1

I'm curious whether there are standards or recommended best practices to protect network equipment that has to be left unattended and outside (of a secure data-center environment) for example for scientific research?

The assumption here is that even a primitive station would have network equipment (at least a switch/router) that connects to the device taking measurement but also communicates the data back via mobile networks / VPN.

As the equipment obviously has value it is of course at risk of being stolen or even being vandalized. If there is a sophisticated attacker the person might also try to intrude the researchers networks.

Is there best practices or frameworks to follow for this scenario to assess the risk and potential counter measures?

  • By not securing physical devices, you basically accept a potential risk (to state the obvious: otherwise you would have secured it in the first place). Availability is an issue for sure as someone could (accidentally or not) turn the power off or destroy the device. From an attack perspective one could reset these devices to the factory default settings and access it with default credentials. Port security as mentioned as one of the answers is not going to help you a whole lot. Counter measures are: securely store this equipment in a locked environment with limited access. – Jeroen Aug 29 at 10:20
2

I haven't found an International (or National) Standard that goes into detail on protecting remote physical assets; the closest I have found is in ISO 27001 - Annex A.11: Physical & Environmental Security. According to Wikipedia, ISO 27001 itself is a much wider-ranging standard on the whole subject of "information security":

ISO/IEC 27001 specifies a management system that is intended to bring information security under management control and gives specific requirements. Organizations that meet the requirements may be certified by an accredited certification body following successful completion of an audit.

However, from the first link, Annex A.11 of the standard is more specific, and comes in two parts:

Annex A.11.1 is about ensuring secure physical and environmental areas. The objective in this Annex A control is to prevent unauthorised physical access, damage and interference to the organisation’s information and information processing facilities.

Annex A.11.2 is about Equipment. The objective in this Annex A control is to prevent loss, damage, theft or compromise of assets and interruption to the organisation’s operations.

A lot of the annex is to do with "on site" assets, but Annex A.11.2 does include:

A.11.2.6 Security of Equipment & Assets Off-Premises

Security controls need to be applied to off-site assets, taking into account the different risks involved with working outside the organisation’s premises. This is a common area of vulnerability and it is therefore important that the appropriate level of controls is implemented and tie into other mobile controls and policies for homeworkers etc. Considerations should be made and risk assessments carried out for assets that are taken off site, either routinely or by exception. Controls will likely include a mixture of; Technical controls such as access control policies, password management, encryption; Physical controls such as Kensington Locks might also be considered too; alongside policy and process controls such as instruction to never leave assets unattended in public view (e.g. locking in the boot of the car). It is particularly important to review security incident trends relating to off-site assets. The auditor will expect to see evidence of this risk assessment taking place and the proportionate controls selected according to the evaluated risk levels. They will also expect to see evidence of policy compliance.

Some other resources that may help:

  • Physical security on Wikipedia includes in it's overview three "layers":

    • deter potential intruders (e.g. warning signs and perimeter markings);
    • detect intrusions and monitor/record intruders (e.g. intruder alarms and CCTV systems); and
    • trigger appropriate incident responses (e.g. by security guards and police).
  • The UK's Centre for the Protection of National Infrastructure has pages on Physical Security and Protecting my Asset that both cover the multi-layered approach, including from the second link:

    • Deter: stop or displace the attack
    • Detect: verify an attack, initiate the response
    • Delay: prevent the attack from reaching the asset (including measures to minimise the consequences of an attack)
    • Mitigate: minimise the consequences of an attack against your site
    • Response: actions to prevent the goal of the attack being completed
  • The US Government's Physical Security Systems Assessment Guide (PDF), while appearing to be mainly aimed at larger (and often manned) facilities, covers similar ground and many aspects will apply to the protection of remote equipment.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.