1. "Don’t judge a book by its cover." In Israel, the vulnerability of physical access translates into daily risks of being in the proximity of a bomb. Suicidal bombers dressing to blend into their surroundings by appearing to be Orthodox Jews or even Israeli soldiers is not uncommon. People dressing as employees, confidently acting as employees, and even disgruntled employees pose serious threats to the safety of these IT assets. We must have processes that impede the access and decrease the exposure to such people. Note: This is a learning process and will never be perfect. 
   
   
2. There is such a thing as suspicious behavior. Everyone should feel a duty not to tolerate strange behaviors, even by fellow employees, without asking questions. The threat is not just theft, but vandalism, corporate espionage, and breach of customer/client/patient confidentiality. Political correctness has no place in protecting assets, though some instances require conversations with corporate counsel or even law enforcement personnel.
   
   
3. Training. We need training in the workplace to be more skeptical of people’s intent without becoming paranoid. Our employees must create an atmosphere where people are sensitive to the risks of simple things like leaving fire exits open unattended, but still enjoy working there. We must feel safe and cared for.
   
   
4. Processes must assess the likely vulnerability of suspicious behavior. The new airport model seems to waste thousands of hours by assuming we are all risks. Lifetimes are being wasted in lines. Should we be scanning the shoes of everyone entering tall building or airplanes because of one failed hijacker who was (surprise!) acting strangely? Imagine the economic impact to consumerism if malls or casinos imposed the same rules as the TSA! There must be a logical association, some human ROI, between the practicality of security procedure and reduction of risk.
   
   
5. Any security adds an administrative burden (think insurance). Remember to budget for IT security to include physical security or to include it more globally in the budget for each building housing your three types of IT assets.

1. Safeguard access to backup tapes and make sure that they are all accounted for and cannot easily disappear.
   
   
2. Make sure that your wireless and mobile users are not introducing risks by behavior. 
   
   
3. Have an established process to revoke access to anyone fairly quickly. This includes access to buildings, rooms, and even hardware or data. You should have a basic IT security breach / IT loss protocol.
   
   
4. Establish reasonable after hours policies. Just as auditors typically frown upon employees who never take off even for vacation time, there maybe some concern about personnel who always come into the office over weekends and holidays.
   
   
5. Use and change locks appropriately. Keys should be periodically updated or entry codes changed, especially after disgruntled people leave. Why invite trouble?
   
   
6. Make sure that alarms work and know what they protect. Codes should also be updated in a timely fashion to reflect any new threat.
   
   
7. Reduce theft by using common sense. Keep equipment away from uncovered windows. Lock the equipment in a room, especially overnight. Tone down the room identification to be sure that it is for people who should be in the building, but may get lost. Room labels like data center for rooms that are not obviously the data center is advertising for trouble.
   
   
8. Consider establishing a sign in / sign out process for more sensitive IT areas. In some environments this adds to the accountability. One way to automate this may be archiving the card entry cards read.

Being sensitive to IT security by budgeting and maintaining tools like firewalls and anti-virus software is not enough. We must focus foremost on the easiest attack point, physical access, and once that is robustly secured move on to the more creative and difficult entry points.