Physical Security

Explain Why Physical Security Is the Foundation.

Explain Physical Security Threats.

Explain Theft.

Explain Vandalism and Sabotage.

The principle is straightforward: physical access to a system is, for most practical purposes, equivalent to total control over that system.

An attacker with physical access to a running computer can extract data from memory, bypass operating system access controls with a bootable USB drive, install hardware…

Data centers can be targeted for theft of physical media or servers.

The principle is straightforward: physical access to a system is, for most practical purposes, equivalent to total control over that system.

An attacker with physical access to a running computer can extract data from memory, bypass operating system access controls with a bootable USB drive, install hardware…

Data centers can be targeted for theft of physical media or servers.

Backup tapes removed from secure facilities have been lost in transit, exposing enormous volumes of sensitive data.

Physical security threats can be categorized into several types.

Understanding each type is necessary to design proportionate controls.

Physical Security Threats connects to risk, controls, and evidence.

Device theft is one of the most common physical security incidents.

Laptops, smartphones, and external drives are stolen both opportunistically (a laptop left unattended in a coffee shop) and deliberately (targeted theft of devices from executives…

The 2006 theft of a Veterans Affairs laptop containing unencrypted data on 26.5 million veterans remains one of the most widely cited examples of the consequences of inadequate…

Physical damage to equipment — whether by disgruntled insiders, activists, or adversaries — can cause significant disruption.

Cutting network cables, damaging server equipment, or destroying backup media can take systems offline and cause data loss.

In high-stakes environments, sabotage may be deliberate and targeted.

Unauthorized entry to secure areas — data centers, server rooms, offices — can enable attackers to install rogue hardware (such as network taps or hardware keyloggers), access…

Unauthorized access is often achieved through social engineering techniques such as tailgating (discussed in Chapter 3) or by exploiting weaknesses in access control systems.

Unauthorized Access connects to risk, controls, and evidence.

Floods, fires, earthquakes, hurricanes, and power outages are not attackers, but they present very real threats to availability.

Data centers must be designed with these threats in mind.

The 2011 flooding in Thailand disrupted global hard drive supply chains for over a year, illustrating how physical environmental threats can have far-reaching consequences for…

In certain threat environments — government, defense, financial services, research — physical surveillance may be used to collect intelligence.

Attackers may install covert cameras, audio recorders, or network monitoring hardware.

State-sponsored adversaries have been known to compromise hotel rooms, conference facilities, and offices used by targets during business travel.

The first line of physical defense is the perimeter — the boundary between public and controlled space.

Perimeter security is designed to deter, delay, and detect unauthorized entry.

Building and Perimeter Security connects to risk, controls, and evidence.

Physical barriers define the perimeter and force potential intruders to spend time and effort attempting to breach it.

High-security facilities use anti-climb fencing (often topped with razor wire or angled outward), concrete bollards to prevent vehicle-ramming attacks, and security gates with…

The choice of barrier depends heavily on the threat model: a corporate office campus faces different threats than a military installation.

Adequate lighting is one of the most cost-effective physical security controls available.

Well-lit areas deter opportunistic attackers (who prefer to operate undetected), improve the effectiveness of surveillance cameras, and help security personnel observe the…

Motion-activated lighting is particularly effective along perimeter areas and access points.

Video surveillance serves both detective and deterrent purposes.

Cameras record activity for later review and, when visible, discourage would-be attackers.

Modern IP camera systems can incorporate analytics for motion detection, object recognition, and anomaly detection.

For surveillance to be effective, footage must be stored securely, reviewed regularly, and retained for a sufficient period.

Trained security personnel provide a level of response capability that no automated system can fully replicate.

Guards can exercise judgment, respond to incidents, challenge suspicious individuals, and conduct patrols.

However, guards are also subject to human limitations — fatigue, distraction, and susceptibility to social engineering.

Guard effectiveness is enhanced by clear procedures, good communication technology, and regular training.

Visible signs — "Authorized Personnel Only," "CCTV in Operation," "Trespassers Will Be Prosecuted" — serve as both legal notice and psychological deterrence.

While not a barrier in themselves, they establish expectations and create legal clarity about the boundaries of authorized access.

Signage and Security Markings connects to risk, controls, and evidence.

Once the perimeter is established, access control systems regulate who can enter which areas and under what circumstances.

Physical access control is analogous to logical access control in the digital realm — and the same principles apply: something you have , something you know , and something you…

Access Control Systems connects to risk, controls, and evidence.

Electronic key card systems (using RFID or magnetic stripe cards) are the most common form of corporate physical access control.

Each card is linked to an identity, and access events are logged.

Cards can be quickly deactivated when employees leave or when a card is reported lost.

Proximity cards (which work without insertion — simply by being near the reader) are convenient but can be vulnerable to cloning if an attacker gets close enough to read the…

Biometrics use physical or behavioral characteristics to verify identity.

Biometric systems are most effective as part of multi-factor authentication combined with another credential type.

Biometric Access Controls connects to risk, controls, and evidence.

A mantrap (also called an airlock or access control vestibule) is a small enclosed area with two sets of doors — the second door does not open until the first has closed and…

This prevents tailgating (an unauthorized person following an authorized one through a door).

Mantraps are common at the entrances to data centers, bank vaults, and government facilities.

Some sophisticated mantraps include weight sensors or camera systems to detect if more than one person has entered the enclosed space.

Visitors to controlled facilities should be required to sign in, show identification, receive a visitor badge, and be escorted by authorized personnel.

Visitor logs serve as both a deterrent and a forensic record.

Badge designs should visually distinguish visitors from employees, making it easy for anyone in the facility to identify someone who should not be moving freely.

Data centers — facilities that house the servers, storage, networking, and cooling equipment that support organizational IT — require especially rigorous physical security.

They represent a single point of concentration for enormous volumes of critical data and systems.

For security specifically, organizations often follow guidance from NIST Special Publication 800-53, which includes physical and environmental protection controls.

The physical environment of a data center or server room must be carefully controlled to ensure availability.

Environmental threats can cause hardware failures, data corruption, and fires.

Environmental Controls connects to risk, controls, and evidence.

Why Physical Security Is the Foundation

Physical Security Threats

Theft

Vandalism and Sabotage

Where Why Physical Security Is the Foundation applies.

Where Physical Security Threats applies.

How the difference changes the security decision.

Identify the asset or process at risk.

Choose a preventive, detective, or corrective control.

Explain what evidence would prove the control is working.

Define one core concept in plain language.

Compare two controls or threats from the week.

Apply one idea to a campus or business system.

Evaluate why a solution might fail in practice.

Collect evidence, not just screenshots.

Explain what the artifact proves.

Connect the proof back to risk and control selection.

Physical Security

Security is a decision process, not just a tool list.

Use the reading to justify practical choices.