CISSP 10.2 - Implement Site & Facility Security Controls (Part 3 of 4)

This episode of the ISC2 Certified Information Systems Security Professional (CISSP) exam prep series continues Domain 3’s tour of site and facility controls, moving from detection into the surrounding environment. It looks at how the unglamorous utilities and handling practices quietly keep equipment running clean, cool, and continuously, and keep investigations defensible.

Frequently Asked Questions

How do you store digital evidence so it holds up?

Keep it isolated, tracked, and provably unchanged. Store the data on a dedicated system separate from production, take it offline when you are not adding to it, and block internet access to and from it. Log every action, limit access to your security administrator and legal counsel, encrypt everything, and calculate a hash for each dataset so you can later prove nothing was altered.

How do you design work areas by sensitivity?

Think in concentric circles of protection, so the more valuable the assets, the harder that area is to reach, with the most sensitive assets at the protected center. Separate work zones with real walls that run floor to ceiling where secrecy matters, enforce a clean-desk policy, classify each area, and escort visitors. The highest tier is a sensitive compartmented information facility, which often bans cameras and phones inside.

Why is clean, steady power such a big deal?

Wall electricity is neither as clean nor as constant as your gear needs, so you defend it in escalating levels. A surge protector guards only against overloads, a power conditioner also filters line noise, and an uninterruptible power supply delivers clean power and carries the load briefly when the grid drops. Generators sit at the top, but keep a battery even with a generator because it bridges the minutes before the generator warms up.

What power problems should you be able to name?

A fault is a momentary complete loss while a blackout is a prolonged one. A sag is a brief voltage drop and a brownout is a prolonged one. A spike is a momentary high-voltage surge while a surge is sustained, and inrush is the initial jolt when equipment first connects. Ground is the safe return path to the earth. If the trouble starts outside your meter it is the utility’s problem; anything inside is yours.

How do you keep temperature and humidity in a safe range?

Aim for steady control rather than just cold air. Equipment rooms generally sit between about 59 and 90 degrees Fahrenheit, but stability matters more than any exact number, because swings cause chip creep and cracked solder joints. Keep humidity roughly between 20 and 80 percent, since too much invites condensation and corrosion while too little lets static build into a damaging electrostatic discharge. Hot and cold aisles organize airflow.

Reference: This article is based on concepts discussed in CISSP 10.2 - Implement Site & Facility Security Controls (Part 3 of 4).