PHYSICAL ACCESS CONTROLS

CHAPTER 3 - PART 2

Advantages of electronic door locks over bolting

TOPICS COVERED
and combination locks:
● Physical Access Controls 1) Card assignment to a specific (identifiable)
● Auditing Physical Access individual
2) Access restricted to individual’s unique access
PHYSICAL ACCESS CONTROLS needs
● Through the special internal code and
sensor devices, access can be restricted
INTRODUCTION based on the individual’s unique access
● Protection from unauthorized access needs. Restrictions can be assigned to
● Limit access to authorized individuals particular doors or to particular hours of
● Explicit and implicit authorization the day.
3) Difficult to duplicate
EXAMPLES OF PHYSICAL ACCESS CONTROLS 4) Easy deactivation of card entry upon
a) Bolting door locks employee termination or card stolen or lost
● Metal key; do not duplicate; strict (silent or audible alarms; control card keys;
management control example is the swipe card with slotted
● Require the traditional metal key to gain electronic device; for sensitive locations; logs
entry. The key should be stamped “do not card users)
duplicate” and should be stored and issued ● If na terminate yung employee, aalisin yung
under strict management control. access niya.
● Kapag may card key na reported
b) Combination door locks (cipher locks) loss/stolen, mag-aalarm yon. Pwede
● Use a numeric keypad or dial to gain entry malaman kung sino yung nag access.
and are often seen at airport gate entry ● Swipe card - may magnetic chips
doors and smaller server rooms containing data.
● change combination; reduces risk of ○ For logging yung ID na tinatap sa
combination being known UST. More of detective control
● The combination should be changed at ● Silent or audible alarms can be automatically
regular intervals or whenever an employee activated if unauthorized entry is attempted.
with access is transferred, fired or subject ● Issuing, accounting for and retrieving the card
to disciplinary action. keys is an administrative process that should
● This reduces the risk of the combination be carefully controlled.
being known by unauthorized people. ● The card key is an important item to retrieve
● Example: Yung password sa UST dapat when an employee leaves the firm.
palitan every term (regular intervals). ● An example of a common technique used for
● Buburahin yung combi kapag umalis or card entry is the swipe card.
lumipat ng department yung employee. ○ A swipe card is a physical control
Baka kasi may SoD issue. technique that uses a plastic card with a
magnetic strip containing encoded data to
c) Electronic door locks provide access to restricted or secure
● Card key or token and sensor reader locations. The encoded data can be read
● Uses a special code to activate door by a slotted electronic device.
locking mechanism ■ Ex. Timezone
● Use a magnetic or embedded chip-based ○ After a card has been swiped, the
plastic card key or token entered into a application attached to the slotted
sensor reader to gain access. electronic device prevents unauthorized
● A special code stored in the card or token is physical access to those sensitive
read by the sensor device that then locations, as well as logs all card users that
activates the door locking mechanism. try to gain access to the secure location.

❖ Bolting door lock - metal key

❖ Combi door lock - may keypad

1
 Chapter 3: Physical Access Controls - Part 2

❖ Electronic door lock - May plastic card key or ● Logging is typically done at the front
token reception desk and entrance to the computer
room.
● Before gaining access, visitors should also be
Security Token
required to provide verification of
● Physical device (e.g. smart card)
identification such as a driver’s license or
● With something that a user knows (e.g. PIN)
vendor identification tag.
● Allows authorized access to a computer or
network
f) Electronic logging
● A feature of electronic and biometric
Administrative process for card keys of
security systems
electronics locks that should be controlled
○ Dapat hindi na-eedit
includes:
○ Example: pag tap ng card, ATM
a) Issuing of the card keys
● All access can be logged, with unsuccessful
b) Accounting for the card keys
attempts being highlighted.
c) Retrieval of the card keys

RECITATION QUESTION:
d) Biometric door locks
● Activated by an individual’s unique body
Question 1A: Identify the picture:
features; for extremely sensitive facilities
○ Can be voice, retina, finger print,
hand geometry, or signature
■ Ex. GCash, Touch ID
○ This system is used in instances when
extremely sensitive facilities must be
protected, such as in the military.

e) Manual logging
● Requires visitors to sign a log; at the
front reception desk or entrance; requires
providing verification of identification
Answer: combination door lock
○ Lahat ay galing sa manual bago
naging high tech
Question 1B: An advantage of electronic door
○ Important sa computer room. Hindi
locks over bolting and combination locks is:
dapat laging pumapasok yung
Answer:
programmers sa computer room.
1) Card assignment to a specific individual
○ Visitor’s should provide their
2) Access restricted to individual’s unique
identification upon entering.
access needs
○ Paglog ng attendance sa computer -
3) Difficult to duplicate
generally, manual logging siya kasi
4) Easy deactivation of card entry upon
may human intervention kahit nag
employee termination or card stolen or
iinput sa computer. Automated yung
lost
portion ng date and time.
○ Electronic kapag yung computer yung
gumawa without human intervention. g) Identification badges (photo IDs)
● Should be worn and display by all
personnel; different color; sophisticated
Important information in the visitor’s log
photo IDs; control issuing, accounting
1) Name of the visitor
and retrieving badges
2) Company represented
● Visitor badges should be a different color
3) Reason for visiting
from employee badges for easy
4) Person to see
identification.
5) Date and time of entry and exit
● Sophisticated photo IDs can also be
used as electronic card keys.

2
 Chapter 3: Physical Access Controls - Part 2

● Issuing, accounting for and retrieving ● Use two doors in entries to facilities such
the badges is an administrative process as computer rooms and high security
that must be carefully controlled. areas; reduces the risk of piggybacking;
use of a turnstile; may also be used for
h) Video cameras delivery and dispatch areas
● Including motion-activated models, should ● For the second door to operate, the first
be located at strategic points and entry door must close and lock, with only
monitored by guards; retain recording one person permitted in the holding area.
with sufficient resolution ○ Only use one door at a time
● The video surveillance recording should be ● This reduces the risk of piggybacking,
retained for possible future playback, and when an unauthorized person follows an
it should be recorded in sufficient authorized person through a secured entry.
resolution to permit enlarging the image to ● In some installations, this same effect is
identify an intruder. accomplished through the use of a full
● Balance control and costs. Mas malaki height turnstile.
yung cost kapag matagal i-reretain yung ○ Turnstile - Ex. yung nasa MRT or LRT
recording. ● Deadman doors may also be used for
delivery and dispatch areas where outer
i) Security guards doors open to admit a truck and the inner
● Very useful if supplemented by video doors cannot be opened to load or unload
cameras and locked doors; bond for until the outer doors are closed and
guards supplied by external agency locked.
● Guards supplied by an external agency
should be bonded to protect the l) Computer workstation locks
organization from loss. ● Secure the device to the desk to prevent
use; another feature is the use of a
turnkey or card key
Security guard agency bond
● Secure the device to the desk, prevent the
● Ensures the lawful and honest conduct of
computer from being turned on or
the security guard agency in providing
disengage keyboard recognition, thus
security services to its clients
preventing use.
● Also a financial assurance that protects
● Another available feature is locks that
clients from the dishonest acts of the
prevent turning on a PC workstation until a
security guard agency and its personnel
key lock is unlocked by a turnkey or card
key.
j) Controlled visitor access ● This is sometimes seen in the case of
● All visitors escorted by responsible high-security workstations, such as those
employee; bonded personnel that process payroll.
● Visitors include friends, maintenance
personnel, computer vendors, consultants
Turnkey system
(unless long-term, in which case special
● Customized for a particular application
guest access may be provided) and
● Idea: users can just turn the key and the
external auditors.
system is ready go
○ Maintenance - yung software galing sa
● Includes all the hardware and software
scratch, i-momodify mo siya at
necessary for a particular application
ichechange
● All service contract personnel, such as
cleaning people and offsite storage m) Controlled single-entry point
services, should be bonded personnel. ● Monitored by a receptionist
○ This does not improve physical ● Should be used by all incoming
security but limits the financial personnel; unnecessary or unused entry
exposure of the organization. points should be eliminated
● Multiple entry points increase the risk of
k) Deadman doors unauthorized entry.
● Also referred to as a mantrap or airlock
entrance

3
 Chapter 3: Physical Access Controls - Part 2

● Unnecessary or unused entry points, such

follows an authorized person through a secured
as doors to outside smoking or break
entry, this is known as:
areas, should be eliminated.
Answer: piggybacking
● Emergency exits can be wired to an
alarmed panic bar for quick evacuation.
AUDITING PHYSICAL ACCESS
n) Alarm system
● Should be linked to inactive entry points, ● Touring the computer site; provides
motion detectors, and the reverse flow of opportunity to begin review access
enter- or exit-only doors restrictions
● Security personnel should be able to hear ● Include computer site and offsite storage
the alarm when activated. facilities
● Visual observation; Documents to help
o) Secured report/document distribution carts includes:
● Such as mail carts; should be covered, ○ Emergency evacuation procedures
locked and not left-unattended ○ Inspection tags
○ Fire suppression system test results
p) Other physical controls on facilities ○ Key lock logs
● On the computer room or information
processing facility ● Touring the computer site is useful for the
● Not be visible or identifiable from the auditor to gain an overall understanding and
outside perception of the installation being reviewed.
● Discreet identification ● As with environmental controls where the site
● Use of reinforced glass and further is owned by a third party, a contractual right
protection such as bars of audit may be required.
● Facilities such as computer rooms should ● This tour provides the opportunity to begin
not be visible or identifiable from the reviewing physical access restrictions
outside; there should be no windows or (e.g., control over employees, visitors,
directional signs. intruders and vendors).
● The building or department directory ● The computer site (i.e., computer room,
should discreetly identify only the developers’ area, media storage, printer
general location of the information stations and management offices) and any
processing facility. offsite storage facilities should be included in
● If windows are present, they should be this tour.
constructed of reinforced glass and, if on ● Much of the testing of physical safeguards
the ground floor of the building, further can be achieved by visually observing the
protected for example, by bars. previously noted safeguards.
● Documents to assist with this effort
include emergency evacuation procedures,
RECITATION QUESTION: inspection tags (recent inspection?), fire
suppression system test results
Question 2A: Identify the picture: (successful? Recently tested?) and key lock
logs (all keys accounted for and not
outstanding to former employees or
consultants?).

Testing should go beyond the computer room to

include:
● Location of all operator consoles
● Printer rooms
● Computer storage rooms
● UPS/generator
● Location of all communications equipment
Answer: turnstile identified on the network diagram
● Media storage
Question 2B: When an unauthorized person ● Offsite backup storage facility

4
 Chapter 3: Physical Access Controls - Part 2

● To complete a thorough test, the IS auditor

should look above the ceiling panels and
below the raised floors in the computer
operations center observing smoke and water
detectors, general cleanliness, and walls that
extend all the way to the real ceiling (not just
the fake/suspended ceiling).
● For ground-floor computer room, the IS
auditor may consider walking around the
outside of the room viewing the location of any
windows, examining emergency exit doors for
evidence that they are routinely used (such as
the presence of cigarette stubs or litter) and
examining the air conditioning units.
● The IS auditor should consider if additional
threats exist close to the room such as storage
of dangerous or flammable material.

Paths of physical security to be evaluated:

● All entry doors
● Emergency exit doors
● Glass windows and walls
● Movable walls and modular cubicles
● Above suspended ceilings and beneath raised
floors
● Ventilation systems
● Over a curtain, fake wall

RECITATION QUESTION:

Question 3A: (identify the picture)

Answer: generator

Question 3B: An example of an evidence to look

for by an IS auditor when examining emergency
exit doors, if these are routinely used, is the
presence of:
Answer: cigarette stubs or litters