Cisco Gets Physical

Did you know that Cisco has some great solutions for physical security? More importantly, are you thinking about physical security in your environment? Physical security is often overlooked in many environments yet it is just as important as security configurations on your routers and firewalls. Because it is often a weak link it has been a topic I have taken interest in over this last year. One of the fun things I started doing is to practice lock picking. Wait, that probably sounds bad. Let me explain. I get together with a friend of mine and we buy locks and race each other to see how fast we can pick the lock using a ball point pen and a bobby pin. Unfortunately, he usually wins. His best time is six seconds. I’m embarrassed to say that my average time is around eight minutes. Well, actually, it’s probably more than that because usually after anything more than ten minutes I give up. Nevertheless, it is a fun “hobby” (can that really be considered a hobby?). In penetration testing you are sometimes asked to check the physical security of an organization which may also include compromising physical access controls such as locks. One thing I have noticed in testing is that while many places implement biometrics, card readers, and other strong access control measures on their doors, they lack the means to centrally manage all of their doors. Cisco offers the Physical Access Gateway and Physical Access Manager solutions that can manage thousands of doors remotely. Now you can not only have strong access control on your doors but have a means to monitor activity, enroll users, and integrate with applications over your network from a single management station. Physical penetration testing is not just about testing the locks, however, but also testing whether or not you are detected. Good physical security includes not just preventive measures like locks, but also detective and deterrent controls. One popular solution that provides both detection and deterrent is video surveillance. The Cisco Video Surveillance Manager solution offers some highly efficient solutions for organizations looking to implement video surveillance produces. They offer Video Surveillance IP Cameras, a Media Server to manage your video streams, an Operations Manager for centralized management, and a Media Virtual Matrix that feeds the video into multiple monitors in a command center. Having network physical security management solutions is not without risk however. It continues to shock me that companies would connect their video cameras directly into the same network as their data network or, even worse, their wireless network. This makes it too easy for malicious attackers to compromise the video cameras. If you do implement a solution for surveillance or for door access management, for goodness sakes, keep it in its own separate network. Follow the guidelines for good network security as you would your data network. All this talk of physical security has got me itching to get back to practicing lock picking again. I think it is time for me to take a trip down to the hardware store and pick myself up a new dead bolt lock to practice on.