physical-security

# 🏠 Physical Security Skill ## 🎯 Purpose This skill enforces physical security controls for home office environments, equipment protection, and environmental security. Based on Hack23 AB's [Physical Security Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Physical_Security_Policy.md), it demonstrates how enterprise-grade physical security is achievable for remote-first operations. **Key Principle:** *Physical security isn't just locks and guards—it's layered protection for remote work environments where traditional perimeter security doesn't exist.* ## 📚 Scope This skill covers: - **🏠 Home Office Security:** Workspace protection, access control, secure storage - **💻 Equipment Protection:** Laptops, monitors, mobile devices, storage media - **👥 Visitor Management:** Guest access controls for home office environment - **🌡️ Environmental Security:** Fire, water, temperature, humidity protection - **🧹 Clean Desk/Screen Policy:** Information exposure prevention - **🔒 Physical Access Controls:** Device locks, secure storage, theft prevention ## ⚙️ Security Rules ### MUST Requirements Physical security controls you **MUST** implement: 1. **🏠 Workspace Security** ```yaml home_office_requirements: dedicated_workspace: required lockable_door: recommended window_security: blinds_or_curtains_required visitor_visibility: minimize_screen_visibility secure_storage: lockable_cabinet_or_drawer backup_media: fireproof_safe_or_offsite_storage ``` 2. **💻 Equipment Protection** ```yaml device_security: laptops: - physical_lock_cable: when_in_public_spaces - full_disk_encryption: mandatory - screen_privacy_filter: recommended_for_sensitive_work - automatic_screen_lock: 5_minutes_idle_maximum - boot_password: BIOS/UEFI_password_required mobile_devices: - screen_lock: biometric_or_strong_PIN - device_encryption: mandatory - remote_wipe_capability: enrolled_in_MDM - physical_protection: use_protective_case storage_media: - encryption: all_removable_media_encrypted - labeling: classification_labels_applied - secure_storage: locked_cabinet_when_not_in_use - disposal: secure_wipe_or_physical_destruction ``` 3. **🌡️ Environmental Controls** ```yaml environmental_protection: fire_safety: - smoke_detectors: installed_and_tested_monthly - fire_extinguisher: accessible_and_inspected - evacuation_plan: documented_and_practiced - electrical_safety: no_overloaded_circuits water_damage: - equipment_placement: elevated_off_floor - leak_detection: water_sensors_near_equipment - backup_protection: waterproof_bags_for_critical_items climate_control: - temperature_range: 15-25°C_optimal - humidity_control: 30-60%_relative_humidity - ventilation: adequate_airflow_for_equipment ``` 4. **🧹 Clean Desk/Screen Policy** ```yaml information_protection: end_of_day: - lock_sensitive_documents: secure_cabinet_or_safe - secure_removable_media: encrypted_and_locked_away - log_out_of_systems: all_sessions_terminated - screen_lock: automatic_lock_enabled - shred_confidential_waste: cross_cut_shredder during_work: - minimize_paper: digital_first_approach - classify_documents: apply_classification_labels - visitor_awareness: hide_sensitive_information - screen_positioning: away_from_windows_and_visitors ``` 5. **👥 Visitor Management** ```yaml home_office_visitors: before_visit: - schedule_visitors: avoid_overlap_with_sensitive_work - prepare_workspace: secure_all_confidential_materials - screen_positioning: ensure_no_visibility_of_work during_visit: - lock_screens: all_devices_locked - escort_required: visitor_never_left_alone_in_workspace - conversation_awareness: avoid_discussing_confidential_matters after_visit: - verify_security: check_all_devices_and_documents_secure - access_review: review_system_access_logs_if_visitor_near_devices ``` ### MUST NOT Prohibitions Physical security practices you **MUST NOT** do: 1. **❌ Equipment Exposure** ```yaml prohibited_practices: - leave_devices_unlocked: in_public_or_shared_spaces - work_in_public: with_sensitive_data_visible_to_others - store_devices_visibly: in_vehicles_or_unsecured_locations - share_workspace: with_unauthorized_individuals_during_sensitive_work - leave_doors_unlocked: when_workspace_contains_business_equipment ``` 2. **❌ Information Exposure** ```yaml prohibited_behaviors: - print_unnecessary_documents: use_digital_workflows_instead - leave_documents_unattended: always_secure_or_destroy - discuss_confidential_matters: in_public_or_with_visitors_present - dispose_unsecurely: regular_trash_for_sensitive_documents - store_passwords_physically: written_passwords_in_visible_locations ``` 3. **❌ Unsafe Practices** ```yaml dangerous_behaviors: - overload_circuits: multiple_high_power_devices_on_one_outlet - block_exits: equipment_blocking_emergency_egress - ignore_alarms: smoke_detector_or_security_system_alerts - disable_protection: removing_security_cables_or_locks - unsecured_backup_media: leaving_backup_drives_visible_or_unlocked ``` ## 💡 Examples ### Example 1: Home Office Setup (Compliant) **Scenario:** Setting up a secure home office workspace for cybersecurity consulting work. ```yaml # Home Office Security Configuration workspace_security: location: room: dedicated_home_office door: lockable_from_inside windows: - privacy_film_applied: true - blinds_installed: true - desk_positioned: perpendicular_to_window equipment: primary_workstation: device: Ubuntu_22.04_LTS_laptop security: - full_disk_encryption: LUKS_enabled - BIOS_password: configured - physical_lock_cable: attached_to_desk - screen_privacy_filter: installed monitors: count: 2 positioning: facing_away_from_door_and_windows privacy: screen_not_visible_from_hallway mobile_devices: - iPhone_with_MDM: biometric_lock_enabled - iPad: encrypted_and_screen_locked storage: secure_cabinet: type: lockable_metal_filing_cabinet contents: - backup_drives: encrypted_USB_drives - client_contracts: physical_copies_locked - hardware_tokens: YubiKeys_secured fireproof_safe: contents: - critical_backups: offline_encrypted_backups - emergency_contacts: printed_emergency_procedures environmental: fire_protection: - smoke_detectors: 2_units_tested_monthly - fire_extinguisher: ABC_rated_inspected_annually climate_control: - temperature: thermostat_set_20°C - humidity: dehumidifier_maintains_45%_RH power_protection: - UPS: 1500VA_battery_backup_for_workstation - surge_protection: all_devices_on_surge_protectors clean_desk_policy: daily_routine: - end_of_day: all_documents_locked_in_cabinet - screen_lock: automatic_after_5_minutes - shredding: cross_cut_shredder_for_sensitive_waste ``` **Result:** ✅ Compliant - Comprehensive physical security controls for home office **ISO 27001:2022 Mapping:** - A.7.4: Physical security monitoring - A.7.9: Security of assets off-premises - A.7.13: Clear desk and clear screen ### Example 2: Visitor Access Control (Compliant) **Scenario:** Client visiting home office for project kick-off meeting. ```yaml # Visitor Management Procedure visitor_access_control: pre_visit_preparation: schedule: date: 2026-02-15 time: 10:00-12:00 visitor: client_representative security_actions: - review_calendar: no_overlapping_sensitive_work - secure_materials: - lock_client_contracts: all_other_clients_secured - close_applications: client_systems_logged_out - position_screens: face_away_from_guest_seating - prepare_meeting_area: - clean_desk: no_documents_visible - lock_cabinets: filing_cabinet_secured - test_screen_lock: automatic_lock_verified during_visit: physical_controls: - workspace_access: visitor_not_allowed_in_office_area - meeting_location: living_room_separate_from_workspace - screen_status: all_devices_locked_before_meeting - door_closed: office_door_closed_and_locked behavioral_controls: - conversation_topics: project_scope_only_no_other_clients - document_handling: only_visitor_specific_materials_shown - device_access: visitor_devices_not_connected_to_network - escort_policy: visitor_escorted_if_bathroom_access_needed post_visit: verification_checklist: - physical_security: - devices_still_locked: verified - documents_secured: filing_cabinet_still_locked - no_items_left_behind: workspace_checked - access_review: - system_logs: no_unauthorized_access_detected - network_connections: no_unknown_devices_connected - follow_up: - meeting_notes: sensitive_details_encrypted - next_steps: documented_in_project_tracker ``` **Result:** ✅ Compliant - Proper visitor management with information protection **ISO 27001:2022 Mapping:** - A.7.1: Physical security perimeters - A.7.2: Physical entry - A.7.13: Clear desk and clear screen ### Example 3: Equipment Loss Prevention (Non-Compliant → Corrected) **Scenario:** Laptop left unattended in coffee shop while working remotely. **❌ Non-Compliant Practice:** ```yaml # INCORRECT - Physical Security Violation coffee_shop_work: laptop_security: - screen_lock: disabled_for_convenience - physical_security: left_on_table_while_ordering_coffee - confidential_work: client_contract_visible_on_screen - location: public_coffee_shop_with_high_traffic ``` **Problems:** - ❌ Device left unattended in public space - ❌ Screen lock disabled exposing confidential information - ❌ No physical security (cable lock) used - ❌ Sensitive work performed in public location **✅ Corrected Approach:** ```yaml # CORRECT - Secure Remote Work Practices remote_work_policy: location_assessment: - evaluate_sensitivity: client_contract_work_is_HIGH_classification - decision: work_from_home_office_only_for_sensitive_tasks public_space_work: allowed_activities: - general_research: non_client_specific_industry_research - email_review: non_confidential_communications_only - code_review: public_open_source_projects_only required_controls: - screen_privacy_filter: prevents_shoulder_surfing - VPN_connection: always_enabled_for_business_access - screen_lock: automatic_after_2_minutes_in_public - physical_security: laptop_never_left_unattended - positioning: back_to_wall_screen_not_visible_to_others prohibited_activities: - client_contracts: no_confidential_documents_in_public - sensitive_data: no_HIGH_or_CRITICAL_data_access - production_systems: no_administrative_access_from_public_wifi device_protection: - physical_lock_cable: attached_when_in_public_spaces - screen_lock: automatic_and_immediate_when_leaving_seat - backup_awareness: work_saved_to_cloud_before_leaving_home ``` **Result:** ✅ Corrected - Appropriate controls for remote work based on data sensitivity **Classification Impact:** - 🔴 **Critical/High Data:** Work from home office only with full security controls - 🟡 **Medium Data:** Public spaces with screen privacy filter and VPN - 🟢 **Low/Public Data:** Public spaces with basic security awareness ## 🔗 Integration Points ### ISMS Policy Integration This skill implements controls from: - **[Physical Security Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Physical_Security_Policy.md)** - Home office security framework - **[Asset Register](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Asset_Register.md)** - Equipment inventory and classification - **[Information Security Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Information_Security_Policy.md)** - Overall security framework - **[Classification Framework](https://github.com/Hack23/ISMS-PUBLIC/blob/main/CLASSIFICATION.md)** - Data sensitivity levels - **[Incident Response Plan](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Incident_Response_Plan.md)** - Device loss/theft procedures ### Related Security Skills - **cryptography** - Encryption requirements for devices and storage media - **data-classification** - Information sensitivity and handling requirements - **mobile-device-management** - Mobile device security controls - **access-control** - Authentication and authorization for devices ### Compliance Frameworks **ISO 27001:2022 Controls:** - **A.7.1** - Physical security perimeters (home office boundary definition) - **A.7.2** - Physical entry (visitor management and access control) - **A.7.4** - Physical security monitoring (environmental and equipment monitoring) - **A.7.9** - Security of assets off-premises (remote work equipment protection) - **A.7.13** - Clear desk and clear screen (information exposure prevention) - **A.7.14** - Secure disposal or re-use of equipment (secure destruction procedures) **NIST CSF 2.0 Functions:** - **PR.AC-01** - Physical access to assets is managed and protected - **PR.DS-01** - Data-at-rest is protected (encrypted storage media) - **PR.IP-06** - Data is destroyed according to policy (secure disposal) - **PR.PT-02** - Removable media is protected (encrypted and secured) **CIS Controls v8.1:** - **1.1** - Establish and maintain detailed enterprise asset inventory (equipment tracking) - **3.6** - Securely manage enterprise assets and data (physical security controls)