Creating layered protection begins with a careful analysis to clearly define and identify core assets, or those things that a campus seeks to protect. The protective layers can include anything designed to:
- Deter
- Detect
- Delay
- Deny access to or compromise of core assets
A concentric layered approach might include the following:
Core Asset: A bag of gold
- Layer 1: Gold placed in a heavy jewelers safe
- Layer 2: Combination requires input from two trusted persons to open
- Layer 3: Capacitance proximity sensor on safe
- Layer 4: Vibration sensor to detect entry through floor
- Layer 5: Volumetric passive infrared alarm sensor (PIR)
- Layer 6: Heavily constructed floor to ceiling fire wall enclosing room
- Layer 7: Video surveillance coverage of room
- Layer 8: Heavy steel sheathed solid core door
- Layer 9: Heavy steel door frame with reinforced strike
- Layer 10: Proximity card activated electronic access control system
- Layer 11: Biometric access verification feature
- Layer 12: Door ajar alarm and latch guard sensors
- Layer 13: Safe room located in secure access controlled wing
- Layer 14: No windows leading to secure wing
- Layer 15: Wing located in secure building with alarm and access control features
- Layer 16: Cameras with video analytics placed at key access points
- Layer 17: Climb- and cut-resistant fence to protect vulnerable areas
- Layer 18: Secure building located in center of campus
- Layer 19: Maximum surveillance of secure building from other campus areas
- Layer 20: Fence and landscape features that restrict the approach paths to the secure building
- Layer 21: Adequate exterior lighting to ensure day and night surveillance
- Layer 22: Active monitoring of security systems
- Layer 23: All security equipment located in locked, alarmed, access controlled closets with tamper protection
This example shows a system with a very large number of layers. The number of layers used to protect your assets will depend on the value of your assets. This should include the cash required to replace the asset and the impact of its loss to the organization if it were removed or compromised. The cost of protective systems should always be less than the replacement cost of the asset.
Security layers must also protect against known or anticipated threats (not always people). A windowless basement at the center of a building might be a good location to protect valuable electronic equipment unless the building is located in an area that is prone to flooding.
Concentric layers of protection would then require moisture sensors and the location of this equipment moved to a higher floor. Tornado prone areas might view placement of this equipment quite differently.
