Topic 2.3 Notes – Protecting Physical Spaces

What Protecting Physical Spaces Means

If someone can physically reach a device, room, or building, they may get around software defenses fast. A thief can steal a laptop, plug malware into a USB port, read papers on a desk, or shut systems down by cutting power.

This topic is about layered, risk-based protection. That means:

1. Find the physical weakness
2. Think about how an attacker would use it
3. Pick controls that reduce that risk

You’ll see three control functions across this topic:

• Preventive controls block or reduce the chance of an attack
• Detective controls create evidence or alerts
• Corrective controls reduce harm after something goes wrong

The Main Physical Security Controls

There are two big groups here. Managerial controls shape employee behavior through rules and training. Physical and related technical controls block access, protect devices, and keep systems running.

Keep the defense-in-depth idea in mind here. Physical security is the outer layer, but it still supports the inner layers that protect systems and data.

Defense in depth layers

Managerial controls

Two managerial controls matter most in this topic.

Security awareness training

Training helps employees protect physical spaces through everyday choices.

It should teach people to:

• Spot social engineering, including phishing and in-person deception like “I forgot my badge”
• Avoid letting other people into restricted areas with their own badge
• Help prevent device theft by keeping laptops and other portable devices under control

A common test trap is thinking training solves the whole problem. It doesn’t. Training helps, but people still make mistakes, so physical barriers matter too.

Workstation security policy

A workstation security policy explains how to protect devices, documents, and information where work happens. Some organizations use tiers, so systems handling sensitive data get stronger rules.

Common rules include:

• Lock unattended devices so nobody can use your signed-in session
• Clean desk policy so sensitive papers are removed or secured
• Privacy screens or barriers to reduce shoulder surfing
• Surge protectors or UPS devices to protect equipment and availability

One distinction you need clear in your head: a session lock protects a logged-in account, and a physical computer lock helps stop theft. Those are different controls.

Physical and related technical controls

These controls protect the building, the room, the device, or the power supply.

• Fences, gates, bollards deter and restrict approach to a building
  • Bollards are especially about limiting vehicle access
• Locks protect doors, server cabinets, and computers from theft or unauthorized access
• Card readers deny unauthorized badges and record which badge was used and when
• Access control vestibules and turnstiles help limit entry to one person per authorization
• Disable USB ports to stop malware-loaded drives or malicious peripherals
• UPS and generators keep power available during outages
  • UPS = short-term backup for a device
  • Generator = larger-scale, longer backup

A secured entry vestibule is a good example of a control that works with badges or other access checks to reduce tailgating.

Access control vestibule

How These Controls Match Specific Risks

This part gets tested a lot in scenarios. The question usually gives you a vulnerability and asks for the best mitigation.

Use this chain:

1. Identify the asset and the physical vulnerability
2. Explain how an attacker could exploit it
3. State the effect on confidentiality, integrity, or availability
4. Choose a control that prevents, detects, or corrects it
5. Explain why that control fits
6. Decide whether another layer is needed

Common matches:

• Unlocked building approach → fencing, gates, bollards
• Unlocked room or cabinet → locks
• Need to restrict badge access and keep entry records → card readers
• One valid badge could let in several people → vestibules or turnstiles
• Signed-in device left alone → session lock
• Sensitive papers left out → clean desk policy
• Screen visible to others → privacy screen
• Open USB access → disable ports
• Short outage → UPS
• Long outage affecting larger systems → generator

Important wording:

• Piggybacking means an authorized person is talked or tricked into letting someone in
• Tailgating means someone follows in without being noticed
• Card reader logs the badge used, not guaranteed true identity if the badge was stolen or cloned

Why Layering and Prioritizing Matter

No single control covers every risk. A lock won’t help during a blackout. A UPS won’t stop theft. A card reader alone won’t stop someone slipping in behind an employee.

That’s defense in depth. You stack controls so one weakness doesn’t expose everything.

Mitigations are prioritized by:

• Risk severity
  • How much damage would happen? Think stolen data, downtime, lost devices, interrupted service.
• Cost
  • Purchase, setup, maintenance, staffing, training, inconvenience

For a server in an unlocked room with exposed USB ports and frequent outages, strong choices would be room locks, cabinet locks, disabled USB ports, and a UPS. A card reader adds access control and logs. A vestibule only makes sense if tailgating risk is high enough. A generator is worth it if long downtime would hurt badly.