Security integration, physical environment and media
Security integration begins with the business service and its protection requirements, not with a product shopping list. Establish scope, assets, users, data flows, trust boundaries, dependencies and operating constraints. Convert those requirements into a design that explains which control addresses which threat and how the controls interact. A firewall, identity provider, endpoint agent and logging platform do not become an integrated security service merely because each product has been installed.
A design should identify management and data paths separately. Restrict administrative access, protect credentials, record relevant actions and account for failure behavior. Document permitted traffic with source, destination, purpose and owner instead of leaving a temporary unrestricted rule indefinitely. Integrations need compatible event formats, timestamps and identity references if alerts are to support investigation. Test both intended access and prohibited access, along with performance, recovery and the behavior when an important component is unavailable.
Physical and environmental controls protect the service on which logical controls depend. Identify authorized access, equipment ownership, power continuity, appropriate environmental monitoring and fire/water risks. Facilities and electrical protection should follow the actual professionally approved design and applicable requirements rather than an invented universal temperature, clearance or suppression recipe. A UPS supports some interruptions; its runtime, load and upstream/downstream dependencies still need evidence.
Carrier or media security concerns the media and channels that store or move data, not only a telecommunications operator. Inventory removable devices and storage media, restrict authorized use, protect transfers and choose handling rules for the data class. A deleted filename is not evidence that recoverable data has been sanitized. Sanitization depends on the storage technology, encryption/key state, intended reuse and applicable disposal requirements. Record custody and verification, including what happened to backup or exported copies.
For example, a fictional supplier receives temporary administrative access during installation. Record the approved purpose, scope, expiry and named owner; test that the account cannot reach unrelated systems; collect the required audit evidence; and remove or reauthorize access at handover. Acceptance should include configuration records, test results, recovery instructions, ownership and operator training. Operations then checks drift and reviews changes. This is a general engineering lifecycle, not a claim that these paragraphs reproduce the current official CISAW stage names or complete practical examination.