Physical Security Recommendations

Consider the following list of guidelines when you develop a security policy for your site.

• Restrict access to the systems that are configured with Trusted Extensions. The most secure locations are generally interior rooms that are not on the ground floor.

• Monitor and document access to systems that are configured with Trusted Extensions.

• Secure computer equipment to large objects such as tables and desks to prevent theft. When equipment is secured to a wooden object, increase the strength of the object by adding metal plates.

• Consider removable storage media for sensitive information. Lock up all removable media when the media are not in use.

• Store system backups and archives in a secure location that is separate from the location of the systems.

• Restrict physical access to the backup and archival media in the same manner as you restrict access to the systems.

• Install a high-temperature alarm in the computer facility to indicate when the temperature is outside the range of the manufacturer's specifications. A suggested range is 10°C to 32°C (50°F to 90°F).

• Install a water alarm in the computer facility to indicate water on the floor, in the subfloor cavity, and in the ceiling.

• Install a smoke alarm to indicate fire, and install a fire-suppression system.

• Install a humidity alarm to indicate too much or too little humidity.

• Consider TEMPEST shielding if machines do not have it. TEMPEST shielding might be appropriate for facility walls, floors, and ceilings.

• Allow only certified technicians to open and close TEMPEST equipment to ensure its ability to shield electromagnetic radiation.

• Check for physical gaps that allow entrance to the facility or to the rooms that contain computer equipment. Look for openings under raised floors, in suspended ceilings, in roof ventilation equipment, and in adjoining walls between original and secondary additions.

• Prohibit eating, drinking, and smoking in computer facilities or near computer equipment. Establish areas where these activities can occur without threat to the computer equipment.

• Protect architectural drawings and diagrams of the computer facility.

• Restrict the use of building diagrams, floor maps, and photographs of the computer facility.