Physical and Environmental Security
What this domain tests
Physical and environmental security tests protection of facilities, equipment, and media from unauthorized access, damage, and environmental hazards.
Core rules
- Use layered defenses: perimeter, building, secure zone, cabinet or room, and device.
- Access to secure areas should be authorized, logged, reviewed, and revoked.
- Visitors need escort and badges; logs should be retained.
- Environmental controls include temperature, humidity, water detection, fire detection and suppression, and power.
- UPS and generators need testing; fuel and batteries degrade.
- Fire suppression in server rooms should suit energized electrical equipment, such as clean agent, not water.
- Media storage and disposal must prevent unauthorized recovery.
- Clear desk and clear screen reduce exposure.
Worked example
A server room has a UPS but no monitoring. During a heat wave, the air-conditioning fails. Temperature rises, but nobody is alerted; servers shut down. The review finds no temperature sensor and no escalation path. Treatment: add environmental monitoring with SMS alerts, test the UPS quarterly, add a water sensor near the cooling unit, and document shutdown procedures. Reasoning: controls existed but were not monitored or tested, so the risk remained.
Traps
- Focusing only on door locks.
- Omitting water sensors near cooling and plumbing.
- Using water sprinklers in a server room.
- Keeping no visitor logs or escort records.
- Disposing of media without sanitization.