Physical Security and Access Control
Layers and control points
Physical security works in layers: perimeter, building envelope, internal zones, and high-value areas. Access control is the process of deciding who, where, when and why a person may enter. Know the main methods: identity checks, passes and badges, visitor logs, escort rules, keys and locks, and electronic systems such as card readers, PINs and biometrics.
Core principles
- Least privilege: give the minimum access needed for the role.
- Positive identification: verify against an approved list or system; do not accept a uniform or a name alone.
- Challenge politely: anyone without a visible badge in a controlled area should be approached courteously and verified.
- Tailgating and piggybacking: one badge, one person. Politely stop a second person entering on one swipe.
- Key and card control: keys and cards are signed in and out; loss is reported immediately.
- Anti-passback and audit: the system should show who is where; logs are reviewed.
Traps to watch
Scenario questions where a guard lets in a 'known' contractor without a pass, or holds the door for a group. Also watch answers that rely on physical force to stop a tailgater - verbal, courteous challenge is correct.
Rule of thumb
If you cannot verify, you do not admit. Verify, record, then admit - in that order.
Worked example
A person in a delivery uniform arrives at a staff-only door without a pass and says the usual guard lets him in. Correct answer: do not admit; direct him to the visitor entrance, verify with the receiving department, log the visit, and escort as required.