Why is physical security important? A cybersecurity POV

Why is physical security important? A cybersecurity POV

We have seen how cybersecurity is getting more complex each day, with the threat actors evolving their techniques, tactics, and procedures to surpass all the status quo measures implemented by businesses for cybersecurity.  

Since human error remains one of the biggest and the most exploited factors in cyberattacks, it is also imperative to be aware of physical security and its role in cybersecurity.   

Today, we will be delving into physical security and why it is vital for cybersecurity. 

The rise of hybrid attacks:

When approaching cybersecurity, businesses often fail to address some of the most fundamental aspects of cybersecurity that may make them vulnerable to cyber-attacks. Human error and social engineering remain the most exploited factors in businesses. Modern-day threats have evolved into hybrid attacks that target physical and digital assets.  It is mainly a response to the massive adoption of Internet of Things (IoT) devices, Operational Technology, and similar technology by businesses to operate efficiently.  It has resulted in a significant expansion of attack surface, making cybersecurity more complex than it ever was before. 

Another challenge is the increasing skills gap that is in a way disabling businesses to channel their efforts towards the melioration of cybersecurity resilience. It may be due to a lack of capable teams, resources, technology, lack of awareness, or all the challenges. Modern-day cyber attackers that target large organizations have evolved to orchestrate physical/cyber-attacks on all industrial control systems (ICS), networks, IoT, and OT.    

This is the reason why it is important to understand what is physical security.   

What is physical security?  

Physical security encompasses all the measures that are taken to keep all the people, properties, and physical assets secure from unauthorized access, usage, loss, theft, or damage.   

What are its essential components 

• Access control 
• Surveillance 

Why is physical security important? 

There are two reasons why physical security is crucial for businesses today. One reason is the increase in complexity of the attacks. There are a few possible ways through which cyber attackers may target organizations. Here are some examples: 

• They may target and hack Unmanned Aircraft Systems (UAS) to gather sensitive information by gaining access via an unsecured network through wireless hacking technology.  
• Attackers may override Heating, Ventilation, and Air Conditioning systems to cause a temperature rise, resulting in the inoperability of the network servers.  
• They may gain unauthorized access to facilities by exploiting security gaps in access controls, gaining admin-level access to change individual permissions, and allowing them to use USB devices.   
• By interrupting telecommunications, an attacker can create a delay in the response time of law enforcement and incident response services.  
• Through the exploitation of vulnerabilities in healthcare technology, attackers can steal sensitive healthcare data or cause medical devices to malfunction which can have lethal consequences that could risk lives.   

Another reason why physical security is important is adherence to compliance. Many global and regulatory compliance standards (GDPR, HIPAA, ISO 27001, etc.) recommend implementing best practices for physical security. 

What needs to be done for physical security and cybersecurity?  

Consider the following points before you approach physical security: 

Take an approach that blends physical and cybersecurity holistically and together.

Both physical security teams and cybersecurity teams need to work together while framing policies and implementing measures. Cybercriminals don’t care whether the two departments are separate from each other and engage in hybrid attacks anyway. 

Work with an expert using a risk-based approach for what works best for you. 

Do your research and work with a team of experts who can guide you better such that you don’t take more efficient measures. 

Implement customized access controls  

It means utilizing unique IDs and keycodes for each person instead of using blanket access codes and cards. Individual ID codes are also very hard to track.   

Audit your security and take measures against unauthorized access 

Take a comprehensive security audit of all your IT and physical infrastructure assessing where the information is stored and by whom and whether there are any suspicious activities such as repeated fail attempts and access in odd hours beyond permitted timings. If there is someone who has left the organization make sure you take physical security items back from them such as keys, cards, etc.   

Raise cybersecurity awareness among staff 

Raise awareness, encourage adherence to standard operating procedures and best practices in security, and conduct drills to gauge awareness of the response steps. Take assistance from experts who can ensure that all the requisite measures are in place for physical security.   

How can SharkStriker help? 

Through a team of cybersecurity and compliance experts working directly as your extended team, you can engage in a complete assessment of your organization’s cybersecurity and compliance posture. We engage in gap assessment against the recommended measures and best practices for physical security in various globally renowned standards such as ISO27001, GDPR, etc. We also engage in periodical benchmark assessments that ensure that your business keeps up with the latest updates in compliance guidelines.   

The following are some of the services that we can offer:  

• Risk management
• Security consulting
• Implementation 
• Training