Why would security cover things like natural disasters?

Question

I'm taking a course which is designed with the CISSP certification in mind. Though the class is categorized as software engineering, we talked a lot about physical security and, in particular, floods, fires, earthquakes and cars running into things. How is this security? For example we were told that data centres are safest in the middle of a building because if the roof was leaking the top wouldn't be safe, and water tends to go down so the lower floors would be the first to flood.

Is this really a security issue? For example, if the roof leaks the engineer would be at fault, not the security analyst. You wouldn't hire a security analyst to make sure the roof is solid.

UPDATE: Also, things like having bollards around a building to protect pedestrians from cars, how's this security? No one's really explained this yet. I was told the companies most valuable assets are their employees, but with this line of reasoning, what isn't security?

If the availability is so encompassing, what isn't part of security?

Answer 1

All other answers are fine. I'm going to offer you a classic security perspective.

• Starting a fire/flood is a textbook scenario for physical penetration/exfiltration. People under stress are less likely to challenge strangers.

• A fire can be used to destroy forensic evidence, in particular when there's insider involvement.

• An earthquake or, indeed, any natural disaster (like bush fires) is a potential complication for security because law and order break down and looting rears its ugly head.

• Perimeter security against SVBIEDs is a necessary consideration in certain countries and threat environments. If a suicide car bomber can drive close to the walls of your data center, it is your failure as a security consultant. Hence bollards, flowerbeds, and concrete barriers.

• Security is a holistic discipline. Every specialist cares about bits and pieces of the enterprise, and by necessity of life loses sight of the whole. There should be at least one person out there who thinks in terms of adversary's behavior and not his/her own pigeonhole. Which, incidentally, is a security consultant's job description.

Answer 2

CISSP is an information security certification not a computer security certification.

Information security is about the protecting the confidentiality, integrity, availabity of information in general. Information is not only stored on computers. They are printed out and stored in filing cabinets, they are memorized and stored in your employee's brains. Therefore, apart from ensuring that your computer networks are secure, you need to ensure physical security of your premises. If those confidential documents are stolen or destroyed in a disaster, it is also a loss of availability. If your employees sell the information to a competitor, then it is considered a loss of confidentiality. That is why policies and physical security measures are important.

Answer 3

It comes down to the classic security triad; Integrity, Confidentiality and Availability. The last of which could certainly suffer from any type of natural disaster, which is why you must include it in your continuity plan.

Answer 4

Even if you take a narrow view of computer security as being limited to dealing with intentional malicious attacks, any way in which your system is vulnerable to a natural disaster also represents a way in which a well-equipped (or clever) attacker could disrupt your service. For example, if a data center is vulnerable to flooding, someone who wants to take it offline could cut a sprinkler pipe in the building. So it makes sense to protect against natural disaster scenarios as part of an overall security plan.

Answer 5

Disasters are as much a security issue as mitigating denial of service attacks. In the ISC2 (CISSP) docs, security is often represented by the CIA triad: Confidentiality, Integrity and Availability. Disaster recovery strategies and DDOS mitigation both pertain to establishing and maintaining availability.

Answer 6

I'll toss in my 2c and mention something that others have not specifically mentioned: Business Continuity Plans

BCP is an important function of a security analyst's job, and as such, the CISSP provides a broad overview of the issues that can impact disasters and outages. Knowing these high-level details helps the CISSP build a foundation for knowledge and the mindsets required to do BCP.

Please note that what is covered in the CISSP material is a broad, high-level overview of the topics. There is much, much more a Security pro needs to know and consider to properly create and manage a BCP program.

Answer 7

If we look in a dictionary one of the secondary meanings of "security" is:

the ​fact that something is not ​likely to ​fail or be ​lost

While we often think of Information Security as guards, guns, and hackers in dark glasses, what it is really about is protection of information from threats. These threats could be:

• External attackers - hackers
• Malicious insiders
• Natural disasters
• Technical problems - leaks, power outages
• Honest mistakes - like losing a CD full of data
• A lot more!

The reason CISSP covers all these is that an organisation needs someone to look after these issues. Turns out the sort of things you do to defend against the threats are pretty similar, so it makes sense to have one department take care of them.

Answer 8

I'm going to turn it around:

Disaster planning is not part of security, because security is part of disaster planning.

Disaster Planning, which is made up of Disaster Prevention and Disaster Recovery, covers a range of topics (e.g. redundancy, backups) including security.

Answer 9

Information security is about the protecting the integrity,confidentiality, and availability of information. Without being able to protect the information and make it available to those who require it even during a natural disaster could mean the end of a business.

I helped to develop Business Continuity Plans where one of the critical requirements was that certain information had to be (by law) available 24 hours a day, 7 days a week, 365 days a year. There was no allowed down time, even during a natural disaster such as a horrific earthquake.

There was no simple solution - business impact analysis had to be conducted. Information is not only being stored on computers. It is often scattered about and not just found in one centralized location. Identifying the critical information which is necessary to keep the business functioning is very tricky. Once the identification of critical systems and components is completed and reviewed. There is additional risk assessment which needs to take place.

During large natural disasters, such as earthquakes or large tornados, there is a high probability that the physical premises will be out of commission for some time. There were even examples where there was no building left or the team had limited access (15 to 20 minutes) to gather what was needed before no one would ever be allowed back into the building. Also, you could plan on some delays, because it had to be determined the buildings were sound enough for anyone to access them.

If it is a large disaster, where do you go or how is the continuity of operations accomplished. Local employees are certainly going to be affected by the disaster as well. It could be weeks before they are in any position to come back to work. In the case of one BCP I worked on, the employees were also faced with their homes being totally destroyed or they only had a few minutes to enter their homes and gather up belongings. Many told me they grabbed clothes and toothbrushes, and identification documents and had to leave other personal items behind.

So part of the technical strategy can be developing a multitude of options depending on the Risk Assessment. There can be plans for cold sites, warm sites, and hot sites depending on the budget. Strategies for protecting identified critical servers and hardware with RAID, clustering, and load balancing, focusing on fault tolerance. Of course, there is protection of data through backs up and plans for restoring critical data and having it available to be utilized by the cold sites, warm sites, and hot sites, ensuring confidential documents are protected and available to those who require the information at all times.

Once in place, all of these strategies, plans, and policies need to reviewed, maintained, and verified. It requires a lot of personnel to be involved and to be aware. The one constant thing is change. New hardware and software solutions are being implemented. Business requirements and laws are being modified. I can certainly understand why it is mentioned. Information security is about the protecting the integrity, confidentiality, and availability of information.