Chapter 2: Install security control measures

Security control measures are essential for ICT technicians tasked with safeguarding information systems within Kenyan organizations. These controls protect physical assets, data, and network resources from theft, damage, or unauthorized access, ensuring operational continuity and compliance with legal frameworks such as the Data Protection Act. This chapter focuses on installing both physical and logical security controls, enabling technicians to implement effective defenses in environments like county government offices, banks, and educational institutions.

2.1 Physical control measures

Physical control measures are the barriers, devices and people that protect ICT equipment and the rooms that hold it from theft, tampering, vandalism, fire, flooding and unauthorised entry. Software protection is of little use if someone can walk into a room, unplug a server or carry away a hard disk. Physical controls therefore form the outer layers of protection and work together with the logical controls taught in the next topic. This topic introduces the idea of control measures and then shows how each physical control is selected, installed and maintained.

2.1.1 Introduction to security control measures

A security control measure is any action, device or rule that reduces the chance or the effect of a threat to ICT assets. Controls are grouped as physical, logical and administrative: physical controls protect places and equipment, logical controls, also called technical controls, protect data and systems through software, and administrative controls are the policies, training and procedures that guide people. Chapter 1 introduced controls by asset type and by nature; this topic concentrates on the physical group, which protects hardware, cabling, power and the premises themselves.

Layers of physical protection

No single barrier is trusted alone. Physical security uses layers, an approach called defence in depth, so that an intruder who passes one layer meets the next. A computer repair and networking workshop may use four layers:

• Perimeter: the outer boundary, such as a fence, a gate or a lit compound, which discourages casual entry.
• Building: the walls, doors, windows, grills and an alarm that make forced entry difficult and noisy.
• Room: a server or equipment room with its own strong door, lock and restricted list of people allowed in.
• Device: a locked rack or cabinet, a cable lock or a tamper seal on the equipment itself.

Environmental controls for ICT rooms

Equipment can also be harmed by the surroundings, so physical protection includes environmental controls. Smoke and heat detectors give early warning of fire and suitable extinguishers, such as carbon dioxide types for electrical equipment, allow it to be fought safely. Air conditioning or ventilation keeps temperature and humidity within the range the manufacturer states. Surge protectors, uninterruptible power supplies and, where needed, a generator protect against power faults. Water sensors and keeping equipment off the floor protect against leaks and flooding.

Importance of physical controls

Physical controls matter because many serious losses involve the device and not the network.

• Preventing theft: laptops, drives and phones are small and valuable, and one stolen device can expose all of its data.
• Controlling who reaches equipment: a person who can touch a server can bypass many logical controls, so limiting physical access limits that option.
• Reducing downtime: protection from fire, flooding, dust, heat and power faults keeps services running.
• Protecting against insiders: limiting which staff may enter sensitive rooms, and recording entry, protects against misuse by people who already have access to the building.
• Supporting legal duties: protecting storage and equipment is part of the safeguards that the Data Protection Act, 2019 expects for personal data.
• Providing evidence: records from cameras and access logs help to find out what happened after an incident.

2.1.2 Implementation of physical control measures

Implementing a physical control means choosing it to suit an identified risk, installing it correctly, testing that it works, and recording and maintaining it. Controls are installed in the order of the layers, from the outer boundary inwards, and each is documented in the asset register. The following steps apply to protecting an equipment room, such as the room that holds a small internet service provider's servers and switches.

Steps to implement physical controls for an ICT room

1. Identify the assets in the room and the risks to them, such as theft, forced entry, fire and water, using the asset register.
2. Decide the layers needed and choose controls for each, balancing the value of the assets against the cost of the controls.
3. Prepare a list of people who need access and the times they need it, and remove everyone else from the list.
4. Install the barriers first: reinforce the door and frame, fit window grills and burglar proofing, and fit locks.
5. Install the detection systems: security alarm sensors and CCTV cameras, and check that cabling and power supplies are protected.
6. Test every control, for example by opening the door to check that the alarm sounds, and check that the cameras record clearly.
7. Train staff and guards in the rules, record each control in the register and set dates for inspection and maintenance.

2.1.2.1 Grills

A grill is a metal barrier fixed across a window, vent or other opening so that air and light can pass but people cannot. Grills are made of welded steel bars, flat bar or expanded metal mesh, and are fixed to the wall with bolts set into the masonry or through the frame so that they cannot be levered out. They are fitted on windows of rooms holding equipment, on ventilation openings and on the glass panels of doors. A grill on an opening that is also an escape route must be openable from the inside, for example with a lockable gate and the key kept in a known place, so that people can leave during a fire. Grills are checked for rust, loose fixings and cut bars.

2.1.2.2 Security guards

A security guard is a trained person who controls entry, patrols the premises and responds to incidents. Unlike a device, a guard can judge a situation, challenge a stranger and call for help. A guard controlling an equipment area keeps a visitor register that records name, time in, time out, who was visited and the purpose of the visit, escorts visitors and contractors, checks the identity of anyone not known, and records equipment that is taken out. Guards follow written post orders and are briefed on what to do in a fire, an alarm, a break-in or an unknown caller. Organisations that hire guards should use a firm licensed under the Private Security Regulation Act, 2016. Guards cannot watch everything at once, and a determined person may try to talk past them, so they work together with locks, alarms and cameras.

2.1.2.3 Firewall

In physical security a firewall means the hardware appliance, a dedicated box with network ports, that sits between the organisation's internal network and the internet connection. Because it is a physical device, it needs the same protection as any server. It is mounted in a locked rack or cabinet, powered through a surge protector or UPS, and has its console port and unused network ports protected so that nobody can plug in a cable and reset it. A hardware firewall is installed as follows:

1. Mount the appliance in the equipment rack in a locked room or cabinet.
2. Connect it to a protected power source, preferably through a UPS.
3. Connect the WAN port to the internet modem or router and the LAN port to the main switch of the internal network.
4. Connect a management computer to the console or management port and keep that cable and port secured.
5. Label every cable and port, record the device in the asset register, and fit a tamper-evident seal if the policy requires it.

How the firewall decides which traffic to allow is set by rules and software settings, which belong to logical security and are covered in the topic on logical security control measures.

2.1.2.4 Locks

A lock allows entry only to people holding the correct key, code or credential. Locks are chosen according to the value of what they protect and the number of people who need access.

A lock is only as strong as the door and frame it is fitted to, so the frame and hinges are reinforced. Keys and codes are issued to named people and recorded, codes are changed when a person leaves, and spare keys are stored securely. Electric locks need extra care: a door that stays locked when the power fails must still open from the inside, so that people can always get out in a fire.

2.1.2.5 Burglar proofing

Burglar proofing is the strengthening of a building and its openings so that forced entry takes more time, makes more noise and is more likely to be noticed. It goes beyond fitting grills. Measures include a solid or steel-faced door with a strong frame, long screws and hinge pins that cannot be removed from outside, security glass or protective film on windows, shuttering over glass shop fronts, securing roof and ceiling spaces that can be used to climb into a room, outdoor lighting and trimming vegetation that hides people. A computer room should have no weak point that is easier to attack than the door, so every opening is checked in turn, including the ceiling and the wall shared with a neighbouring room.

2.1.2.6 Security alarms

A security alarm detects entry or tampering and warns people by sound or a message. A basic system has a control panel, a keypad to arm and disarm it, detectors, a siren and a backup battery, and may have a communicator that sends a message to the owner or a security company. Detectors are grouped into zones so that the panel shows where the alarm was triggered.

• Door and window contacts: a magnet and switch pair that signals when the door or window is opened.
• Passive infrared (PIR) motion detectors: sense movement by the change in heat in a room and are used inside rooms that are empty at night.
• Glass-break detectors: respond to the sound or shock of breaking glass.
• Vibration or shock sensors: fixed on walls, safes and cabinets to detect drilling or hammering.
• Tamper switches: inside the panel and detectors, to signal if someone opens or disables them.

The alarm is tested regularly, the battery is replaced when weak and users are trained to avoid false alarms, which cause people to ignore real ones. Environmental alarms such as smoke and water sensors can be linked to the same panel.

2.1.2.7 CCTV

Closed-circuit television (CCTV) uses cameras to watch and record an area so that activity can be seen live and reviewed later. A system has cameras, cables or wireless links, a recorder (a DVR for analogue cameras or an NVR for network cameras), storage and a monitor. Network cameras are often powered over the network cable by a Power over Ethernet (PoE) switch. Cameras are placed to cover entrances, equipment rooms and corridors, mounted out of reach, and positioned so that they do not face directly into bright light.

The recorder's storage depends on the number of cameras, the bit rate and how many days are kept. Worked example: eight cameras each record continuously at 4 Mbps and footage is kept for 14 days.

Total bit rate = 8 × 4 Mbps = 32 Mbps

Data per second = 32 ÷ 8 = 4 MB/s

Data per day = 4 MB/s × 86 400 s = 345 600 MB = 345.6 GB

Data for 14 days = 345.6 GB × 14 = 4 838.4 GB, which is about 4.84 TB

The technician therefore chooses a storage size larger than 4.84 TB, for example a 6 TB drive. Recording only on motion, or at a lower bit rate, reduces the figure.

Images of identifiable people are personal data, so under the Data Protection Act, 2019 the organisation should display a notice that cameras are in use, limit who can view footage and keep it only for the period it needs. The recorder is kept in a locked room, because a camera system is useless if the recorder can be taken.

Physical protection of printed ICT records

Printed copies of ICT records such as network diagrams, password sheets and client reports also need physical protection. They are kept in lockable cabinets, handed out only to people who need them, and logged when removed. Records that are no longer needed are destroyed with a cross-cut shredder and not thrown in a bin, and sensitive documents are carried in sealed envelopes. A clear-desk habit, in which nothing sensitive is left on a desk overnight, prevents casual exposure.

Chapter Summary

This chapter explored the installation of security control measures essential for protecting ICT systems. It began with an overview of physical control measures, detailing how grills, security guards, locks, burglar proofing, security alarms, CCTV, and firewalls contribute to safeguarding physical assets. The discussion then shifted to logical security control measures, emphasizing the importance of firewalls, encryption, authentication, authorization, accounting, remote storage, anti-malware solutions, and regular updates or patches in securing digital information. Finally, the chapter addressed the crucial process of testing these implemented controls, outlining various testing techniques and tools used to verify their effectiveness in maintaining system security. Together, these components form a comprehensive approach to mitigating risks and enhancing the resilience of ICT environments.