Tutorial 6.11: Infrastructure Security and Facility Protection

Learning Objectives

After completing this tutorial, you should be able to:

• Explain the principles of secure facility design, including site selection and construction.
• Analyze perimeter protection measures and their role in infrastructure security.
• Design security controls for telecommunications and network infrastructure.
• Evaluate data centre security requirements, including redundancy and environmental controls.
• Assess the protection of utilities (power, water, communications) and the need for redundancy.
• Describe security measures for cabling and distribution systems.
• Identify the unique security challenges of industrial control systems (ICS) and operational technology (OT).
• Integrate infrastructure security with physical and logical security controls.
• Conduct a risk assessment for critical infrastructure.

Overview

In Tutorial 6.10, we explored physical and environmental security at the facility level—access controls, environmental systems, and general protection. This tutorial extends that foundation to the critical infrastructure that supports information systems and business operations. Infrastructure security encompasses the protection of telecommunications networks, data centres, cabling, power and utility systems, and other foundational assets that enable the organization to function.

Infrastructure is often the target of sophisticated attacks, both physical and cyber. A disruption to telecommunications, power, or cooling can cripple an organization, regardless of the strength of its logical security. Therefore, infrastructure security must be robust, redundant, and integrated with both physical and logical controls.

This tutorial covers secure facility design from the ground up, including site selection, perimeter barriers, and structural considerations. We will then delve into specific infrastructure components: telecommunications and network cabling, data centre design and redundancy, utility protection (power, water, HVAC), and the unique challenges of industrial control systems (ICS) used in critical infrastructure sectors such as energy, manufacturing, and transportation.

We will also address the integration of infrastructure security with the broader security program, including the role of physical security, cybersecurity, and governance. Through case studies and practical exercises, you will learn how to assess infrastructure risks and design effective protective measures.

Secure Facility Design Principles

The foundation of infrastructure security is a facility designed with security in mind. This involves careful site selection, construction considerations, and space planning.

Site Selection

• Location: Avoid areas prone to natural disasters (flood zones, fault lines, hurricane paths). Prefer locations with stable utilities and low crime rates.
• Surroundings: Minimize proximity to potential threats (e.g., chemical plants, high-crime neighborhoods). Ensure adequate setback from public roads.
• Accessibility: Provide secure and controlled access points for employees, deliveries, and emergency services.

Construction and Building Design

• Structural integrity: Use reinforced concrete, blast-resistant materials for critical areas.
• Window and door security: Use shatter-proof glass, security glazing, and heavy-duty locks.
• Roof and ceiling protection: Secure against unauthorized entry; ensure fire and water resistance.
• Utility entry points: Secure all utility entrances (power, water, telecom) to prevent tampering.
• Zoning: Separate public areas from sensitive operations; use internal walls and partitions to create security zones.
• Emergency egress: Ensure safe, secure evacuation routes that do not compromise security.

Security Integration in Design

• Include space for security operations centres (SOCs) with optimal visibility.
• Pre-wire for CCTV, intrusion detection, and access control.
• Plan for redundant power and cooling infrastructure.
• Design cable pathways and telecom rooms with security in mind.

Secure facility design is a proactive approach that reduces vulnerabilities before construction begins, often being more cost-effective than retrofitting.

Perimeter Protection and Barriers

The outer perimeter is the first layer of defense. It delays and deters unauthorized entry, and provides a clearly defined boundary.

Physical Barriers

• Fencing: Chain-link with barbed wire, anti-climb designs, or solid walls. Height should be at least 8 feet (2.4 m).
• Gates and vehicle barriers: Controlled by guards or electronic access; bollards and crash-rated barriers to prevent vehicle ramming.
• Lighting: Adequate exterior lighting to eliminate shadows and deter intruders.
• Natural barriers: Bodies of water, dense vegetation, or cliffs can augment physical barriers.

Detection and Monitoring

• Perimeter intrusion detection systems (PIDS): Fiber-optic cable sensors, microwave barriers, or buried seismic sensors to detect crossing.
• CCTV: Cameras with night vision and motion tracking, strategically placed to cover all perimeter approaches.
• Security guards: Patrolling the perimeter and manning gates.

Access Control at Perimeters

• Vehicle access: Checkpoint with card readers, license plate recognition, and visual inspection.
• Visitor access: Registration, ID check, and badges before entering.

The perimeter should be regularly tested and maintained, as it is the first line of defense against physical intrusion.

Telecommunications and Network Infrastructure

Telecommunications infrastructure includes all the cabling, routers, switches, and other equipment that connect the organization to the outside world and within itself. Securing this infrastructure is crucial for availability and integrity.

Telecommunications Rooms and Enclosures

• Physical access control: Limit access to telecom rooms to authorized personnel using EAC and biometrics.
• Environmental controls: Maintain temperature and humidity; monitor for water leaks.
• Fire suppression: Use gas-based systems to protect sensitive electronics.
• Cable management: Use organized cable trays and conduits to prevent accidental damage and tampering.

Redundancy and Diversity

• Diverse entry points: Bring telecom cables into the building from at least two different routes to avoid single points of failure.
• Diverse carriers: Use multiple Internet service providers (ISPs) and long-distance carriers for redundancy.
• Wireless backup: Consider cellular or satellite backup for critical links.

Protection from Interception and Tapping

• Encryption: Encrypt all traffic in transit (e.g., IPsec, TLS).
• Physical security: Secure cable conduits and avoid running cables through unsecured areas.
• Regular inspections: Check for unauthorized devices or taps on cables.

Telecommunications infrastructure should be considered a critical asset and protected accordingly.

Data Centre Security and Redundancy

The data centre is the heart of the IT infrastructure. Its security and reliability are paramount.

Physical Security

• Access control: Multi-factor authentication (card + PIN or biometric) for entry; mantraps to prevent tailgating.
• Continuous surveillance: CCTV with 24/7 monitoring and recording.
• Security guards: On-site presence to verify identity and respond to alarms.
• Locking racks: Rack-level locks to prevent unauthorized physical access to servers.

Environmental Redundancy

• Cooling: N+1 or N+2 redundant HVAC systems; hot aisle/cold aisle layout for efficiency.
• Power: Dual power feeds from different substations; UPS with battery backup; diesel generators with fuel supply contracts.
• Fire suppression: Gas-based systems (e.g., FM-200, Novec 1230) to avoid water damage; early detection (VESDA).
• Water detection: Leak sensors under raised floors and near cooling units.

Operational Security

• Change management: Strict procedures for any physical changes to the data centre.
• Visitor logs: Detailed records of all non-essential visitors, including purpose and escort.
• Regular audits: Internal and external audits to verify compliance with security standards.

Data centres are often classified by tiers (I-IV) based on redundancy and availability (Uptime Institute). Tier IV offers the highest availability with fault-tolerant infrastructure.

Utility Protection and Redundancy

Reliable utilities—power, water, telecommunications—are essential for continuous operations. Infrastructure security must include protection and redundancy for these utilities.

Power

• Multiple feeds: Connect to two different utility substations.
• On-site generation: Diesel or natural gas generators sized for full load; regular testing and fuel supply agreements.
• UPS: Provides clean, uninterrupted power during switching; properly sized to allow generator start.
• Surge protection: Protect against lightning and voltage spikes.

Water

• Backup supply: If cooling towers require water, have a backup source (e.g., municipal and well).
• Leak detection: Sensors in vulnerable areas.
• Dry cooling alternatives: Air-cooled chillers reduce water dependency.

Telecommunications

• Diverse routes: Fiber and copper lines from different providers and different physical paths.
• Wireless backup: Microwave, satellite, or cellular as a last resort.

Utility protection should be documented, tested, and regularly updated to ensure that the organization can withstand utility failures.

Cabling and Distribution Security

Cables are the nervous system of the infrastructure, carrying data and power. They are vulnerable to accidental damage, intentional tampering, and interference.

Physical Protection

• Conduits and cable trays: Enclose cables to protect from physical damage and restrict access.
• Armored cables: Use cables with metal armor in exposed areas.
• Secure routing: Avoid running cables through public areas or near potential hazards.

Labeling and Documentation

• Clear labeling: All cables should be labeled at both ends for easy identification.
• Documentation: Maintain accurate cable maps and schematics.

EMI/EMC Protection

• Separate data cables from power cables to prevent electromagnetic interference.
• Use shielded cables if necessary in high-EMI environments.

Monitoring and Detection

• Infrastructure monitoring: Some systems can detect cable cuts or taps.
• Regular inspections: Physical checks for signs of tampering.

Industrial Control Systems (ICS) Security

In critical infrastructure sectors (energy, manufacturing, water, transportation), Industrial Control Systems (ICS) and Operational Technology (OT) control physical processes. These systems have unique security requirements due to their real-time nature, legacy protocols, and lifecycles.

ICS/OT Security Challenges

• Legacy systems: Often outdated, unpatched, and with limited security capabilities.
• Proprietary protocols: May lack encryption and authentication.
• Real-time requirements: Security solutions must not interfere with process timing.
• Long lifecycles: Equipment may remain in service for decades.
• Convergence of IT and OT: Connecting ICS to enterprise networks and the internet introduces new risks.

Protection Measures

• Network segmentation: Separate OT networks from IT networks using firewalls and demilitarized zones (DMZs).
• Access control: Strictly limit access to ICS; use multi-factor authentication.
• Monitoring: Use industrial intrusion detection (e.g., passive sensors to monitor network traffic).
• Patch management: Apply patches only after rigorous testing, often during scheduled downtime.
• Physical security: Protect control rooms and PLCs from physical tampering.
• Incident response: Develop specific playbooks for ICS incidents, involving both IT and OT teams.

Standards such as NIST SP 800-82 (Guide to Industrial Control Systems Security) and IEC 62443 provide comprehensive guidance for ICS/OT security.

Integration with Physical and Logical Security

Infrastructure security does not exist in a vacuum. It must be integrated with physical security (access controls, CCTV) and logical security (firewalls, encryption) to provide a unified defense.

• Unified access control: Use the same credentials for physical and logical access where possible (e.g., smart card for building and computer login).
• Shared monitoring: Security operations centre (SOC) should monitor both physical and cyber events.
• Joint incident response: A physical breach (e.g., stolen server) may have cyber implications, requiring coordinated response.
• Policy alignment: Ensure policies for infrastructure security are consistent with overall security policies.
• Risk management: Infrastructure risks should be included in the enterprise risk register.

Integration ensures that security is holistic and that gaps between physical and logical domains are not exploited.

Infrastructure Risk Assessment

Assessing infrastructure risks follows a similar process to other risk assessments, but with a focus on physical assets and dependencies.

Threat Identification

• Natural disasters (earthquakes, floods, fires)
• Accidental damage (construction, vehicle impact)
• Intentional attacks (sabotage, terrorism, vandalism)
• Utility failures (power outage, water supply disruption)
• Insider threats (disgruntled employees, contractors)

Vulnerability Assessment

• Physical barriers: Are they adequate? Are there weak points?
• Redundancy: Are there single points of failure (SPOF) in power, cooling, telecom?
• Access control: Is it effective? Are logs reviewed?
• Monitoring: Is there adequate CCTV, intrusion detection, and environmental monitoring?
• Maintenance: Are backup generators tested regularly? Are UPS batteries replaced?

Impact Analysis

Determine the operational, financial, and reputational impact of infrastructure failure. For example, a data centre outage could cause revenue loss, regulatory fines, and loss of customer trust.

Risk Treatment

Select controls to mitigate identified risks, prioritizing based on risk level. Common mitigation measures include redundancy, improved physical security, and enhanced monitoring.

Infrastructure risk assessments should be conducted regularly and after any significant change to the environment.

Case Studies

Quiz

Exercises

Homework

Summary

In this tutorial, we explored the critical domain of infrastructure security and facility protection. Infrastructure—the physical and logical foundation of an organization—must be secured to ensure the availability and integrity of business operations. We began with secure facility design, emphasizing site selection, construction, and zoning to create a resilient environment.

We examined perimeter protection as the first line of defense, using barriers, detection systems, and access control. We then delved into telecommunications and network infrastructure, including the need for diverse entry points, redundant carriers, and secure telecom rooms. Data centre security was explored in detail, covering physical access, environmental controls (power, cooling, fire suppression), and operational practices to ensure high availability.

The protection of utilities (power, water, telecom) was highlighted as essential for continuity, with a focus on redundancy and testing. We also addressed cabling security, including physical protection, labeling, and EMI prevention. A significant portion was dedicated to ICS/OT security, emphasizing the unique challenges and controls for operational technology, such as network segmentation and specialized monitoring.

Integration with physical and logical security is crucial; we discussed unified access control, shared monitoring, and coordinated incident response. Finally, we covered infrastructure risk assessment as a systematic approach to identify threats, vulnerabilities, and prioritize improvements.

Through case studies, we saw real-world examples of infrastructure failures and the lessons learned. Infrastructure security is not a one-time investment but a continuous process of assessment, maintenance, and improvement. By mastering these concepts, you will be able to design and manage a robust infrastructure security program that supports the organization's resilience and long-term success.

COMP400 — Computer and Network Security (Revision 3) • Unit 6.11 • © TrustOpen University