Pass your certification exam. Faster. Guaranteed.

Internal Facilities Security Transcription

Welcome to our internal facilities security module. It is important that you control visitors entering your facility and have an escort requirement so that individuals are not moving about the facility without being monitored. You should have a visitor policy and make sure that the policy is enforced all of the time.

Visitors should enter a public area and should be provided to provide government issued photo identification. You should then consider how you will provide visitor passes. Will you print badges with photos or use standard visitors badges? Will you need to get a printer for this purpose or will you use pre-made labels?

Are you going to provide a lanyard or some type of clip so that they can wear the ID? You should also make sure that you have employees or security guards that are qualified to be escorts. These individuals should additional training and should know different procedures that they should follow when handling visitors.

You should not just let any employee be responsible for transporting visitors in the facility. You should also consider the visitor request process, how individuals will request permission to bring visitors in. Will there be an approval process? Should you have a photo of the visitor? Are you going to collect a fingerprint or other biometric data from this individual?

And you should also make sure that your visitors sign in and out with a time, and check these logs daily to make sure that you don't have unauthorized person entering the facility. The time-based log will also be helpful in the event of an emergency, so you know who is in the building and who may need to be evacuated.

And is also helpful in case of an incident, you will know who is on the property. You should have a specific individual responsible for handling deliveries and controlling delivery personnel so that they are not granted unrestricted access to your facility. You should also make sure that you're using appropriate keys and locking systems.

And decide whether to use mechanical locks, cipher locks, electronic access control locks, or perhaps even biometric locks. You should make sure that the installation and service of the locks is done by a qualified individual. This can either be an internal facilities individual with proper training, or by using an outside vendor that you trust to handle this task.

You should also make sure that you control access to keys. And that individuals are required to sign out and sign in keys so that you know who had access to sensitive areas at what time. You can use access control systems in order to make sure that only authorized individuals can access controlled, sensitive areas. You can use proximity or prox cards which operate on a RFID technology that allows you to hold a card or device like a key fob near a reader and get access to a specific area. You can use a swipe card with a magnetic stripe that the user swipes into a card reader and that card reader verifies that they have permission to access the sensitive area.

You can use a smart card with an integrated circuit chip to control access to certain locations. This is common with the Department of Defense, CAC or Common Access Card which serves as an identification card and also has a chip to allow access to computer systems and sensitive areas.

These cards can use single factor authentication or multi-factor with a pin or password. Multi-factor is definitely going to be more secure than single factor and with this, the user would insert the card or swipe the card and then either be required to provide a pin number, or use some type of biometric like a fingerprint, or perhaps a facial scan.

You can use photo identification badges and guest badges. And access badges with photos will be much more secure because someone will not be able to pick one up that they find in the parking lot, perhaps and pretend to be that individual. You can also consider color coding badges to indicate the access level that that person has.

This way if they access a sensitive area and their badge does not have the correct color, all of the employees in that area should be able to very easily tell that they do not belong in that sensitive area. You should also have an access control database, which can help you to log individuals as they enter and exit your facilities.

And can also simplify the process of granting or revoking employees privileges to access certain areas as they change jobs or perhaps leave the company. You can use security guards to increase the security at your facility. These security guards are able to deter and detect, as well as investigate any improper actions.

You can use them to check individual's identification cards at entry points. You can also use them to check individuals as they leave the facility to make sure that they are not taking your company equipment out of the building. They can monitor your alarm systems, both intrusion detection and fire alarms, they can enforce regulations and look for suspicious activity and at the end of the day they can make sure that all of your doors and windows are properly secured.

One of the biggest advantages of a security guard is they can exercise discernment, or the ability to look at a situation and determine if any further action needs to be taken or not. There are some disadvantages when using security guards. They will be the most expensive control that you can put in place because you will be required to constantly pay them a salary.

Whereas other controls, once you purchase them, they have little ongoing costs. They could also increase your liability and chance of being sued if they take any improper action. And you should make sure that you have insurance in place to cover any of these types of incidents that might occur. You can use access logging at your doors to keep track of who is entering and exiting your facility. This can be very helpful if your facility requires that level of protection. You can use security guards to maintain the access logs and these guards will be very useful to check an individual's identification and also to take photographs of visitors and issue them temporary identification cards.

Access logging is not considered a preventative control, but a detective control. You basically will collect the logs and maintain them, either in hard copy or on a computer system, or even on your video surveillance system, so that if an incident occurs you can go back and review the logs at a later time to determine who was in the facility.

These logs should capture who entered the facility, when they entered, where they were going, who they were going to visit, who signed the responsibility to escort them, and also what time they left your facility. You can use zoned or progressive security to provide additional controls in more sensitive areas and less monitoring and controls in less sensitive areas.

You can use cameras and coworker awareness to make sure that unauthorized persons are not accessing sensitive areas. Color-coded ID badges can make it easy to determine who belongs in a certain area. But in order for this to be effective, you should have a requirement that all individuals in the facility must display their ID badges at all times.

You should not allow any unescorted visitors. You should require visitors to be with an escort at all times. And you should require them to display a visitor ID badge which is clearly different than the employee ID badges. You can also limit your exposure to any theft of sensitive data by having a clean desk policy.

A clean desk policy requires that at the end of each shift employees totally clear their desk and lock up all sensitive information. This way, you do not have individuals like cleaning personnel and maintenance personnel accessing sensitive documents. You should be familiar with the clean desk policy for the CISSP examination.

It is also important to make sure that your employees are safe. You should have emergency lighting that is tested at regular intervals. And this way, if the power goes out employees can still find their way safely out of the building. You should have clearly labeled exits with lit exit signs.

And these should also be battery powered in case the power goes out, individuals can find their way to the nearest exit safely. You should have fire suppression systems, such as fire extinguishers and sprinklers. And you should also have a fire alarm system and this should have both an audible and visible warning for individuals who may be hearing impaired.

You should provide disaster training to your employees so that they know what actions they should take if an emergency occurs. You should also keep your facility neat and clean and avoid any fire hazards or tripping hazards. You can also consider using a dark facility where the lights stay out at all times unless someone is inside your sensitive area, such as a data center. D3-19 - Internal Facilities Security So since people are a threat to your environment, you would keep the lights out in the data center to discourage individuals from accessing that area, and also to alert others if someone does access that area. Because if the lights are not usually on and someone notices that they are on, then they can either look to see who is inside the data center, or notify security to find out why the lights are on.

This concludes our internal facilities security module. Thank you for watching.