Protecting Physical Spaces · 保护物理空间
| English | 中文 | Pinyin · 拼音 |
|---|---|---|
| clean desk policy/kliːn desk ˈpɒlɪsi/ | 清桌政策 | qīng zhuō zhèng cè |
| bollards/ˈbɒlɑːdz/ | 防撞柱 | fáng zhuàng zhù |
| card readers/kɑːd ˈriːdəz/ | 读卡器 | dú kǎ qì |
| access control vestibule/ˈækses kənˈtrəʊl ˈvestɪbjuːl/ | 门禁前室 | mén jìn qián shì |
| uninterruptible power supply/ˌʌˌnɪntəˈrʌptɪbl ˈpaʊə səˈplaɪ/ | 不间断电源 | bù jiàn duàn diàn yuán |
Managerial controls first
- Security-awareness training teaches staff not to badge strangers in.
- A workstation security policy requires locking devices and a clean desk policy 清桌政策.
- Rules cost little and stop many attacks.
先是管理性控制
- 安全意识培训教员工不要为陌生人刷卡放行。
- 工作站安全政策要求锁定设备并执行清桌政策(clean desk policy)。
- 规则成本低,却能阻止许多攻击。
Physical controls harden the building
- Fences, gates, and bollards 防撞柱 deter access; locks protect doors.
- Card readers 读卡器 log and restrict entry.
- An access control vestibule 门禁前室 (a two-door airlock) stops piggybacking.
物理控制加固建筑
- 围栏、门和防撞柱(bollards)阻止进入;锁保护门。
- 读卡器(card readers)记录并限制进入。
- 门禁前室(access control vestibule)(双门气闸)阻止尾随。
Managerial control or physical control? · 管理控制还是物理控制？
Managerial controls are rules and policies; physical controls are objects that guard the space. · 管理控制是规则和策略；物理控制是守护空间的物体。
A two-door airlock that lets one person pass at a time is a(n)... · 一次只允许一人通过的两侧门气闸门是……
An access control vestibule stops piggybacking. · 门禁通道可防止搭便车。
Which control keeps a device running during a power outage? · 哪种控制措施能在断电期间保持设备运行？
A UPS provides backup power. · UPS 提供备用电源。
Disabling ____ ports blocks external drives from loading malware. · 禁用____端口可阻止外部驱动器加载恶意软件。
Disabling USB ports blocks malware drives. · 禁用USB端口可阻止恶意驱动器。
Which are physical controls? (Choose all) · 哪些是物理控制措施？（多选）
A password policy is managerial, not physical. · 密码策略是管理控制，而非物理控制。
Keeping power on
- Disabling USB ports blocks malware drives.
- An uninterruptible power supply (UPS) 不间断电源 keeps devices running in an outage.
- Match a control's cost to the severity of the risk.
保持供电
- 禁用USB端口阻止恶意软件驱动器。
- 不间断电源(uninterruptible power supply)在停电时保持设备运行。
- 让控制的成本与风险的严重性相匹配。
Locks and cameras are useless if staff prop doors open or badge strangers in. Technology only works alongside trained people — that is why security-awareness training comes first.
如果员工把门撑开或为陌生人刷卡,锁和摄像头就毫无用处。技术只有和受过训练的人一起才有效——这就是为什么安全意识培训排在第一位。
Security-awareness training is a managerial control. · 安全意识培训是一种管理控制。
Training is a rule/policy = managerial. · 培训属于规则/策略 = 管理控制。
An access control vestibule has two doors: the first must close and lock before the second opens. Only one person can pass at a time, so an attacker cannot slip in behind an employee — it defeats piggybacking by design.
门禁前室有两道门:第一道必须关闭并锁住,第二道才打开。一次只能通过一人,所以攻击者无法跟在员工身后溜进去——它从设计上就击败了尾随。
Protect physical spaces with managerial controls (training, workstation and clean-desk policies) and physical controls (locks, fences, bollards, card readers, access control vestibules, disabled USB ports, a UPS). Prioritise by matching cost to risk severity.
用管理性控制(培训、工作站和清桌政策)和物理控制(锁、围栏、防撞柱、读卡器、门禁前室、禁用USB端口、UPS)来保护物理场所。通过让成本与风险严重性匹配来排定优先级。