7.14 Physical Security Operations

Key Takeaways

CISSP 7.14 is officially: Implement and manage physical security.

The current ISC2 outline explicitly identifies: perimeter security controls and internal security controls.

Physical security protects people, facilities, information and technology against unauthorised physical access.

Cybersecurity does not stop at the network boundary.

Physical access can allow an attacker to steal hardware, connect rogue devices, tamper with cabling, access consoles, remove storage media or directly observe sensitive information.

Physical controls and logical controls reinforce one another.

Physical security should normally use multiple layers.

Layers may include property boundaries, building entrances, internal security zones and additional protection around critical assets.

A useful physical-security model is:

deter → detect → delay → respond.

A barrier does not need to be impossible to defeat in order to provide value.

If it delays an attacker long enough for detection and response, it has contributed to security.

Perimeter security protects the outer boundary.

Examples include fences, walls, gates, vehicle barriers, lighting, guards, cameras and intrusion alarms.

Strong protection at one entrance does not compensate for another uncontrolled entrance.

Physical access should therefore be channelled through controlled entry and exit points.

Bollards and other vehicle barriers can help control vehicle approach to sensitive facilities.

Security lighting supports surveillance, deterrence and guard visibility.

Lighting supports security but is not itself access authorisation.

Security guards provide flexible human observation and response.

Guards may verify identity, challenge suspicious individuals, respond to alarms and coordinate emergencies.

Human security controls require training and clearly defined procedures.

CCTV provides valuable monitoring and investigative capability.

Cameras are primarily detective controls.

A camera recording an intrusion does not necessarily prevent the intrusion.

Camera = observe. Lock = restrict. Alarm = notify. Response = act.

Surveillance equipment must be maintained.

A camera that has been offline for months does not provide useful monitoring merely because it remains mounted on the wall.

Camera coverage, image quality, lighting, retention, timestamps and monitoring responsibility should therefore be considered.

Physical intrusion alarms can detect forced doors, held-open doors, movement and other suspicious conditions.

Detection is only useful when there is an appropriate response.

Excessive nuisance alarms can also cause security personnel to stop treating alarms seriously.

Internal physical security restricts movement after someone has entered the facility.

Entering the building does not automatically authorise entry into every room.

Organisations can establish progressively restricted internal security zones.

Public areas might include reception. Controlled areas might include normal employee offices. Restricted areas might include operations rooms. Highly restricted areas might include data centres or evidence storage.

Physical access should follow the principle of least privilege.

Give people access to the areas required for their role - not every area they might conceivably want to enter.

Physical Access Control Systems can authenticate and authorise people or vehicles at controlled entry points.

Physical credentials can include keys, badges, smart cards, combinations and biometric mechanisms.

Sensitive areas may require stronger authentication than ordinary office areas.

Physical access has a lifecycle.

Access should be authorised, issued, monitored, periodically reviewed and revoked when no longer required.

A transfer between roles should trigger review of physical as well as logical privileges.

Termination should include physical credential revocation.

Account disabled ≠ badge disabled.

Keys and combinations are also security credentials.

Sensitive keys should be inventoried, securely stored and recovered when no longer required.

Loss of a master key can have much greater impact than loss of a key to a single room.

Shared physical credentials reduce accountability.

If 50 people use the same door code, the organisation may know that the code was used but not which authorised person used it.

Electronic locks can behave differently during power failure.

Fail-safe locks release when power is lost.

Fail-secure locks remain secured against entry when power is lost.

Life-safety and emergency-egress requirements remain paramount.

Security must not improperly trap people inside a dangerous building.

Secure access vestibules or interlocks can provide additional control around highly sensitive entrances.

Turnstiles can help enforce one-person-per-credential entry.

Tailgating and piggybacking describe unauthorised entry by following someone through a controlled entrance.

Some organisations distinguish tailgating as occurring without the authorised person's knowledge and piggybacking as occurring with their cooperation.

The terminology is not universally used consistently.

The important concept is: someone bypassed individual physical authentication.

Physical security is therefore vulnerable to social engineering.

A perfectly functioning badge reader cannot stop an employee from holding a secure door open for an unauthorised person.

Employee awareness and challenge culture are therefore part of effective physical security.

Anti-passback mechanisms can detect or prevent certain impossible badge sequences, such as the same credential entering twice without a recorded exit.

Visitors require temporary controlled access.

Visitor processes may include identity verification, host confirmation, registration, temporary badges, limited access, escort and sign-out.

Visitor badge ≠ unrestricted access.

Contractors should receive only the physical access required for their authorised work.

Physical access logging provides accountability.

Useful records can identify the credential, location, time and access result.

Monitoring can identify events such as after-hours entry, repeated denied access, unusual locations and forced doors.

Unusual physical access ≠ automatically malicious.

Context should be investigated.

Physical and logical logs can sometimes be correlated.

If a badge shows an employee entering one geographic location while the same user's logical identity authenticates from an implausibly distant location at almost the same time, that correlation may deserve investigation.

Physical logs themselves should be appropriately protected.

Their integrity, retention, availability and timestamps can matter during investigations.

Critical internal areas include server rooms, data centres, wiring closets and restricted storage.

Network closets should not be overlooked.

Physical access to switches, patch panels and cabling can permit disruption, tampering or unauthorised network connection.

Communications transmission paths may require physical protection.

Locked wiring closets, protected cable routes, conduit and controlled network ports can help reduce physical tampering risk.

Physical output devices also require consideration.

Printers, screens, scanners and other output mechanisms can expose data even when the underlying computer system is strongly authenticated.

Secure system ≠ secure information if the output is physically exposed.

Shoulder surfing and unauthorised visual observation can reveal sensitive information without exploiting any software vulnerability.

Delivery areas and loading docks are additional access routes that should be controlled.

Organisations should consider both people entering and assets leaving the facility.

Equipment removal may require authorisation.

A person wearing contractor clothing should not automatically be allowed to push a server out of the building.

Access badges and other physical-security identifiers can themselves contain sensitive information.

Employees should avoid unnecessarily exposing detailed credentials in photographs or public posts.

Physical-security monitoring creates information about people.

CCTV, visitor logs and access records should therefore be appropriately governed, retained and protected according to applicable requirements.

Emergency access may require special arrangements for emergency services or facilities personnel.

These arrangements should support safety without creating an uncontrolled permanent bypass.

Physical security incidents need response procedures.

Examples include forced doors, lost credentials, tailgating, unknown individuals, damaged barriers, camera tampering and missing equipment.

Physical and cybersecurity incident response can overlap.

A rogue device discovered in a wiring closet may require both physical investigation and technical incident response.

Physical controls require maintenance and testing.

Locks, badge readers, cameras, barriers, lighting and alarms should not simply be installed and forgotten.

Installed control ≠ functioning control.

Temporary compensating controls may be required when normal controls fail.

For example, a guard might manually verify employees while a badge reader is being repaired.

Temporary exceptions should have an owner, procedure and path back to the normal control.

Useful physical-security measurements can include access revocation, forced-door events, camera availability, visitor exceptions, lost credentials and alarm-response time.

Domain 3.9 and Domain 7.14 should not be confused.

Domain 3.9 concentrates on designing site and facility security controls.

Domain 7.14 concentrates on implementing and managing physical security during day-to-day operations.

The central CISSP principle is:

establish layered perimeter and internal physical controls, grant access according to business need, monitor and record sensitive physical activity, control visitors and credentials, respond to suspicious events, preserve life safety and continuously verify that the controls remain operational and appropriate.