Physical Security: Secure Your Information System Data Center

Physical security is the controls over computer hardware form the foundation of an organization's Information System (IS) control environment. The computer must be secured from earthquake, hurricanes, floods and other hazards like bombings, vandalism or theft. That's why all organizations should have internal controls in place that help reduce the impact of the disasters.

It is the role of auditors to identify significant physical security control weaknesses then submit the recommendations to management to resolve it. As example, a physical security review of a purpose built computer centre housing a large IBM mainframe computer may require a specific audit of several weeks duration. Here are some of the aspects which need to be considered:

Fire Protection
Fire represents a key area of risk to IT (Informational Technology) infrastructure and good fire protection systems are essential. Fire protection is generally considered under the following headings: fire prevention systems - these include nonsmoking policies, good housekeeping practices such as the prompt removal of waste paper or the use of fire proof materials fire detection systems. It's including the use of smoke and fire detectors in ceiling and floor voids and manual fire alarms, which should be connected directly to a central monitoring station.

Flood Protection
Flooding can be caused by both internal and external sources and the impact can be significant, particularly if the water is contaminated, in which case equipment may be damaged beyond repair. Water detection systems should be installed and where possible, water supplies should be routed away from IT equipment. Care should also be given to the sitting of IT equipment so that it is protected from local hazards, such as being below ground level in an area prone to flooding.

Biometric Hand Geometry Readers
Biometric hand geometry scanners or readers are utilized along with an encrypted or coded database and visual confirmation ensures that only authorized person have the right access to the servers within the data center. Using Pattern Recognition Systems, a device of Access Control Reader, can incorporate proven, biometric technology within the same framework of the data center's security system. This is because authorized person must pass through biometric hand scanners at first for every access checkpoint, the device is able to keep track of any activity such as where and when someone has entered and exited a building or room.

Video surveillance cameras
Can act as an effective deterrent to unauthorized activities and provide critical evidence in criminal prosecution and employee misconduct. Positioned in strategic locations that afford full views of the doors and/or equipment to protect. Previously the video tape was used, now it was changed to newer version of digital video surveillance system.