Aug 23, 2022
ISO 27002 was recently updated this year – along with a reduction of overall controls, 11 completely news ones were added to keep up with new and emerging technology.
One of the new controls added under the Physical category, is something called physical security monitoring. But what does this mean exactly?
Steve Mason joins us again today to delve deeper into physical security monitoring to explain what it is and give examples of different types of security and monitoring you can put in place.
You’ll learn
- What physical security monitoring is
- The purpose of physical security monitoring
- What should be monitored?
- Different types of security and monitoring you can consider
Resources
In this episode, we talk about:
[00:36] A quick recap of our ISO 27002 series and it’s purpose to date – Start from Episode 109
[01:58] ISO 27002 controls reduced from 114 controls to 93 – reduction due to some of them being combined or made redundant in the latest version
[04:02] The purpose of Physical Security Monitoring
[06:22] Example of where security monitoring solved an issue at a bank
[07:29] Another example of a London business who lacked physical security monitoring
[08:45] The importance of reviewing your need for physical security monitoring – what level do you need? Will it include CCTV, Access cards ect
[10:10] An overview of the various access points to consider, including: Main building, secure offices, server rooms, visitor access rights, CCTV, security alarms and personnel
[10:53] Example of where failure to verify a visitor highlighted a companies lack of security.
[11:30] The importance of communication and inductions for key reception and security staff, to ensure they can do the proper checks on visitors / know who should and should not be allowed into certain areas of your workplace.
[13:50] Suggestion of a checklist for checks on visitors for temp reception staff
[14:32] How do you define what needs 24 hour monitoring and what can be monitored for selected hours?
[15:46] The installation of security measures should be appropriate for your needs – don’t go overboard if it’s not needed. i.e. a Data Centre would need a high level of security but a small office may only need access control
[17:48] Take note of any security requirements in customer contracts
[18:10] How do you ensure the integrity of your security measures? i.e. CCTV – guidelines are available for installation, including placement, connection to your systems, keeping the timestamps accurate, logging any camera failures.
[20:00] Example of where a German company mapped out their CCTV so they could highlight blind spots, which were then pointed out to guards who did more checks in those areas
[21:15] Make sure you maintain any security equipment
[22:10] What crossover is there with other ISO 27002 controls? i.e. data masking being used in visitor books
[24:45] How can you apply this control to home workers? This can include training on being aware of potential security risks at home and locking the computer when not nearby ect
We’d love to hear your views and comments about the ISO Show, here’s how:
- Share the ISO Show on Twitter or Linkedin
- Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one.
Subscribe to keep up-to-date with our latest episodes:
Stitcher | Spotify | YouTube |iTunes | Soundcloud | Mailing List