Managerial Controls for Physical Security

This lesson covers two managerial controls for physical security. The first is a workstation security policy, the written measures that protect each desk in a workplace. The second is security awareness training, which teaches employees how they can contribute to the organization's security. Both are applied to one office throughout.

A state university's financial aid office has two areas. At the front counter, student workers check in students who come in about their aid. Each check-in record shows a student's name, student ID number, and reason for the visit.

A staff door, opened by employee badges, leads to the back office. There, counselors work through families' tax forms and prepare award letters.

The two areas handle different data. A check-in record names a student and the reason for a visit. A counselor's screen and desk hold a family's income and the aid the student will receive. Since the back-office data is far more sensitive, its workstations need stricter protection. So the office writes its policy in two tiers, one for each area.

Each requirement answers something that happens in this office. The counter monitors are angled toward the line of students waiting to check in, so the next student can read the record from the side. Each counter monitor therefore gets a privacy screen filter, a physical barrier that prevents others from viewing what's on the screen.

A counselor often walks out to the lobby to meet a family. The workstation stays behind, signed in to that family's file. Locking the device before walking away prevents unauthorized access to the file while the counselor is gone.

The same counselor may have the family's tax forms spread across the desk. Student workers pass through the back office on errands, and anyone passing an empty desk can read the paper on it. So the forms go into a locked drawer before the counselor walks out.

The last requirement concerns power. A counselor builds an award package over a long session before saving it, and an outage would lose the unsaved work. So each counselor's computer is plugged into an uninterruptible power supply (UPS), which keeps it running long enough to save the work when the building's power drops. The counter computers use surge protectors, which guard a device against a sudden spike in power.

The policy covers the desks. Three other risks in the office turn on what one employee does: a message in the inbox, the staff door, and a tablet at closing. The office's second managerial control is training for every employee.

The phishing part of the training works through a message like this one, sent to a counselor.

The message claims to come from the federal student aid system and asks for a password. The office's training states that the aid system never asks for a password by email. The sender's address also isn't the one the aid system's notices come from. So this is a social engineering attempt, and the counselor reports it to the office's IT contact without opening the link.

A student worker's friend, waiting to see a counselor, asks to come through the staff door and wait in the break room. The back office is a restricted area, since the families' tax forms are behind that door, so the student worker doesn't badge the friend in. The friend waits in the lobby like any other student.

Walk-in students check themselves in on a tablet at the end of the counter, and at closing it's sometimes left out. The counter opens onto a hallway that stays open for evening classes, so through the evening the tablet is within reach of anyone in the building. The training has the last student worker on shift lock it in the cabinet under the counter.