Securing a Fixed Workstation

In Brief

Physical security is intended to work towards the exploitation of IT equipment under optimal conditions in order to benefit from the best possible performance for the longest possible amount of time.

When talking about measures or demonstrations, the difference between preventive actions and protective actions should be highlighted.

It would be foolhardy to believe that preventive measures could prevent all incidents. Even if such remediation measures are implemented, it is recommended that other protective measures should be implemented, too.

The scope of the necessary protective measures is inversely proportional to the protective measures already implemented.

Computer/IT Room

For various reasons relating to the type of equipment, its operating equipment, its criticality, noise and heat produced, etc., it is prudent to use dedicated IT/computer rooms separated from the working areas used by employees.

There are different types of IT/computer room:

‘Data Centre’ Computer/IT Rooms

Rooms such as this usually hold specialist equipment necessary for the provision of IT resources. They hold servers, large-scale computers, backup and data restore solutions, storage bays, etc.

In most medium-sized companies, such rooms also contain critical network elements (exchanges, routers, etc.) and access points and equipment used to connect the company to the outside world (telephone switchboard, Internet access, etc.).

In most large structures, there are various specialised rooms, known as the network room, telephony room, and connections room.

In the largest computer centres, it is even possible to make the distinction between ‘dead’ rooms, which host equipment which requires very little human intervention (processors, storage, etc.) and ‘live’ rooms, hosting equipment which requires frequent human intervention (backup automation, etc.).

Upper Floor Connection Room

There are often rooms on upper floors used to connect equipment on that floor to the wiring leading to the main IT/computer room. These rooms usually include patch panels and floor switches.

These rooms and their connections are usually designed with maximum redundancy to prevent disruption to the fullest possible extent.

Given the criticality of this equipment, these rooms are deemed to be IT/computer rooms and are therefore subject to the same design and monitoring requirements.

Protection Against Incidents

The prevention and protection measures detailed in this document are not intended to be exhaustive, or even obligatory in all cases. The choice of applying prevention and protection measures should come as a result of studies including risk analysis, combined with a budgetary assessment and suitable remediation measures.

To ensure the effectiveness of all the proposed prevention and protection measures, they must all be included in an organisational and procedural strategy.

The following aspects are the subject of this chapter:

Organisational Security Measures

Water Damage

Incidents

This type of incident can arise for various reasons, including:

NB:
This point is all the more critical given that most IT/computer rooms are fitted with false ceilings which prevent the easy detection of an incident. Cable routing between floors also provides an easy route for water to pass, making it easy for water to disperse through all types of ‘online’ rooms.

Consequences

The consequences will naturally depend on the scope of the incident, but the areas likely to be affected are:

Countermeasures

Preventive
Protective

Fire Damage

Fire Incident

Be it accidental or criminal, this type of incident can lead to the partial destruction of the company, and more particularly to damage to IT equipment.

Consequences

The consequences can be very significant at all levels of the company. Regarding the IT system, this can cause all or part of the architecture to become unavailable for a fairly long period of time. The damage is often paired with water damage caused by attempts to extinguish the fire and with damage caused by smoke.

There are different types of damage usually experienced in this way, such as:

Countermeasures

Preventive
Protective

SMEs: see Fire

Damage Relating to Electricity

Incidents Relating to Electricity

Electrical incidents can manifest themselves through power disruptions due to over-voltage, drops in voltage, or even power cuts. This type of cut can affect all parts of the company and may have internal or external origins.

Unfortunately, the appearance and duration of these phenomena cannot usually be forecast, except for power cuts announced by the supplier or by the logistics service responsible for the building.

A power cut could be malicious or it could result from an unintended action, and also by natural phenomena such as storms, etc;

Consequences

The risk of damage depends on the severity of the power cut, as some equipment is capable of managing this type of phenomenon so as to properly complete outstanding transactions.

The consequences can be many and varied:

Comments

Do not forget that online equipment distributed across more than one floor, along with personal computers and peripherals are also critical elements that are often sensitive power cuts. 

Countermeasures

Protective
Comments

The effects of a power cut often continue upon restarting. When attempting to restart everything, there is often an overload that trips the fuses. A sequential restart of equipment should instead be performed.

SMEs: see

Electrical Faults

Incidents Relating to Electrical Faults

Computer equipment is designed to work in specific environments to avoid the following incidents:

Consequences

Normal operating conditions should be respected at all times; otherwise, several malfunctions could arise that are difficult to diagnose. However, the usual consequences of an air-conditioning breakdown are as follows:

Countermeasures

Preventive
Protective

Telecommunications Incidents

Incidents

We can cite the following, among such incidents:

This heading includes incidents which directly affect physical elements, such as logical intrusions on IT systems. These, however, are not the subject of this section.

Consequences

The impact depends on the usage that is made of the services affected in the critical production chains. The consequences are as follows:

Countermeasures

Preventive
Protective

SMEs: see

Physical Intrusions

Incidents

The entry of unauthorised people in IT/computer rooms (and in the company’s premises) can lead to many unwanted situations, including:

Consequences

The consequences can be as follows:

Countermeasures

Particularly in this area, it is crucial to frame everything with organisational, procedural and audit measures.

Preventive

Protective

Comments

Before implementing these surveillance measures, please seek authorisation from the National Committee for Data Protection (Commission Nationale pour la Protection des Données).

SMEs: see

Electrostatic Phenomena

Incident

This section deals with all types of electromagnetic and electrostatic phenomena.

This issue can originate from a source outside the company, such as weather phenomena, radio waves or miscellaneous electrical devices. The source can also be related to the building.

Consequences

The consequences can be as follows:

Comments

Another phenomenon is the use of radiation emitted by the computer system to intercept data. Such is the case with wireless networks, for example.

Countermeasures

Preventive
Protective

Inaccessibility of the IT/Computer Centre

Incidents

Access to the computer/IT centre can be blocked for reasons such as:

Consequences

There can be a number of different consequences to any loss of accessibility:

Countermeasures

Preventive
Protective