What Is Physical IT Security?

Physical security is an elementary component of IT security. It includes measures to prevent hazards caused by physical impacts on IT systems. Physical security can, for example, protect against water damage, fire, or burglary.

What is physical (IT) security?

What is physical IT security?

IT security is composed of the building blocks of technical security, logical security, and physical security. The building blocks are designed to ensure the availability of IT systems and enable compliance with the general protection goals of information security.

These include, among other things, the confidentiality, integrity, and authenticity of data as well as the binding nature and accountability of electronically executed actions.

The task of physical IT security is to avert dangers caused by physical impact on IT systems or to prevent them from occurring in the first place. The measures for this can be very diverse and range from a locked computer housing to elaborately protected access to a data center.

What threats does physical IT security protect against?

There are many different dangers that threaten the physical security of computer systems. These threats include, for example:

• Theft
• Burglary
• Vandalism
• EMI radiation
• Fire
• Water damage
• Smoke and gas
• Dust and dirt
• Extreme temperatures
• Elementary damage caused by earthquakes, floods, avalanches …

Physical IT security measures

If it is only a matter of physically securing individual systems such as desktop computers or laptops, measures such as locking computer housings or interface connections can be helpful. PCs, laptops, or peripherals can be protected against theft by firmly tying the housing to objects or furniture using a steel cable and lock (Kensington lock).

Numerous different measures are used for the physical security of complete IT infrastructures such as servers and network components in a data center. Access control systems are installed to prevent unauthorized physical access to the systems. Only authorized persons are granted access to the data center. Electronic access codes, magnetic cards, or biometric data can be used for access control.

In addition, security doors and windows protect against hazards such as fire, smoke, or burglary. Data centers in flood-prone regions are often located on higher floors of buildings. Other physical protection measures include fire, gas, and smoke detectors or CO2 extinguishing systems.

Water damage can quickly lead to complete IT failures. Water ingress due to defective water pipes is a threat to sensitive IT systems. This must be taken into account as early as the planning stage for the data center premises. If water-bearing pipes cannot be prevented, special protection must be provided. Drip pans and hazard detection systems with moisture sensors are suitable measures.

If liquid-cooled processor systems are used, the leakage of liquid from the cooling circuit must be prevented by technical measures. Physical damage to computer systems caused by excessive temperatures is prevented by air-conditioning of the rooms.

Standards for physical safety

Various standards exist for prevention in the area of physical hazards, such as DIN and EN standards. Exemplary standards are:

• The IT fire standard: EN-1047-2
• The IP standard for protection against water or dust penetrating the enclosure: EN-60529
• The burglary standard: EN-1627 and EN-1630