In this inter-networked age, many people often associate security with the more virtual aspects—network, operating system and application security, the underground, crackers, and all of the media-hyped fear, uncertainty, and doubt that surrounds these aspects. Prior to this time, the term security conjured images of armed guards or large, burly men posted by each door. Physical security is a large component of any security policy, and rightfully so. The front door is the most easily utilized point of attack.

The site and infrastructure security policy should outline the methods used to provide and control physical access to the building and the conditions under which access is granted. Important elements are

· Methods of physical access

· Procedures by which access is granted, modified, or denied

· Access restrictions based on employee status

· Hours of operation

· Points of contact for access

· Procedures for incident handling and escalation levels

Physical access methods describe the actual means of accessing the facility, offices, labs, or other areas. These are often a lock and key, proximity cards, or biometric methods. Consideration should also be given to guidelines for the appropriate use and handling of the keys. The procedures used to obtain keys/cards and by which access is granted or modified should be outlined clearly, as it is often a point of confusion for both new and long-time employees. Equally important is a list of the people and departments to whom an employee must go to gain access to the business site—filling out forms or asking approval becomes futile if the person to whom these request should be addressed is unknown.

Many organizations distinguish between full-time, part-time, and contract employees and limit facility access based on these categories. Along with the hours of operation, the site security policy should specify any restrictions for special employees during and outside of regular working hours. Related to the segmentation of employees, the segmentation of the facility is also common. Labs, offices, and storage areas often merit access restrictions in order to prevent unauthorized entry.

Should an incident occur, the procedures for incident handling are vital to the security of an organization, as well as the safety of the employees. Incidents vary in nature, from unauthorized visitors and broken access methods to the removal of employees. Many organizations have security personnel to assist in these matters and suggested methods to react to specific situations. Defined escalation levels help an employee understand incident seriousness and to decide when is the appropriate time to notify external support, such as local law enforcement and legal counsel.

Company Z has installed and uses proximity-based card readers at all external entrances, lab doors, storage closets, and key financial offices for access control.

The administration has defined the following security policy that regulates access into the facility:

· During weekday business hours—between 8 a.m. and 6 p.m.—card access is not required for full-time and part-time employees.

· Contract employees are required to sign in with the receptionist.

· All external doors are locked outside of normal business hours, and card access is required for full-time and part-time employees.

· Contract employees are restricted from access outside of normal business hours unless specialized access forms are filled out and approved by the hiring manager.

· Access to restricted labs, storage areas, and financial offices is gained via specialized access forms and management approval.

· Access cards are obtained at the security office after the hiring manager approves access forms.

· Misplaced or stolen access cards must be reported immediately to security.

· Access cards should be kept on the person at all times; cards should not be loaned to anyone or left unsecured.

The following security policy for incident response is also provided to employees:

In order to ensure safety and security within the Company Z facility, employees should read and understand the following guidelines for dealing with incidents:

· In the event of an unauthorized visitor, the employee should immediately notify the security department and request assistance for removal of the visitor.

· Should the visitor be witnessed committing an act of larceny, attack, or destruction of property, notify the security department, and they will then contact the appropriate authorities.

· All witnesses should provide the security department with an affidavit indicating their presence and the details of the incident, and should be available for further questioning by security and the appropriate authorities.

· All doors, locks, and access methods that are non-functional should be reported to the security department. Security will coordinate with maintenance to fix the broken equipment.

· Managers should be notified when an employee is involved with a breach of security.

· Employees should not handle these situations alone, but instead should notify security and allow the security staff to control the situation.

This example demonstrates important aspects of a site and infrastructure security policy. Constraints on physical access are defined, including the actual methods that employees use to enter the facility and the differentiation between employee types. The processes and procedures used to control access and to acquire the appropriate privileges are outlined, including the identification of the responsible individuals. The response guidelines for any incidents are clearly outlined with the safety of the employee in mind. Individuals trained to handle incidents of this nature are identified and involved in each response method.