Designing Physical Security

Physical security may be overlooked because it is not as complex or interesting as technology security. Assets are things of value, and may include computer devices, equipment, and/or files, or non-computer devices, equipment, paper files – or other things of value: money, checks, art, chemicals, prototypes, ideas on boards. Of organization-reported security breaches, one major cause involves lost, misdelivered or stolen media and documents. Skimmers remain a concern for Point of Sale and ATM machines. All of these physical issues involve or could involve data breaches, protected by law or PCI DSS. To plan for physical security, we inventory rooms, and use the classification system from Information Security to select sensitivity and criticality controls. We consider outdoor, indoor and specialized controls for computer assets.