Intro

This lesson continues our discussion on physical security by addressing walls, doors, and locks used to manage gaps in structural barriers. You can download the video script above or at the end of the video.

External Wall Types

Let's start with walls. I've separated structural walls into three types; structural site perimeter walls are walls that are both part of a structure and form part of a site barrier. Non-perimeter external walls are the outside walls of a building entirely within and apart from the perimeter barrier. Internal walls create offices wiring closets data centers and other security zones. Sites are often designed with one or more structure exterior walls, used as part of the site perimeter barrier. In this example, the organization uses two building walls as part of a fence barrier.

Exterior Wall Material Considerations

One consideration when a structure forms part of a site perimeter is the construction of the exterior walls. These considerations also apply when a completely internal structure is a medium or high physical security zone. These are not the only options. I provide this information only to demonstrate how wall construction determines penetration times. Organizations must work with contractors to determine the best structural approach for walls.

Structure wall as part of the perimeter

Walls that make up part or all of a site perimeter that is only one story high require a top guard of some type to deter roof access. Further, if windows are included in the perimeter wall, they should either be barred or be too narrow for human access. Again, openings no bigger than 96-inch square inches are considered secure. Finally, no roof access stairs or ladders should be accessible to anyone approaching the site perimeter. These considerations apply not only to perimeter segment walls; they also apply to any structure's exterior walls.

Exterior walls not part of site barrier

One difference is exterior roof access. Ladders and other means of roof access should be locked to prevent access by unauthorized individuals. Finally, utility access panels or other access portals should be locked with controlled access to keys or lock codes.

Roof Considerations

Again, roof access for any structure containing critical infrastructure or data with elevated classifications must be controlled. All ladders or stairs internal or external should be locked with close control over keys or lock codes. All access doors and portals should be locked, and there should be no unsecured openings larger than 96 square inches.

Doors

This is a ground floor floor plan. The back employee-only door is always secured with a cipher lock. We cover lock types later in this lesson. It enters into a medium security zone. The front door is used for public access. Note that public access is restricted to a common welcome area separated from the rest of the building by a locked door. The only way a visitor gains access to other areas of the building is with an employee escort. This is a common and recommended design to limit non-employee access to all areas of the business. The data center is a high-security zone. Note that the data center wall is not shared with the external structure wall. If a data center is located on the ground floor, it should never share an external wall with a structure internal wall.

Internal wall construction

Construction is important when looking at deterrence and prevention. As I've already mentioned, walls enclosing a high-security area should not also form part of a building's exterior wall. As with exterior walls, wall material determines how easy it is to break through. This table is an example of the differences. The table also depicts how the height of walls affects how and how well the walls work.

Wall top gaps

An important consideration is any top gap an intruder can pass over. For example, if the building has suspended ceilings, interior walls often only extend as high as the ceiling. This can leave a gap between the top of the wall and the structure's actual ceiling or roof. Organizations must work with contractors to determine the appropriate materials based on risk.

Doors

Doors are our next topic. As with any barrier, the structure of the door is an important consideration. In our example building, the back door is part of the exterior wall. Security should be strong. A hollow wooden door, for example, is not a good barrier at this location. Instead, a steel door is a better solution. Doors into offices require structure considerations based on the associated risk.

Piggybacking

Piggybacking is a common challenge for door access. It's caused by employees with access being polite and allowing someone else to enter by following them through an external door or a door to a high-security zone without providing a pin, key smart card, or other proof of authorized entry.

Man Traps

For high-security zones like the data center, solutions like man traps are sometimes necessary. This is an example of a mantrap. A single person enters the first door into a controlled area. Access through the first door might be controlled by a human guard or a lock. The first door closes, and then the person proceeds to provide identification to a guard, provides a code or a biometric scan, or both to enter the security zone. In our example, cameras help ensure only one person at a time enters the mantrap. Other solutions include a scale as the floor of the trap to detect weight greater than expected for a single person.

Locks

The final topic of this lesson is locks. Locks are not a silver bullet. Organizations should only use them to deter and delay. The vast majority of locks are easily bypassed by a physical picking or electronic bypass. The effort an intruder is willing to spend to bypass a lock depends on the value of the target. Target value is a big consideration when selecting the right lock. For the purposes of our video, we divide our locks into four types: key locks, combination locks, mechanical push button locks, and electronic push button locks. Key locks, padlocks, door handle locks, and deadbolt locks work with tumblers that are usually easily manipulated. In this example, two common lock picking tools available in kits from Amazon are used to pick the lock. I ordered a kit, a how-to book, and practice locks from Amazon. I was able to train myself to pick locks like this in less than a minute. Further, I was taught at military police school how to break a standard padlock in less than a minute using common toolbox tools. Finally, large bolt cutters can cut many padlocks. Another problem with key locks is key management. Keys are lost and then found by those who shouldn't have them. Re-keying a lock requires making physical changes to the locks, if possible, and the distribution of new keys. Finally, keys are often shared with employees who should not have them to expedite a business process, and are often not returned when an employee leaves employment. High-security padlocks do exist that are resistant to cutting or breaking or picking. This is an example of a Discus lock that might be enough when padlock access is needed. Mechanical push button and other types of mechanical combination locks help reduce the risk associated with key management. Mechanical push button locks are popular solutions for access to restricted areas. The combination for these locks is changeable and not available for use like most lost keys found in the parking lot. However, combinations are still shared allowing unauthorized access or access without accountability. These locks can also be hacked by determined and skilled intruders.

Electronic lock systems

Electronic push-button locks are very similar to mechanical push-button locks. The big difference is the ability to purchase and install electronic locks that are centrally managed and monitored. This is an example from Kintronics that shows a series of door locks and sensors connected via power over ethernet connections. All locks and sensors are monitored via a central portal. This portal could monitor locks and sensors in a single building or across multiple structures across an organization's site. In this example, locks are activated using smart cards placed in close proximity. This is our previous floor plan. It shows connections between the locks and the central hub. The security hub feeds a portal on the nearby desk. In connected systems, lock combinations can be controlled by the portal. Further, a unique combination can be given to each person authorized for access to a specific area. This enables accountability. Monitoring allows detection of anomalous lock activity and logs of access. Most network locks also provide for a panic code an employee can enter if being forced to unlock a secure area by an intruder. The panic code alerts guards or an alarm service that forced entry is in progress. Well, that's it for this lesson. If you have questions, please ask. ...and until next time be careful once you click.