Physical Security and Access Control
Physical security is layered defence of people, property and information; access control decides who passes each layer, when, and under what conditions. The exam tests perimeter and building protection, zone design, visitor management, key and card control, and the human behaviours that defeat hardware - tailgating, propped doors and shared PINs.
Layered defence and CPTED
Layers run outward to inward: perimeter (fence, lighting, signage), building envelope (doors, windows, locks), interior zones (reception, restricted areas), and the asset itself (safe, server rack). CPTED - crime prevention through environmental design - uses natural surveillance, clear territorial markings, controlled access and good maintenance so the environment itself discourages intrusion.
Access control rules
- Least privilege: a person gets the minimum access needed for the job, for the minimum time.
- Positive identification: verify identity before issuing a pass; never accept a name alone.
- Anti-passback: a card cannot be used to enter twice without an exit, which exposes pass-back and shared-card abuse.
- Two-person rule for vaults, server rooms and key stores.
- Visitor management: register, badge visibly, escort, record exit.
- Termination discipline: collect cards and keys and remove system rights the same day.
- Challenge culture: every person without a visible badge is politely challenged.
Worked example
Staff tailgate through a single door behind one badge swipe. The weak fix is a sign. The correct fix: reposition the guard to see the doorway, install a mantrap or turnstile, enable anti-passback, give visitors a separate entrance, and run a short awareness briefing. Reasoning: engineering controls change behaviour; signage alone does not.
Traps
Assuming a locked door is a controlled door; propped fire doors; shared PINs; no audit of who holds master keys.