A Guide for Managers (4 of 5)
• Security planning
− One of the most crucial ongoing responsibilities in security management
• Information technology contingency planning
− Consists of a process for recovery and documentation of procedures
• Risk management
− Ongoing effort
− Tasks include performing risk identification, analysis, and management

Michael E. Whitman and Herbert J. Mattord, Principles of Information Security, 7th Edition. © 2022 Cengage. All Rights Reserved. May not be
scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part. 10
 NIST SP 800-100 Information Security
Handbook: A Guide for Managers (5 of 5)
• Certification, accreditation, and security assessments
− An essential component of any security program
− The status of security controls is checked regularly
− Auditing to review a system’s use to determine if misuse/malfeasance has
occurred
• Security services and products acquisition
• Incident response: incident response life cycle
• Configuration (or change) management: manages the effects of changes in
configurations, five-step process
Michael E. Whitman and Herbert J. Mattord, Principles of Information Security, 7th Edition. © 2022 Cengage. All Rights Reserved. May not be
scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part. 11
Information Security Services Life Cycle

Michael E. Whitman and Herbert J. Mattord, Principles of Information Security, 7th Edition. © 2022 Cengage. All Rights Reserved. May not be
scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part. 12
 The Security Maintenance Model

• Designed to focus organizational effort on maintaining systems

• Recommended maintenance model based on five
subject areas:
− External monitoring
− Internal monitoring
− Planning and risk assessment
− Vulnerability assessment and remediation
− Readiness and review

Michael E. Whitman and Herbert J. Mattord, Principles of Information Security, 7th Edition. © 2022 Cengage. All Rights Reserved. May not be
scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part. 13
 The Maintenance Model

Michael E. Whitman and Herbert J. Mattord, Principles of Information Security, 7th Edition. © 2022 Cengage. All Rights Reserved. May not be
scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part. 14
 Monitoring the External Environment (1 of 2)

• Provides early awareness of new and emerging threats, threat agents, vulnerabilities,
and attacks so organization can mount an effective defense.
• Entails collecting intelligence from data sources and giving that intelligence context and
meaning for use by organizational decision makers.
• Data sources:
− Acquiring threat and vulnerability data is not difficult.
− Turning data into information decision makers can use is challenging.
− External intelligence comes from vendors, computer emergency response teams
(CERTs), public network sources, or membership sites.
− Regardless of where or how external monitoring data are collected must be
analyzed in the context of the organization’s security environment to be useful
Michael E. Whitman and Herbert J. Mattord, Principles of Information Security, 7th Edition. © 2022 Cengage. All Rights Reserved. May not be
scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part. 15
 External Monitoring

Michael E. Whitman and Herbert J. Mattord, Principles of Information Security, 7th Edition. © 2022 Cengage. All Rights Reserved. May not be
scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part. 16
 Monitoring the External Environment (2 of 2)

• Monitoring, escalation, and incident response

− Function of external monitoring process is to monitor activity, report results, and escalate
warnings
− Monitoring process has three primary deliverables:
 Specific warning bulletins issued when developing threats and specific attacks pose
measurable risk to the organization
 Periodic summaries of external information
 Detailed intelligence on highest risk warnings
• Data collection and management
− Over time, external monitoring processes should capture information about the external
environment in appropriate formats
− External monitoring collects raw intelligence, filters for relevance, assigns a relative risk
impact, and communicates to decision makers in time to make a difference
Michael E. Whitman and Herbert J. Mattord, Principles of Information Security, 7th Edition. © 2022 Cengage. All Rights Reserved. May not be
scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part. 17
 Knowledge Check Activity 1

The basic function of the external monitoring process is to maintain an informed

awareness of the state of all the organization’s networks, information systems,
and information security defenses.
a. True
b. False

Michael E. Whitman and Herbert J. Mattord, Principles of Information Security, 7th Edition. © 2022 Cengage. All Rights Reserved. May not be
scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part. 18
 Knowledge Check Activity 1: Answer

The basic function of the external monitoring process is to maintain an informed

awareness of the state of all the organization’s networks, information systems,
and information security defenses.
a. True
b. False

Answer: b. False
The steps to maintain an informed awareness of the state of all the organization’s
networks, information systems, and information security defenses are internal
monitoring. External monitoring is oriented to monitor activity, report results, and
escalate warnings.
Michael E. Whitman and Herbert J. Mattord, Principles of Information Security, 7th Edition. © 2022 Cengage. All Rights Reserved. May not be
scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part. 19
 Monitoring the Internal Environment (1 of 3)

• Primary goal is informed awareness of the state of the organization’s networks,

systems, and security defenses.
• Internal monitoring accomplished by
− Inventorying network devices and channels, IT infrastructure and
applications, and information security infrastructure elements
− Leading the IT governance process
− Real-time monitoring of IT activity
− Monitoring the internal state of the organization’s networks and systems

Michael E. Whitman and Herbert J. Mattord, Principles of Information Security, 7th Edition. © 2022 Cengage. All Rights Reserved. May not be
scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part. 20
 Internal Monitoring

Michael E. Whitman and Herbert J. Mattord, Principles of Information Security, 7th Edition. © 2022 Cengage. All Rights Reserved. May not be
scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part. 21
 Monitoring the Internal Environment (2 of 3)

• Network characterization and inventory

− Organizations should have/maintain carefully planned and fully populated inventory of
network devices, communication channels, and computing devices.
− Once characteristics are identified, they must be carefully organized and stored using a
mechanism (manual or automated) that allows timely retrieval and rapid integration of
disparate facts.
• Making intrusion detection and prevention systems work
− The most important value of raw intelligence provided by the IDS is providing indicators of
current or imminent vulnerabilities.
− Log files from IDS engines can be mined for information.
− Another IDS monitoring element is traffic analysis.
− Analyzing attack signatures from unsuccessful system attacks can identify weaknesses in
various security efforts.
Michael E. Whitman and Herbert J. Mattord, Principles of Information Security, 7th Edition. © 2022 Cengage. All Rights Reserved. May not be
scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part. 22
 Monitoring the Internal Environment (3 of 3)

• Detecting differences
− Difference analysis is the procedure that compares the current state of
network segment against the known previous state of same segment
− Unexpected differences between the current state and the baseline state
could indicate trouble

Michael E. Whitman and Herbert J. Mattord, Principles of Information Security, 7th Edition. © 2022 Cengage. All Rights Reserved. May not be
scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part. 23
 Planning and Risk Assessment (1 of 4)

• Primary objective is to keep a lookout over the entire information security program
• Accomplished by identifying and planning ongoing information security activities that
further reduce risk
• Primary objectives
− Establishing a formal information security program review process
− Instituting formal project identification, selection, planning, and management
processes
− Coordinating with IT project teams to introduce risk assessment and review for all IT
projects
− Integrating a mindset of risk assessment throughout organization

Michael E. Whitman and Herbert J. Mattord, Principles of Information Security, 7th Edition. © 2022 Cengage. All Rights Reserved. May not be
scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part. 24
 Planning and Risk Assessment (2 of 4)

• Information security program planning and review

− Periodic review of the ongoing information security program and planning for
enhancements and extensions is recommended.
− Should examine future IT needs of the organization and its impact on
information security
− A recommended approach takes advantage of the fact that most
organizations have annual capital budget planning cycles and manage
security projects as part of that process.

Michael E. Whitman and Herbert J. Mattord, Principles of Information Security, 7th Edition. © 2022 Cengage. All Rights Reserved. May not be
scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part. 25
Planning and Risk Assessment (3 of 4)

Michael E. Whitman and Herbert J. Mattord, Principles of Information Security, 7th Edition. © 2022 Cengage. All Rights Reserved. May not be
scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part. 26
 Planning and Risk Assessment (4 of 4)

• Large projects should be broken into smaller projects because

− Smaller projects tend to have more manageable impacts on networks and users.
− Larger projects tend to complicate the change control process in the implementation phase.
− Shorter planning, development, and implementation schedules reduce uncertainty.
− Most large projects can easily be broken down into smaller projects, giving more
opportunities to change direction and gain flexibility.
• Security risk assessments
− A key component for driving security program change is risk assessment (RA).
− RA identifies and documents the risk that a project, process, or action introduces to the
organization and offers suggestions for controls.
− Information security group coordinates the preparation of many types of RA documents.
Michael E. Whitman and Herbert J. Mattord, Principles of Information Security, 7th Edition. © 2022 Cengage. All Rights Reserved. May not be
scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part. 27
 Vulnerability Assessment and Remediation
(1 of 9)
• Primary goal is the identification of specific, documented vulnerabilities and their
timely remediation
• Accomplished by
− Using vulnerability assessment procedures
− Documenting background information and providing tested remediation
procedures for vulnerabilities
− Tracking vulnerabilities from the time they are identified
− Communicating vulnerability information to owners of vulnerable systems
− Reporting on the status of vulnerabilities
− Ensuring the proper level of management is involved
Michael E. Whitman and Herbert J. Mattord, Principles of Information Security, 7th Edition. © 2022 Cengage. All Rights Reserved. May not be
scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part. 28
Vulnerability Assessment and Remediation
(2 of 9)

Michael E. Whitman and Herbert J. Mattord, Principles of Information Security, 7th Edition. © 2022 Cengage. All Rights Reserved. May not be
scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part. 29
 Vulnerability Assessment and Remediation
(3 of 9)
• Process of identifying and documenting specific and provable flaws in the
organization’s information asset environment
• Five following vulnerability assessment processes can help many organizations
balance intrusiveness of vulnerability assessment with the need for stable and effective
production environment
• Penetration testing (pen test)
− A level beyond vulnerability testing
− Security tests and evaluations that simulate attacks by a malicious external source
(hacker)
− Performed periodically as part of a full security audit
− Conducted one of two ways: black box or white box

Michael E. Whitman and Herbert J. Mattord, Principles of Information Security, 7th Edition. © 2022 Cengage. All Rights Reserved. May not be
scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part. 30
 Vulnerability Assessment and Remediation
(4 of 9)
• Internet vulnerability assessment is designed to find and document vulnerabilities
present in an organization’s public network
− Steps in the process include:
 Planning, scheduling, and notification
 Target selection
 Test selection
 Scanning
 Analysis
 Record keeping

Michael E. Whitman and Herbert J. Mattord, Principles of Information Security, 7th Edition. © 2022 Cengage. All Rights Reserved. May not be
scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part. 31
 Vulnerability Assessment and Remediation
(5 of 9)
• Intranet vulnerability assessment
− Designed to find and document the selected vulnerabilities likely present on
the internal network
− Attackers are often internal members of the organization, affiliates of
business partners, or automated attack vectors (such as viruses and worms)
− This assessment is usually performed against critical internal devices with a
known, high value by using selective penetration testing
− Steps in the process are almost identical to the steps in the Internet
vulnerability assessment

Michael E. Whitman and Herbert J. Mattord, Principles of Information Security, 7th Edition. © 2022 Cengage. All Rights Reserved. May not be
scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part. 32
 Vulnerability Assessment and Remediation
(6 of 9)
• Platform security validation
− Designed to find and document vulnerabilities that may be present because
misconfigured systems are in use within the organization
− Misconfigured systems fail to comply with company policy or standards
− Automated measurement systems are available to help with the intensive process
of validating the compliance of platform configuration with policy
• Wireless vulnerability assessment
− Designed to find and document vulnerabilities that may be present in wireless local
area networks of the organization
− Since attackers from this direction are likely to take advantage of any flaw,
assessment is usually performed against all publicly accessible areas using every
possible wireless penetration testing approach
Michael E. Whitman and Herbert J. Mattord, Principles of Information Security, 7th Edition. © 2022 Cengage. All Rights Reserved. May not be
scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part. 33
 Vulnerability Assessment and Remediation
(7 of 9)
• Documenting vulnerabilities
− Vulnerability database should provide details about reported vulnerability as well as a link to
the information assets
− Low-cost and ease of use makes relational databases a realistic choice
− Vulnerability database is an essential part of effective remediation
• Remediating vulnerabilities
− Objective is to repair flaws causing a vulnerability instance or remove risk associated with
vulnerability
− As a last resort, informed decision makers with proper authority can accept risk
− Important to recognize that building relationships with those who control information assets
is key to success
− Success depends on the organization adopting team approach to remediation, in place of
cross-organizational push and pull
Michael E. Whitman and Herbert J. Mattord, Principles of Information Security, 7th Edition. © 2022 Cengage. All Rights Reserved. May not be
scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part. 34
 Vulnerability Assessment and Remediation
(8 of 9)
• Acceptance or transference of risk
− In some instances, risk must be either simply acknowledged as part of the
organization’s business process or transferred to another organization via
insurance
− Management must be assured that decisions made to accept risk or buy
insurance were made by properly informed decision makers
− Information security must make sure the right people make risk assumption
decisions with complete knowledge of the impact of the decision

Michael E. Whitman and Herbert J. Mattord, Principles of Information Security, 7th Edition. © 2022 Cengage. All Rights Reserved. May not be
scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part. 35
 Vulnerability Assessment and Remediation
(9 of 9)
• Threat removal
− In some circumstances, threats can be removed without repairing
vulnerability
− Other vulnerabilities may be mitigated by inexpensive controls
• Vulnerability repair
− Best solution in most cases is to repair vulnerability
− Applying patch software or implementing a workaround often accomplishes
this
− Most common repair is the application of a software patch
Michael E. Whitman and Herbert J. Mattord, Principles of Information Security, 7th Edition. © 2022 Cengage. All Rights Reserved. May not be
scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part. 36
 Knowledge Check Activity 2

The final process in the vulnerability assessment and remediation domain is the
_____ phase.

Michael E. Whitman and Herbert J. Mattord, Principles of Information Security, 7th Edition. © 2022 Cengage. All Rights Reserved. May not be
scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part. 37
 Knowledge Check Activity 2: Answer

The final process in the vulnerability assessment and remediation domain is the
_____ phase.

Answer: remediation
Remediation cannot be undertaken until all vulnerabilities are identified,
categorized, classified and prioritized.

Michael E. Whitman and Herbert J. Mattord, Principles of Information Security, 7th Edition. © 2022 Cengage. All Rights Reserved. May not be
scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part. 38
 Readiness and Review (1 of 2)

• Primary goal is to keep information security programs functioning as designed

and continuously improving
• Accomplished by
− Policy review
− Program review
− Rehearsals

Michael E. Whitman and Herbert J. Mattord, Principles of Information Security, 7th Edition. © 2022 Cengage. All Rights Reserved. May not be
scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part. 39
 Readiness and Review (2 of 2)

Michael E. Whitman and Herbert J. Mattord, Principles of Information Security, 7th Edition. © 2022 Cengage. All Rights Reserved. May not be
scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part. 40
 Physical Security (1 of 3)

• Physical security involves the protection of physical items, objects, or areas

from unauthorized access and misuse
• Most technology-based controls can be circumvented if an attacker gains
physical access
• Physical security is as important as logical security

Michael E. Whitman and Herbert J. Mattord, Principles of Information Security, 7th Edition. © 2022 Cengage. All Rights Reserved. May not be
scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part. 41
 Physical Security (2 of 3)

• Donn B. Parker’s seven major sources of physical loss:

1. Extreme temperature
2. Gases
3. Liquids
4. Living organisms
5. Projectiles
6. Movement
7. Energy anomalies

Michael E. Whitman and Herbert J. Mattord, Principles of Information Security, 7th Edition. © 2022 Cengage. All Rights Reserved. May not be
scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part. 42
 Physical Security (3 of 3)

• Community roles
− General management is responsible for facility security
− IT management and professionals are responsible for environmental and
access security
− Information security management and professionals perform risk
assessments and implementation reviews

Michael E. Whitman and Herbert J. Mattord, Principles of Information Security, 7th Edition. © 2022 Cengage. All Rights Reserved. May not be
scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part. 43
 Physical Access Controls

• Secure facility is a physical location with controls implemented to minimize the

risk of attacks from physical threats
• Secure facility can take advantage of natural terrain, local traffic flow, and
surrounding development and can complement these with protection
mechanisms (fences, gates, walls, guards, alarms)

Michael E. Whitman and Herbert J. Mattord, Principles of Information Security, 7th Edition. © 2022 Cengage. All Rights Reserved. May not be
scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part. 44
 Physical Security Controls (1 of 8)

• Walls, fencing, and gates

• Guards and dogs
• ID cards and badges
• Locks and keys
• Electronic monitoring
• Alarms and alarm systems
• Computer rooms and wiring closets
• Interior walls and doors
Michael E. Whitman and Herbert J. Mattord, Principles of Information Security, 7th Edition. © 2022 Cengage. All Rights Reserved. May not be
scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part. 45
 Physical Security Controls (2 of 8)

• Walls, Fencing, and Gates

− Some of the oldest and most reliable elements of physical security and the
essential starting point for perimeter control
• Guards and dogs
− Can evaluate each situation as it arises to make reasoned responses and
most have standard operating procedures
− Dogs have a keen sense of smell and hearing and can detect intrusions that
human guards cannot

Michael E. Whitman and Herbert J. Mattord, Principles of Information Security, 7th Edition. © 2022 Cengage. All Rights Reserved. May not be
scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part. 46
 Physical Security Controls (3 of 8)

• ID Cards and Badges

− ID card is typically concealed, while a name badge is visible
− Serve as a simple form of biometrics (facial recognition)
− Should not be the only means of control as cards can be easily duplicated,
stolen, and modified
− Tailgating occurs when an authorized individual opens a door and other
people also enter

Michael E. Whitman and Herbert J. Mattord, Principles of Information Security, 7th Edition. © 2022 Cengage. All Rights Reserved. May not be
scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part. 47
 Tailgating

Michael E. Whitman and Herbert J. Mattord, Principles of Information Security, 7th Edition. © 2022 Cengage. All Rights Reserved. May not be
scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part. 48
 Physical Security Controls (4 of 8)

• Locks and keys

− Two types of locks: mechanical and electromechanical
− Locks can also be divided into four categories: manual, programmable,
electronic, biometric
− Locks fail and so alternative procedures for controlling access must be put in
place
− Locks fail in two ways
 Fail-safe lock
 Fail-secure lock
Michael E. Whitman and Herbert J. Mattord, Principles of Information Security, 7th Edition. © 2022 Cengage. All Rights Reserved. May not be
scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part. 49
 Physical Security Controls (5 of 8)

• Electronic Monitoring
− Equipment can record events in areas where other types of physical controls
are impractical
− Cameras with video recorders, including closed-circuit television (CCT)
systems
− Drawbacks
 Passive and does not prevent access or prohibited activity
 Recordings often are not monitored in real time and must be reviewed to
have any value

Michael E. Whitman and Herbert J. Mattord, Principles of Information Security, 7th Edition. © 2022 Cengage. All Rights Reserved. May not be
scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part. 50
 Physical Security Controls (6 of 8)

• Alarms and alarm systems

− Alarm systems notify people/systems when an event occurs
− Fire detection, intrusion, environmental disturbance, or an interruption in
services
− Reliance on sensors that detect an event: motion detectors, thermal
detectors, glass breakage detectors, weight sensors, and contact sensors

Michael E. Whitman and Herbert J. Mattord, Principles of Information Security, 7th Edition. © 2022 Cengage. All Rights Reserved. May not be
scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part. 51
 Physical Security Controls (7 of 8)

• Computer rooms and wiring closets

− Require special attention to ensure confidentiality, integrity, and availability of
information
− Logical access controls are easily defeated if attacker gains physical access
to computing equipment
− Custodial staff, often the least scrutinized people who have access to offices,
are given greatest degree of unsupervised access

Michael E. Whitman and Herbert J. Mattord, Principles of Information Security, 7th Edition. © 2022 Cengage. All Rights Reserved. May not be
scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part. 52
 Physical Security Controls (8 of 8)

• Interior walls and doors

− Information asset security is sometimes compromised by improper
construction of facility walls and doors
− Facility walls are typically either standard interior or firewall
− High-security areas must have firewall-grade walls to provide physical
security against potential intruders and fires
− Doors allowing access to high-security rooms should be evaluated
− To secure doors, install push or crash bars on computer rooms and closets

Michael E. Whitman and Herbert J. Mattord, Principles of Information Security, 7th Edition. © 2022 Cengage. All Rights Reserved. May not be
scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part. 53
 Failure of Supporting Utilities and
Structural Collapse
• Supporting utilities (heating, ventilation, air conditioning, power, water) have
significant impact on continued safe operation of a facility
• Each utility must be properly managed to prevent potential damage to
information and information systems

Michael E. Whitman and Herbert J. Mattord, Principles of Information Security, 7th Edition. © 2022 Cengage. All Rights Reserved. May not be
scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part. 54
 Heating, Ventilation, and Air Conditioning

• Areas within heating, ventilation, and air conditioning (HVAC) systems that can
cause damage to information systems include
− Temperature and Filtration
− Humidity and Static Electricity
• Ventilation shafts
− Ductwork is small in residential buildings but large enough in commercial
buildings for an individual to climb through
− If ducts are large, security can install wire mesh grids at various points to
compartmentalize the runs
Michael E. Whitman and Herbert J. Mattord, Principles of Information Security, 7th Edition. © 2022 Cengage. All Rights Reserved. May not be
scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part. 55
Power Management and Conditioning (1 of 2)

• Power systems used by information-processing equipment must be properly

installed and correctly grounded
• Noise that interferes with the normal 60 Hertz cycle can result in inaccurate time
clocks or unreliable internal clocks inside CPU
• Grounding and amperage
− Grounding ensures that returning flow of current is properly discharged to
ground
− GFCI is capable of quickly identifying and interrupting a ground fault
− Overloading a circuit can create a load exceeding electrical cable’s rating,
increasing the risk of overheating and fire
Michael E. Whitman and Herbert J. Mattord, Principles of Information Security, 7th Edition. © 2022 Cengage. All Rights Reserved. May not be
scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part. 56
Power Management and Conditioning (2 of 2)

• Uninterruptible power supply (UPS)

− In case of power outage, UPS is the backup power source for major
computing systems
− Basic UPS configurations:
 Standby
 Line-interactive
 Standby online hybrid
 Standby ferroresonant
 Double conversion online
 Data conversion online
Michael E. Whitman and Herbert J. Mattord, Principles of Information Security, 7th Edition. © 2022 Cengage. All Rights Reserved. May not be
scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part. 57
 Knowledge Check Activity 3

Power systems used by information-processing equipment must be properly

installed and correctly _____.

Michael E. Whitman and Herbert J. Mattord, Principles of Information Security, 7th Edition. © 2022 Cengage. All Rights Reserved. May not be
scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part. 58
 Knowledge Check Activity 3: Answer

Power systems used by information-processing equipment must be properly

installed and correctly _____.

Answer: grounded
Grounding ensures that the returning flow of current is properly discharged to the
ground. If the grounding elements of the electrical system are not properly
installed, anyone who touches a computer or other electrical device could
become a ground source, which can cause damage to the equipment and injury
or death to the person.

Michael E. Whitman and Herbert J. Mattord, Principles of Information Security, 7th Edition. © 2022 Cengage. All Rights Reserved. May not be
scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part. 59
 Interception of Data

• Three methods of data interception:

− Direct observation
− Interception of data transmission
− Electromagnetic interception
• U.S. government developed the TEMPEST program to reduce the risk of
electromagnetic radiation (EMR) monitoring

Michael E. Whitman and Herbert J. Mattord, Principles of Information Security, 7th Edition. © 2022 Cengage. All Rights Reserved. May not be
scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part. 60
 Securing Mobile and Portable Systems

• Mobile computing requires more security than typical computing infrastructures

on the organization’s premises
• Many mobile computing systems have corporate information stored within them
• Some are configured to facilitate user’s access into organization’s secure
computing facilities
• Controls support security and retrieval of lost or stolen laptops

Michael E. Whitman and Herbert J. Mattord, Principles of Information Security, 7th Edition. © 2022 Cengage. All Rights Reserved. May not be
scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part. 61
 Remote Computing Security

• Remote site computing involves variety of computing sites outside the

organization’s main facility
• Telecommuting is off-site computing using Internet, dial-up, or leased point-to-
point links.
• Remote working became critical during COVID-19 pandemic
• Employees may need to access networks on business trips and telecommuters
need access from home systems or satellite offices
• Telecommuter’s computers must be made more secure than organization’s
systems
Michael E. Whitman and Herbert J. Mattord, Principles of Information Security, 7th Edition. © 2022 Cengage. All Rights Reserved. May not be
scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part. 62
 Special Considerations for Physical
Security Threats
• Develop physical security in-house or outsource?
− Many qualified and professional agencies
− Benefit of outsourcing includes gaining experience and knowledge of
agencies
− Downside includes high expense, loss of control over individual components,
and level of trust that must be placed in another company
• Social engineering: use of people skills to obtain information from employees
that should not be released

Michael E. Whitman and Herbert J. Mattord, Principles of Information Security, 7th Edition. © 2022 Cengage. All Rights Reserved. May not be
scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part. 63
 Summary (1 of 7)

• Change is inevitable, so organizations should have procedures to deal with changes in

the operation and maintenance of their information security program.
• The CISO decides whether the information security program can adapt to change as it
is implemented or whether the process of the risk management program must be
started anew.
• To stay current, the information security community of interest and the CISO must
constantly monitor the three components of the security triple: threats, assets, and
vulnerabilities.
• To assist the information security community in managing and operating the ongoing
security program, the organization should adopt a security management maintenance
model. These models are frameworks that are structured by the tasks of managing a
particular set of activities or business functions.
Michael E. Whitman and Herbert J. Mattord, Principles of Information Security, 7th Edition. © 2022 Cengage. All Rights Reserved. May not be
scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part. 64
 Summary (2 of 7)

• NIST SP 800-100, “Information Security Handbook: A Guide for Managers,” outlines

managerial tasks performed after the program is operational. For each of the 13 areas
of information security management presented in SP 800-100, there are specific
monitoring activities:
1. Information security governance
2. Systems development life cycle
3. Awareness and training
4. Capital planning and investment control
5. Interconnecting systems
6. Performance measures
7. Security planning
Michael E. Whitman and Herbert J. Mattord, Principles of Information Security, 7th Edition. © 2022 Cengage. All Rights Reserved. May not be
scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part. 65
 Summary (3 of 7)

8. Information technology contingency planning

9. Risk management
10. Certification, accreditation, and security assessments
11. Security services and products acquisition
12. Incident response
13. Configuration and change management

Michael E. Whitman and Herbert J. Mattord, Principles of Information Security, 7th Edition. © 2022 Cengage. All Rights Reserved. May not be
scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part. 66
 Summary (4 of 7)

• The maintenance model recommended in this module is made up of five subject areas
or domains: external monitoring, internal monitoring, planning and risk assessment,
vulnerability assessment and remediation, and readiness and review.
• The objective of the external monitoring domain in the maintenance model is to provide
early awareness of new and emerging threats, threat agents, vulnerabilities, and
attacks so that an effective and timely defense can be mounted.
• The objective of the internal monitoring domain is an informed awareness of the state
of the organization’s networks, information systems, and information security defenses.
The security team documents and communicates this awareness, particularly when it
concerns system components that face the external network.
• The primary objective of the planning and risk assessment domain is to keep an eye on
the entire information security program.
Michael E. Whitman and Herbert J. Mattord, Principles of Information Security, 7th Edition. © 2022 Cengage. All Rights Reserved. May not be
scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part. 67
 Summary (5 of 7)

• The primary objectives of the vulnerability assessment and remediation domain are to identify
specific, documented vulnerabilities and remediate them in a timely fashion.
• The primary objectives of the readiness and review domain are to keep the information security
program functioning as designed and keep improving it over time.
• Physical security requires the design, implementation, and maintenance of countermeasures
that protect the physical resources of an organization.
• An organization’s policy should guide the planning for physical security throughout the
development life cycle.
• In facilities management, a secure facility is a physical location that has controls to minimize the
risk of attacks from physical threats. A secure facility can use natural terrain, traffic flow, and
urban development, and can complement these environmental elements with protection
mechanisms such as fences, gates, walls, guards, and alarms.

Michael E. Whitman and Herbert J. Mattord, Principles of Information Security, 7th Edition. © 2022 Cengage. All Rights Reserved. May not be
scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part. 68
 Summary (6 of 7)

• The management of keys and locks is a fundamental part of general management’s

responsibility for the organization’s physical environment.
• A fail-safe lock is typically used on an exit door when human safety in a fire or other emergency
is the essential consideration. A fail-secure lock is used when human safety is not the dominant
factor.
• Fire suppression systems typically work by denying an environment one of the three
requirements for a fire to burn: temperature (an ignition source), fuel, and oxygen.
• Four environmental variables controlled by HVAC systems can cause damage to information
systems: temperature, filtration, humidity, and static electricity.
• Computer systems depend on stable power supplies to function; when power levels are too
high, too low, or too erratic, computer circuitry can be damaged or destroyed. The power
provided to computing and networking equipment should contain no unwanted fluctuations and
no embedded signaling.
Michael E. Whitman and Herbert J. Mattord, Principles of Information Security, 7th Edition. © 2022 Cengage. All Rights Reserved. May not be
scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part. 69
 Summary (7 of 7)

• As with any phase of the security process, the implementation of physical security must
be constantly documented, evaluated, and tested. Once the physical security of a
facility is established, it must be diligently maintained.
• Data can be intercepted electronically and manually. The three routes of data
interception are direct observation, interception of data transmission, and interception
of electromagnetic radiation.
• With the increased use of laptops, tablets, and smartphones, organizations should be
aware that mobile computing requires even more security than the average in-house
system.
• Remote site computing requires a secure extension of the organization’s internal
networks and special attention to security for any connected home or off-site computing
technology.
Michael E. Whitman and Herbert J. Mattord, Principles of Information Security, 7th Edition. © 2022 Cengage. All Rights Reserved. May not be
scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part. 70
 Self-Assessment

• You learned about Capability Maturity Model Integration (CMMI) on page 490 of
the textbook.
• From what you learned about CMM in general and CMMI in particular, should a
company try to gain higher levels of CMMI as a goal? What would be the benefit
of achieving an improved CMMI score?

Michael E. Whitman and Herbert J. Mattord, Principles of Information Security, 7th Edition. © 2022 Cengage. All Rights Reserved. May not be
scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part. 71