The Cyber Risk Handbook

Chapter 20 Physical Security

Radar Risk Group Inge Vandijck, CEO, Radar Risk Group, Belgium Paul Van Lerberghe, CTO, Radar Risk Group, Belgium

The head of security, Flory, is impressing on CEO Tom that “. . . physical asset security—not just digital asset security by the IT department—is also important. One without the other does not work.”

“OK,” Tom replied, “but I need to understand exactly how.”

Flory lists several physical risk scenarios in her mind such as:

• A break-in and theft at the data center.
• An imposter physically penetrating their facility pretending to be a visitor or supplier and stealing laptops or leaving lots of USBs on desks hoping someone will eventually plug it in or using latest desktop internal phones to gain digital access, or other means of gaining access to data assets (e.g., network).
• Social engineering by the adversary becoming friendly with guards and physically penetrating the location to gain access to data assets (e.g., network).
• Blackmail and other pressures on guards.
• An employee insider and collusion or sabotage.

In the end, Flory decides to explain a plan to build a state-of-the-art physical security risk management system in order to assist the IT information security function by considering various physical security threat scenarios such as theft, sabotage, and break and entry to the data center.

Tom Commits to a Plan

Tom commits to what he calls Tom’s plan on the advice of Flory, his head of security. It sets out how to plan, implement, ...