Choosing Physical Controls

The managerial controls lesson covered training and policy. This lesson chooses physical controls for one site, a wind farm's operations building. It holds a control room, a maintenance garage, and a visitor center that hosts school tours. A walkthrough produced the findings below, and this lesson picks a control for each, then an order to buy them in.

A control is chosen from the attack it has to stop. Take the garage rack. An adversary standing at the rack can switch a server off, plug in a device of their own, or carry a server away. Each attack starts with a hand on the rack.

A control can prevent that attack by keeping the hand off the rack. It can detect it by recording who reached the rack. Or it can correct it by limiting the damage afterward.

With no gate, a vehicle can drive up to the garage at night, and a stolen server leaves in it. A fence around the garage and the back of the building, with a gate on the road, answers that. It deters: an adversary is less likely to try, and one who does has to climb it. The shoulders beside the gate are flat, so bollards set in them keep a pickup from driving around it.

An adversary who climbs the fence meets the garage door next. It's locked at night, but it's the only lock on the path. An adversary who gets through it stands at the rack with nothing else in the way. A lock on the server cabinet puts a second lock between that adversary and the servers. The laptop on the bench could leave under a jacket, so a cable lock ties it down.

The side door has a different problem. Each crew member's key opens it on every day, so a member of one crew can enter on another crew's day. The lock also records nothing. A card reader gives each crew member a badge that opens the door only on that crew's scheduled days. It also logs which badge entered and when. So the reader prevents by turning a badge away on the wrong day, and detects by keeping that log.

The corridor door has a card reader, and a technician's badge passes it, so another reader adds nothing. The risk is a technician admitting a tour member. It happens on purpose when a technician holds the door for someone who seems to belong. It happens by accident when a tour member walks in behind a technician. A turnstile turns once per badge, so the technician passes and the tour member doesn't. An access control vestibule would also work.

Past the turnstile, the four workstations still take a flash drive in any USB port. An adversary with a minute at one could plug in a drive that loads malware onto the machine commanding the turbines. Disabling USB storage on all four stops any drive from loading. The keyboards and mice still work, and the operators load every setting over the network, so they lose nothing.

When the line failed last year, the servers and workstations went dark, and the operators lost sight of the turbines. An adversary who cut the line would get the same result. No control on site can keep the line up, so these controls keep the systems running through the failure instead. A UPS in the server cabinet, and a small one under each control-room workstation, takes over the instant the line fails and holds them for forty minutes. A generator powers the whole building through an outage as long as last year's six hours.

The seven controls cost 69,500 dollars together, so they need an order. Severity is the harm that follows if a finding is exploited. Three controls answer high-severity findings, since each of those puts the turbine controls at risk: the rack and the service laptop beside it, the workstation ports, and power to the servers and workstations. Three are moderate, because an earlier control now stands behind each one. The locked cabinet stands behind the side door, and the disabled ports behind the corridor. The UPS covers the first forty minutes of any outage, so only a long one needs the generator. The road is low, since everything it leads to has its own control.

The list is sorted by severity, then by cost within a level. Severity comes first because a cheap fix to a mild finding would leave a severe one open. That's why the card reader, at 2,100 dollars, comes after the 2,600-dollar UPS.