IT security through infrastructure.

IT security through infrastructure.

Obviously, before any good IT security can be achieved, it is crucial to ensure the quality and security of the infrastructure. Infrastructure security operations and management are based on three key components: Access control and surveillance, video surveillance and intrusion detection and reporting.

The key values of a safe structure.

The basic idea is always to establish a structure that is sufficiently reassuring to relieve the stress of an individual, a group or an organization. One way of reassuring individuals is to limit and manage rights. Being able to propose such a condition will relieve existing teams.

However, whatever structure is put in place, its security needs to be scalable, since the emergence of new attacks is a constant. New professions have emerged in response to the speed with which the profession and knowledge have evolved in recent times. For large structures, this means bringing in specialists for certain types of intrusion or attack, and even administrators to validate compliance.

Security has thus gradually become a science, a technique and an art. It aims to create exclusion systems and respect access rights for a restricted number of individuals, systems, content or objects. Security also encompasses physical security, blocking access to high-risk structures for untrained actors.

Basically, working in cybersecurity means having to combat intrusions, anticipate physical damage, maintain a system and the services it provides, and limit access to information.

The term cyber has simply expanded the scope of the profession to include intangible properties such as data or virtual access. Now, every structure is made up of physical and intangible security. Each of them must be able to offer solid, foolproof security.

When we talk about setting up a framework to protect part of an organization’s physical assets, we use the term infrastructure security.

When it comes to infrastructure security, we’re usually quick to think of a system for denying access, such as a locked door, but a structure for protecting infrastructure involves many more elements if it is to be effective. Many procedures are put in place to respond to a wide range of situations.

To be able to deal with the safety of a zone, you need to think of the system in three parts:

The external perimeter: this is the unsecured area around the protected zone. A typical example is a company parking lot. In some cases, they remain accessible without access rights. Although this is less and less the case.

The perimeter boundary: this is the boundary that joins the inside to the outside. It can be a simple boundary wall, or an SAS with a booth.

The interior: the heart of our system, with the highest level of safety.

In a strategy to secure the structure, the action plan is designed to control all 3 layers of the zone. To achieve this, several tools can be used, communicating with each other to offer the highest possible level of security.

Two types of action are possible in these three layers:

Natural access methods: natural access encompasses solutions that guide an individual into or out of the zone.

Reinforce the zone: here, the structures put in place will serve to prevent unauthorized entry and recognize public and private individuals.

Set up an access control system.

In order to set up an effective control system, we need to focus on three specific points: entries, exits and returns. By definition, entries concern an individual’s right to re-enter the zone. Conversely, exits concern the fact of leaving the zone. Finally, and a little more specifically, returns concern the obligatory passage after an individual’s initial entry.

In security, we use the term “rights” to refer to a privilege or permission given to an individual, group or authority. This right may be granted by a higher authority, whether governmental or private. A person with a right or permission is said to be authorized to do something. Conversely, the person is not authorized.

When an individual attempts to enter an area to which he or she does not have rights, we speak of an intruder exercising a trespass.

Once these concepts have been described in detail, the purpose of access control is to allow entry, exit and return according to authorizations.

As we saw in our security zone diagram, access control takes place at the outer perimeter. This may be a gate at the entrance to an industrial center, or a door in a building.

Finally, the role of the external perimeter is to be able to select the people authorized to go further.

Introduction to security policies.

The best way to achieve a structure that perfectly brings together the three zones we’ve seen above is to implement a common security policy. Companies and organizations are required to implement a security policy detailing the various accesses and who has which rights. As a general rule, the more open access an area has, the more compromised the level of security. Being able to implement a structure limiting the scope of actions will help reduce attempts, but also prevent accidents.

A rather amusing example is the case of a company that refuses to install a coffee cup on its desks. In this case, access is denied to people with coffee, limiting their possibilities. But this is primarily to prevent problems such as the loss of electrical equipment due to coffee falling on it.

Badges or electronic access cards are commonly used to measure access. RFID radio protocol is also frequently used to identify company employees.

Photo Maxime Macé

Maxime Macé

Simple passionné de thématiques diverses et variées. J’apprécie enrichir mes connaissances dans les disciplines techniques comme l’informatique, les sciences et l’ingénierie, mais aussi dans les domaines merveilleux de la philosophie, l’art et la littérature.

Prenons contact

Vous souhaitez me contacter suite à la lecture de cet article ? Merci de renseigner votre adresse électronique et je vous recontacterai dans les plus brefs délais.

CV Ingénieur développeur informatique

CV Étudiant PhD Artificial Intelligence

Portfolio Artist designer