2 cissp ® Official Study Guide Eighth Edition

Protecting Physical Assets 
Physical assets go beyond IT hardware and include all physical assets, such as an organiza-
tion’s building and its contents. Methods used to protect physical security assets include 

---

712
Chapter 16 
■
Managing Security Operations
fences, barricades, locked doors, guards, closed circuit television (CCTV) systems, and 
much more.
When an organization is planning its layout, it’s common to locate sensitive physical 
assets toward the center of the building. This allows the organization to implement pro-
gressively stronger physical security controls. For example, an organization would place a 
datacenter closer to the center of the building. If the datacenter is located against an outside 
wall, an attacker might be able to drive a truck through the wall and steal the servers.
Similarly, buildings often have public entrances where anyone can enter. However, addi-
tional physical security controls restrict access to internal work areas. Cipher locks, man-
traps, security badges, and guards are all common methods used to control access.
Managing Virtual Assets
Organizations are consistently implementing more and more virtualization technologies 
due to the huge cost savings available. For example, an organization can reduce 100 physi-
cal servers to just 10 physical servers, with each physical server hosting 10 virtual servers. 
This reduces heating, ventilation, and air conditioning (HVAC) costs, power costs, and 
overall operating costs.
Virtualization extends beyond just servers. Software-defined everything (SDx) refers to 
a trend of replacing hardware with software using virtualization. Some of the virtual assets 
within SDx include the following:
Virtual Machines (VMs)
VMs run as guest operating systems on physical servers. The 
physical servers include extra processing power, memory, and disk storage to handle
the VM requirements.