So this is about helping to manage physical access, usually controlling passage through a gap. This could be a safe, this could be a door in a wall. This could be a gate in a fence. All examples of controlling access through a secure perimeter. There are interdependence between control types. Let's just think about an example, if you are setting up a data center in the center of a city that has a very high crime level. If you have good logical controls, but no physical controls, you're going to have a problem. Just think this through, if the system administrator leaves the door to the data center open, there is nobody at the reception controlling access to the building. Somebody could walk in from the street, walk through the reception area, walk straight into your data center and install some malicious hardware, some malicious software. Maybe something that logs keystrokes. Maybe they could cut cables, maybe they could steal equipment. If they're installing a key logger that could affect confidentiality, if they're stealing equipment, that's going to affect availability or if they're cutting cables, still affect availability. So generally we need a good balance between the controls, some administrative, some physical, some logical. But where we have more challenging environments, so for example, an area with a high crime rate. It may be, we support our logical controls with increased physical controls. Maybe we have a building without windows. Maybe we have additional security employees to protect the area and so on. We also recognize that not all internal areas are of equal sensitivity. Data centers, research areas, areas with network and computer equipment, typically, they have a higher value and therefore we protect assets according to value. So we would invest more in controls for these areas. It's also very common to see organizations breaking up those security zones, instead of, as we looked at with when we talked about defense in depth, instead of just relying on one secure perimeter. Now, a very similar concept, we're zoning our security internally. For our environmental design, we have the idea of crime prevention through design. We can actually manage our risk level through design. If we're building a new site, if we're lucky enough to be able to design the site from scratch, what we can do is try to build security in, and a lot of modern buildings, modern campuses start to look very similar. And it's because of this idea of CPTED, crime prevention through environmental design. Just think about some of the campuses you might have seen, they have a fence around the perimeter, that's a barrier. But then there is an open green space, lots of grass, and this is to make sure that you've got the ability to see people approaching. If somebody climbed the fence, you can see who it is because there's a big gap, nobody should be there really in the open green space. Then, you start to see the use of small hills or small kind of rolling hills, undulating up and down. And this is to help prevent vehicles, not big enough for people to hide behind, but just enough to prevent people gaining speed if they're in a vehicle, to prevent people gaining enough speed to ram into your building. You also see other forms of physical barrier. For example, many of these modern campuses have waterways, small water features, and again, these help prevent vehicles approaching areas that they shouldn't. So if somebody wants to steal all your equipment by having a small stream or a kind of lake or something similar, it can help provide a physical barrier from the building. Towards the building, even closer to the building, we might see things like concrete balls, monuments, bollards, statues and again, they provide some form of physical barrier. Some of these look very artistic, but they're designed that their purpose may indeed be security. You see this with a large concrete spheres placed wide enough apart, that human beings can walk between them, but that cars can't. Seating as well, concrete seating prevents vehicles gaining access to the building. And very close to the building perimeter, we see the use of close circuit television, cameras and also the use of what we call defensive planting. Defensive planting, you actually have very low level shrubs and these are densely planted, so there's no space for a human being to stand next to the building and maybe eavesdrop or peer through the window. But also these are typically, these plants have thorns. So if you do try and break in, it's not going to be impossible, but it's another control type. These thorns may collect forensic evidence from your clothing or maybe even blood. They scratch the skin. The building itself may not have windows that open. Lots of these newer campuses also have reflective windows to prevent the building overheating, but also to help prevent people visually gaining access to the building, actually being able to see what's happening internally. We talked about biometrics and some of the considerations we have with biometrics include throughput. How fast are they? Are they fast enough for our needs? Have seen some biometric solutions that are not fit for purpose. Things like eye scanners to process payments may not be an appropriate approach. What speed do we need? We also want to think a little bit about accuracy. This is already, we've discussed this in chapter one already, so I'm not going to dwell on it too long. Accuracy, we have the false acceptance rate and the false rejection rate, those two types of error. And we want, again, we want a balance that meets our needs. How invasive the approach is? Typically retinal scanners or iris scanners are considered more invasive than something like a palm scan, but again, making sure something is fit for purpose is what we're talking about. Usually, biometrics for them to be effective, they have to be universal, degree of universality, if we use fingerprint scanners as the image shows, does everybody have fingerprints? What if somebody doesn't? I had a case, maybe a year ago where there was somebody reported who went to the gym each morning, and each morning because of the lifting weights, their fingerprint changed just slightly through abrasion. It changed their fingerprint record, so they had continual problems logging into a site. How do you manage that? Is a fingerprint appropriate? Maybe, maybe not commonly though. We have alternative approaches. If you think about your smartphone, it will allow biometrics usually. But when you power the device down, power it back on, it requires some kind of additional assurance. So just bear in mind that not all biometric approaches are universal.