Physical Security
Layered defense
Physical security is designed in rings: site perimeter, building envelope, interior zones, and the critical asset itself. Each ring should deter, detect, delay, and allow response. Delay is the metric most often forgotten - a fence that slows an intruder for four minutes while a guard responds in three is doing its job.
Concepts
- CPTED - natural surveillance, natural access control, territorial reinforcement, and maintenance. Design out opportunity before adding hardware.
- Perimeter - fences, clear zones, bollards and crash-rated barriers, standoff distance. Vehicle-borne threats are answered by distance and engineering, not by signage.
- Lighting - enough to see and be seen; excessive lighting creates glare and dark pockets.
- Locks and key control - hardware grade matters, but key control and rekeying discipline matter more. Master keys multiply risk.
- Access control - card, PIN, biometric; mantrap or turnstile for tailgating; anti-passback.
- Intrusion detection - perimeter, area, and object detection; balanced magnetic switches, PIR, dual-technology sensors to cut false alarms.
- CCTV - cameras do not prevent crime; they detect, record, and support response. Retention, coverage, privacy, and monitoring determine value.
Traps
- Crediting cameras with deterrence as though it were guaranteed.
- Specifying a strong lock on a hollow-core door or glass wall.
- Forgetting that alarms require a response plan and someone to respond.
Worked example
An office lobby has repeated tailgating. Cheap fix: a turnstile or mantrap at the employee entrance, badge-in/badge-out with anti-passback, a receptionist trained to challenge, and a camera on the door. Total cost is modest and each layer covers the others' failure.
Rule of thumb: deter, detect, delay, respond - and always ask what happens when the first control fails.