Alarmed Carrier and Protective Distribution System (PDS)

Every other category on this site protects a place. This one protects a cable. Where a network carries classified or sensitive traffic, the physical path between rooms is part of the attack surface, and the governing requirement is usually that the conduit is either inspected or alarmed.

What is a PDS (Protected Distribution System)?
A Protected Distribution System (PDS) is a physically protected pathway for network cabling that carries unencrypted classified or sensitive information through areas of lower security, for example between SCIFs or secure rooms in different parts of a building or campus. In the United States, CNSSI 7003 is the national instruction that describes PDS, and it recognizes two types: hardened carriers and alarmed carriers. The accrediting authority for the installation decides which type a route needs.

Hardened carrier vs. alarmed carrier

Hardened carrier: the cable runs in sealed conduit, in some cases with encasement, that makes tampering physically difficult and visible. Its integrity is confirmed by periodic visual inspection of the route.
Alarmed carrier: the carrier is fitted with sensors that monitor it continuously and raise an alarm when it is drilled, cut, opened or otherwise disturbed.
An alarmed carrier can reduce the inspection routine the approving authority requires for the route.
RBtec makes alarmed carrier systems: ShortPDS (copper sensor cable, short runs) and FiberPDS (fiber optic sensing, long routes), both designed for CNSSI 7003 alarmed carrier PDS deployments.

What an alarmed carrier does
A protective distribution system encloses the cable run and detects tampering with the enclosure. RBtec builds two, for two different distances.

FiberPDS is a long-range alarmed carrier built on the same distributed acoustic sensing technology as RaySense. A single processor monitors up to 100 km (62 miles) of conduit, pipe, raceway and cable tray, and locates tampering to within 3 meters. For campus and inter-building runs, this replaces a great deal of inspection.

ShortPDS adds intrusion detection to conduits, pipes, raceways and cable trays over shorter runs. It exists because the alternative — periodic visual inspection of every foot of carrier — is expensive, and because the requirement does not go away just because the run is short.

Physical security for a cyber requirement
This is the category that sits between the two disciplines, and it is usually specified by a network or accreditation team rather than a physical security one. If you are working to a government PDS requirement, the specification will normally tell you whether a hardened carrier, an alarmed carrier, or continuous inspection is acceptable — and the alarmed carrier is generally the option that removes the inspection burden.

What to tell us
Run length, the carrier type already installed, and the standard you are accrediting against. Those three usually determine the answer.