Physical Security and Access Control
This domain tests how physical barriers, layout and access procedures combine to keep unauthorised people away from people, information and assets.
Defence in depth
Security is layered: the perimeter (fence, wall, gatehouse, bollards, lighting), the building envelope (doors, windows, locks, glazing), interior zones, and the asset itself (safe, strongroom, server rack). Each layer should delay an intruder and create a chance of detection.
Access control in four steps
- Identify: who are you, or what token do you hold?
- Authenticate: is that token genuine? Photo, PIN, biometric.
- Authorise: are you entitled to this zone at this time?
- Record: is there an audit trail? Other rules: need-to-enter is separate from need-to-know, and both apply. Visitors are pre-registered, identified, badged, escorted where required, and their badges recovered on exit. Keys are numbered, logged in a signed register, and master keys held only by named accountable officers. Searches must be lawful, consistent, non-discriminatory and carried out with dignity, by a person of the same sex where a body search is needed.
Threats
Tailgating and piggybacking, pass-back of badges, borrowed badges, propped doors, and social engineering such as a confident stranger claiming to be a technician who forgot his badge.
Worked example
A contractor in overalls with a valid badge asks you to hold the server-room door because both hands are full. Holding it defeats the door's control and admits him to a zone he is not authorised for. Instead, check the badge against the authorisation list for that zone, then call the facilities supervisor. If he is not listed, escort him to reception; do not admit him.
Traps
Treating a badge as a pass to every door; mistaking politeness for permission; leaving a door on the latch 'just for a minute'; over-trusting technology without a human check.