9 Physical Access Controls
Physical access controls are the safeguards that protect people, facilities, equipment, and other assets from unauthorized access, theft, damage, or disruption. The chapter explains that cybersecurity depends on physical infrastructure, so strong physical security is a foundational part of protecting information systems. It emphasizes a layered defense approach that helps deter, detect, delay, and respond to threats before they reach critical assets.
These layers begin with security perimeters and expand inward through controls for outer areas, building entrances, workspaces, and highly sensitive secure areas. Organizations use measures such as fences, barriers, bollards, locks, turnstiles, access gates, mantraps, and visitor procedures to restrict entry and prevent problems like tailgating and piggybacking. Access control can also be strengthened with badge systems and biometric authentication, which verify identity through cards, codes, or unique physical traits.
The chapter also highlights the role of monitoring and logging in maintaining accountability and supporting investigations. Security guards, CCTV, alarm systems, and access logs all help detect suspicious activity, preserve evidence, and alert personnel to unauthorized entry or emergencies. By combining physical barriers, authentication methods, and continuous monitoring, organizations reduce risks to confidentiality, integrity, and availability while better protecting the environments in which their systems operate.
Illustration of security perimeters
Relationship between False Acceptance Rate (FAR), False Rejection Rate (FRR), and Crossover Error Rate (CER) in biometric systems.
Answers to Review Questions
- The correct answer is D. A lock is a device that prevents a physical structure (typically a door) from being opened, indicating that only the authorized person (i.e. the person with the key) can open it.
- The correct answer is D. Multifactor authentication (MFA) requires the use of two or more different factors to verify a user's identity . These factors include ‘something you know’ (such as a password), ‘something you have’ (such as a smart card), and ‘something you are’ (such as a fingerprint). Password and username both fall into the category of ‘something you know’, so using them together does not constitute MFA.
- The correct answer is B. Mantraps are physical security measures that consist of a small, secured space with two sets of access-controlled doors, ensuring that only one person can pass through at a time and helping to prevent unauthorized access.
- The correct answer is B. Smart cards are a type of card that can be used to grant access. They are embedded with integrated circuits or a "chip" that can process data. This card, when paired with a card reader, can provide authentication, data storage, and application processing.
- The correct answer is D. The outer perimeter refers to the boundary that surrounds the physical facility, including parking lots, gardens, and other outdoor areas. Its primary security objective is to deter, detect, and delay potential intruders.
FAQ
What is the security perimeter in physical security?
The security perimeter is the boundary that protects physical and logical assets from external threats. It creates defined layers of security around a facility or protected area.
Why is physical security important in cybersecurity?
Physical security protects the facilities, equipment, and infrastructure that information systems depend on. If an attacker gains physical access, they may bypass technical controls, steal assets, or disrupt services.
What is the purpose of layered physical security controls?
Layered physical security controls are designed to deter, detect, delay, and respond to unauthorized access. Multiple layers ensure that if one control fails, others can still protect the asset.
What are the main types of security perimeters?
The chapter describes outer perimeters, inner perimeters, work area perimeters, and secure area perimeters. Each layer applies stronger controls as individuals move closer to sensitive assets.
What is tailgating and how is it different from piggybacking?
Tailgating happens when an unauthorized person follows an authorized person through a secured entry without being detected. Piggybacking is when the authorized person knowingly allows the unauthorized person to enter.
What is the role of a visitor management policy?
A visitor management policy controls and monitors visitor access, defines which areas visitors may enter, and determines whether escorts are required. It helps ensure only authorized visitors are allowed into the facility.
What is a mantrap used for?
A mantrap is a security device with two interlocking doors that allows only one door to be open at a time. It is used to prevent unauthorized entry and reduce tailgating risk.
What are the main biometric authentication metrics?
The main biometric performance metrics are False Acceptance Rate (FAR), False Rejection Rate (FRR), and Crossover Error Rate (CER), also called Equal Error Rate (EER). These help measure the balance between security and usability.
Why are physical access logs important?
Physical access logs provide accountability by recording who accessed a protected area and when, including failed attempts. They support investigations, audits, compliance, and security monitoring.
How do security guards and CCTV support physical access control?
Security guards provide active monitoring, verification, deterrence, and delay, while CCTV records activity and preserves evidence. Together, they help detect suspicious behavior and respond to incidents.
Fundamentals of Cybersecurity ebook for free
