Guidelines for AUTOMATIC DATA PROCESSING PHYSICAL SECURITY and RISK Managervien-R
Total Page:16
File Type:pdf, Size:1020Kb
FIPS PUB 31 FEDERAL INFORMATION PROCESSiNG STANDARDS PUBLICATION 1974 JUNE ,.,,---~--~~-. --------'-~---,~. --"-,,:;"::,-''::"--' -,., ---" , -~~~~-----"" .-~~-''_., -" --- .. ~ .\I I I I ' t 1 I" <:; ! \ I II I '0 e;1t 1\ ~J Guidelines FOR AUTOMATIC DATA PROCESSING PHYSICAL SECURITY AND RISK MANAGErViEN-r r--~~I 1 I I I CATEGORY: ADP OPERATIONS i _:1 SUBCATEGORY: COMPUTER SECURITY I 1 ! I i '~-"-,,--., .... ~ .,~--.. _.. ,. -""---.~ ----.--_."" __ ._. __ ,,." .. __ ... ~.~_. ---~-~--.---'-~-- ------.--.. ~--..---_---.-.-.-- ,-.--,---,,-.--.... - .. ~--.-.-._."--"'-.-._.-- --" -_.-... --_. i ~ '0 ) ".' , , . , L _. __ . __. __ ._ "'__________ ....•... _ .". _, _______., ____ , ____ .. ______ ",,~ __.,, __ ,.,. ' ___,. ___.. _, __" ____ .___ ~ _______,,. _____ " ... " ___ ,,,,,.,_,,_,,.,, ___.,." ______ ,. ___ .____________ ,,.,., .• " ,~ " • 1 FOl'ewm.'d The Federal Information Processing Standards Publication Series of the National Bureau of Standards is the official pUblication relating to standards adopted and promul gated under the provisions of Public Law 89-306 (Brooks Bill) and under Part 6 of Title 15, Code of Federal Regulations. These legislative and executive mandates have given the Secretary of Commerce important responsibilities for improvin'g the utilization and man agement of computers and automatic data processing systems in the Federal Government. To carry out the Secretary's responsibilities, the NBS, through its Institute for Computer Sciences and Technology, provides leadership, technical guidance, and coordination of government efforts in the development of guidelines and standards in these areas. The subject areas of personal privacy, data confidentiality and computer security are of the greatest national interest. The Secretary of Commerce has identified the efforts required to provide solutions to technical problems encountered in these areas as personal objectives in the Department's overall program. Data confidentiality and computer security are dependent upon the application of a balanced set of managerial and technological safeguards. Within the context of a total security program, the NBS is pleased to make these Guidelines for ADP fhysical Security and Risk Management available for use by Federal agencies. RUTH M. DAVIS, Director Institute for Computer Sciences and Technology Abstract This publication provides guidelines to be used by Federal organizations in struc turing physical security programs for their ADP facilities. It treats security analysis, natural disasters, supporting utilities, system reliability, procedural measures and controls, off-site facilities, contingency plans, secUl'ity awareness and security audit. It contains statistics and information relevant to physical security of computer data and facilities and references many applicable publications for a more exhaustive treat ment of specific subjects. ,Keywords: ADP security; computer reliability; contingency plans; Federal Information Processing Standard; fire safety. natural disasters; physical security; risk analysis; security audit; security awareness; supporting utilities. Nat. Bur. Stand (U.S.), Fed. Info. Process. Stand. Publ. (FIPS PUB) 31, 92 pages, (1974) CODEN: FIPPAT For Hn\p by thp Sup~rlntcnd~nt of HOCUll1pntH. P,S, GO\'prnll1ent Printing Otllpp Washington Il.C. :!o,i02, ({Jrd,'r hy SlJ Cntalog C 13.;;:; ::11) GPO, price $1.35, SuuHrrlptlon Her~lr" al~o llY~llnblc for all nl'''' 1"I1'S publications unu Hl1PlllNll('ntx for an lrlll"finilp "l'rlot!, FIPS PUB 31 . Federal Information Processing Standards Publication 31 1974 June ANNOUNCING THE GUIDELINES FOR AUTOMATIC DATA PROCESSING PHYSICAL SECURITY AND RISK MANAGEMENT F'edoral Information Processing Standards Publications are issued by the National Bureau of Standards pursuant to the Federal Property and Administrative Services Act of 1949 2.5 amended, Public Law 89-306 (79 Stat. 1127), and ag implemented by Executive Order 11717 (38 FR 12315, dated May 11, 1973), and Part 6 of Title 15 CFR (Code of Federal Regulations). Name of Standard. Guidelines for Automatic Data Processing Physical Security and Risk Man agement. Category of Standard. ADP Operations, Computer Security. Explanation: These guidelines provide a handbook for use by Federal organizations in structuring physical security and risk management programs for their ADP facilities. This publication dis cusses security analysis, natural disasters, supporting utilities, system reliability, procedural meas ures and controls, off-site facilities, contingency plans, security awareness, and security audit. It contains statistics and information relevant to physical security of computer data and facilities and references many applicable publications for a more exhaustive treatment of specific subjects. Approving Authority. Department of Commerce, National Bureau of Standards (Institute for Computer Sciences and Technology). Maintenance Agency. Department of Commerce, National Bureau of Standards (Institute for Com puter Sciences and Technology). Cross Index. None. Applicability. These Guidelines are intended as basic reference document and a checklist for gen eral use throughout the Federal Government to evaluate computer security and plan physical se curity programs in ADP systems. Implementation. As new ADP systems are developed and current systems improved, these Guide lines should be utilized. Each organization should analyze its requirements for protection of data and processing facilities and implement the recommendations found in these Guidelines commen surate to its calculated risk. Depending upon differing operational requirements, facilities will re quire various levels of security protection. These Guidelines should assist the installation of man agers in making, and justifying essential security decisions. Specifications. Federal Information Processing Standard 31 (FIPS 31), Guidelines for Automatic Data Processing Physical Security and Risk Management, (affixed). Qualifications. The statistics and recommendations provided in these Guidelines are based upon data and information supplied from many sources within the government and private sectors and reflect current practice and technologies. As new knowledge, techniques, and equipments become available in the future, these Guidelines will need to be modified accordingly. As experiences are gained through Use and application of these Guidelines, a basis for security standards may be es tablished. In this regard, comments and critiques concerning applications experience will be wel- comed. These should be addressed to the Associate Director for ADP Standards, In~t.itute_fQr."C.om'.':, ...". ,...... -." . puter Sciences and Technology, National Bureau of Standards, Washington, D.C. 20234. 1 'NCJRS JUN 2 1980 FIP8 PUB 31 Where to Obtain Copies of the Standard. a. Copies of this publication are available from the Superintendent of Documents, U.S. Govern ment Printing Office, Washington, D.C. 20402 (SD Catalog Number C13.52:31). There is a 25 per cent discount on quantities of 100 or more. When orderin~5' specify document number, title, and SD Catalog Number. Payment may be made by check, money order, coupons, or deposit account. b. Microfiche of this publication is available from the National Technical Information Service, U.S. Department of Commerce, Springfield, Virginia 22151. When ordering refer to Report Num ber NBS-FIPS-PUB-31 and title. Payment may be made by check, money order, coupons, or deposit account. 2 FIPS PUB 31 Federal InfOl'mation Processing Standards Publication 31 1974 June Specifications for GUIDELINES FOR AUTOMATIC DATA PROCESSING PHYSICAL SECURITY AND RISK MANAGEMENT Contents Pnge Pnge Action Summary .......... 5 5.1.1 Instructions for the Facility Physical Security Survey ......................................... 46 1. ADP Security Analysis ................................... 8 5.2 Boundary Protection .................................. .. 47 5.2.1 Emanations ............................................... .. 48 • 1.0 Introduction .... ...... ....... ........................ .. 8 5.3 Entrance Door Controls ............................ .. 48 1.1 Scope ............................................................... .. 8 5.4 Perimeter Intrusion Controls .................... .. 49 1.2 Threat to ADP Operations ...... ............. .. 9 5.5 Critical Area Controls ................................ .. 50 1.3 Risk Analysis ........................................... .. 9 5.6 Guard Force Operations '" ......................... 53 1.3.1 Loss Potential Estimate ......................... .. 9 5.7 Integrating Physical Security Measures .. 54 1.3.2 Threat Analysis ..................................... .. 11 1.3.3 Annual Loss Expectancy ....................... .. 11 6. Internal Controls ............................................... .. 54 1.3.4 Selecting Remedial Measures ............... .. 13 1.4 Implementing the Security Program ..... .. 14 6.0 Introduction ................................................... .. 54 1.5 Supporting Documents ............. .. 15 6.1 Personnel Controls ...................................... .. 55 6.1.1 Personnel Selection ................................... 55 2. Anticipating Natural Disasters 15 6.1.2 Training ..................................................... 55 6.1.3 Supervision ................................................. .. 55 2.0 Introduction ................................................ .. 15 6.2 Organizing for Internal Control ............... 56 2.1 Fire Safety .................................................