Physical Security and Physical Access Controls
Unit 4: Security Concepts. Lesson 13 of 41 in APlus Academy Core 2.
Security starts at the door. If an attacker can touch the server, the software controls do not matter. The exam names the physical measures and expects you to match each to the threat it stops.
Perimeter and building
- Bollards: short posts that stop vehicles from ramming an entrance or driving onto a walkway.
- Fences: define the perimeter and slow intruders; height and topping set the level.
- Lighting: well-lit grounds deter and let cameras see.
- Video surveillance: cameras that deter, record evidence, and, with monitoring, alert; placement covers entrances, parking, and server rooms.
- Alarm systems: sound and notify on a breach; tied to door contacts and motion sensors.
- Motion sensors: detect movement after hours; infrared, microwave, ultrasonic.
- Security guards: judgment that no device has; check IDs, escort visitors, respond.
- Magnetometers: metal detectors at entrances to catch weapons and stolen hardware.
Doors and rooms
- Access control vestibule: two doors with a space between; the second opens only after the first closes and the person is verified. It stops tailgating (someone slipping in behind an authorized person). The old name is mantrap.
- Badge reader: reads a card, fob, or phone and unlocks the door for authorized people, logging who entered when.
- Door locks: keyed, electronic keypad, badge, or biometric; the server room door is locked, always.
- Equipment locks: cable locks for laptops, locking cabinets and racks, chassis locks so a drive cannot be pulled.
Physical access methods
- Key fobs: small tokens read by the door; cheap and revocable.
- Smart cards: cards with a chip that proves identity, often the same card that logs into the PC; may need a PIN (two factors).
- Mobile digital keys: the phone as the badge, through NFC or Bluetooth.
- Keys: metal keys still exist and are the hardest to revoke; a lost master key means rekeying.
- Biometrics: something you are. Retina scanner (blood vessels in the eye), fingerprint scanner, palm print scanner, facial recognition technology (FRT), voice recognition technology. Biometrics cannot be forgotten or lent, but they can be spoofed and cannot be changed if copied, so they pair with a badge or PIN for high security. Together these are the exam's physical access security methods.
Matching control to threat
- A car aimed at the lobby: bollards.
- An intruder following an employee through the door: access control vestibule (and training against tailgating).
- Laptops disappearing from desks: cable locks and locked cabinets.
- Night-time break-in: alarm system with motion sensors, lighting, cameras.
- Who entered the server room at 2 a.m.: badge reader logs and video.
- Weapons or stolen drives leaving the building: magnetometer and guard.
Physical Security and Physical Access Controls, explained slowly
Layers of physical security
Physical security works in rings. The outer ring is the property line, the next is the building shell, then the floor or suite, then the room, then the rack or cabinet, then the device itself. A good design puts at least one control in every ring so a failure in one is caught by the next. The exam rarely says "ring," but its scenarios always describe which ring was breached, and the right answer is the control that belongs to that ring.
ring controls property fences, bollards, lighting, cameras, guards at the gate building badge readers, access control vestibule, magnetometer, alarm, guards at the desk floor/suite badge readers, door locks, cameras in corridors room keypad or biometric lock, motion sensor, camera, no windows rack/cabinet locking racks and cabinets, keyed drawers device cable locks, chassis locks, port blockers
The access control vestibule, step by step
- A person badges through the first door into a small enclosed space.
- The first door closes and locks behind them.
- Only now can the second door be opened, by a second badge read, a PIN, a biometric, or a guard who verifies the person.
- One person at a time, because the space is sized for one; a second person cannot slip in.
The vestibule defeats tailgating (following someone through) and piggybacking (the person ahead holding the door on purpose). Employees must also be trained to challenge or report strangers, since a vestibule guards only the doors it is installed on.
Choosing biometrics
method accuracy cost user acceptance notes fingerprint good low high cuts and dry skin cause misreads; can be lifted palm print good medium high vein patterns are hard to fake facial good low high lighting and masks affect it; liveness checks stop photos retina excellent high low shines light into the eye; slow; very accurate voice fair low high background noise and recordings are problems
Biometrics have a false acceptance rate (letting the wrong person in) and a false rejection rate (locking the right person out). Tightening one loosens the other; the crossover point is how systems are compared. High-security rooms pair a biometric with a badge or PIN so both must fail.
Worked scenarios
- A visitor followed an employee into the data center through a badged door. The control that would have stopped it is an access control vestibule; the training gap is "do not hold doors."
- A laptop left on a desk overnight is gone in the morning, and the office door was locked. The next ring inward is the device: a cable lock or a locked cabinet.
- Someone rammed a truck into the loading dock door. Bollards.
- A former employee's badge still opens the door. Physical access control also needs a revocation process: badges are disabled at termination.
How the exam asks it
"Which of the following would BEST prevent unauthorized people from entering behind employees?" (vestibule). "Which control prevents vehicles from approaching the entrance?" (bollards). "A technician wants to know who entered the server room and when" (badge reader logs, video). "Which is an example of something you are?" (fingerprint, retina, face, palm, voice).
What to memorize
Bollards for vehicles; vestibule for tailgating; badge readers log entry; equipment locks protect devices; magnetometers detect metal; motion sensors and alarms for after-hours; guards provide judgment. Biometric methods: retina, fingerprint, palm print, face, voice. Key fobs, smart cards, mobile digital keys, and metal keys are something you have.