f information security. However, it is too common to discover that a perpetrator could bypass an expensive firewall simply by walking in and out of the facility disguised as a building services attendant or by jacking into an unprotected Ethernet socket in a lobby. It is often easier to steal a computer than it is to hack into the system from the Internet. Polls blame insider threats for 70-90% of information security breaches. A simple physical security survey begins by observing whether office doors, desk drawers and file cabinets are locked, workstations are shut down or locked, and that sensitive papers and media are secured. Stories abound of competitors viewing an organization's strategy through a conference room window. Moreover, it is simpler to steal a computer from a telecommuter's home than to break into corporate headquarters. Worse yet, a trusted friend may simply log on to the corporate network to obtain confidential information such as an initial public stock offering. The primary goal of physical security is the safety of people. A physical security strategy begins with a business impact analysis that lists threats such as flood, loss of power, or earthquake, and rates each in terms of human impact, property impact, business impact, probability, and resources available in the case of such an event. Historically, locked doors and managed keys have regulated physical access. Today, organizations require picture ID and electronic badges. Access to information assets often requires a personal ID number and possession of a one-time password- generator. Biometrics devices such as fingerprint scanners, retinal scanners, and hand geometry scanners are also becoming increasingly common. Organizations should examine policies regarding management of mobile devices, such as wireless-enabled PDAs, which are now full-featured computers and video communications devices. Because it is better to design quality into a system than to retrofit it, organizations should think ahead. It is also important to review proce