Topic 2.4 Notes – Detecting Physical Attacks

What Detecting Physical Attacks Is

Physical attack detection means spotting unauthorized or suspicious activity in real spaces like entrances, hallways, server rooms, and storage areas. The goal is not just to know that something happened. You want usable evidence.

A quick reminder. Preventive controls try to stop access, like locks or vestibules. Detective controls reveal activity, like cameras or motion sensors. Some controls do both. A badge reader can block entry and create a log.

The main thing to remember is this: one alert rarely proves an attack. Defenders usually verify and correlate evidence.

This helps uncover attacks such as:

• Tailgating when someone slips in behind an authorized person
• Piggybacking when an authorized person is talked or tricked into letting someone in
• Cloned or stolen badge use when the system accepts a credential, but the person using it is unauthorized
• Shoulder surfing, device access, theft, and physical destruction

Physical Detective Controls

These controls help defenders notice suspicious activity and piece together what happened afterward. A common setup uses cameras and motion sensors together.

• Cameras give visual monitoring and a visual record.
  • Best case is live monitoring + recording.
  • Live feeds help immediate response.
  • Recordings help later with timelines, route tracking, and seeing what the person did.
  • Facial recognition can add alerts for unauthorized people, but it still needs verification.
  • Their weakness is field of view. If the camera sees only the door, it cannot show what happened deeper inside.
• Security guards notice suspicious behavior and can respond right away.
  • Stationary guards fit entrances, lobbies, restricted doors, and high-value assets.
  • Patrolling guards fit perimeters, parking lots, and exterior spaces.
  • Guards are strong because they can interpret context, question someone, and act.
• Motion sensors detect movement and raise alerts.
  • Best in low-traffic sensitive spaces like server rooms or records rooms.
  • A motion alert tells you movement happened. It does not tell you who moved or what they did.
  • That is why motion sensors work best with cameras.
• Employees are often the first people to notice someone out of place.
  • They might catch fake maintenance claims, badge excuses, shoulder surfing, or suspicious wandering.
  • They are an extra layer, not the whole system.
• Badge and door-sensor records show who appeared to access a door and when.
  • Door sensors can also show how long a door stayed open.
  • Long-open times can suggest piggybacking or tailgating.
  • Common test trap: a valid badge record does not prove the real cardholder used it.

Where Controls Should Go

Placement matters because a bad control location gives weak evidence.

• Cameras
  • Strong locations are ingress and egress points.
  • Think about coverage, angle, lighting, obstructions, likely attacker path, and tampering risk.
  • A few well-placed cameras beat many cameras with blind spots.
• Motion sensors
  • Put them where movement is unexpected, not just where the room is important.
  • Busy lobbies create too many false alarms, and people stop trusting the alerts.
  • Best setup is when the sensor’s area matches a camera’s view.
• Locks and controlled entry
  • Sensitive spaces need locks on all entry points.
  • One unsecured side door weakens the whole design.
  • Access control vestibules help stop piggybacking and tailgating and funnel people past cameras, guards, and badge readers.
• Guards
  • Stationary guards belong at traffic funnels like gates, lobbies, and secure-area entrances.
  • Patrolling guards belong around perimeters and exterior areas.

How Physical Attacks Are Identified

Detection usually follows a chain, moving from the first alert to the asset that may have been affected:

Physical attack investigation flow

1. An indicator appears, such as a motion alert, long door-open event, suspicious person report, or unusual camera activity.
2. Defenders check camera footage.
3. They compare badge logs and door data.
4. They track where the person went.
5. They identify what assets may have been affected.

The strongest pairings are:

• Motion sensor + camera = alert + visual confirmation
• Badge log + door-open time + camera = strong evidence for piggybacking or tailgating

Keep these distinctions clear:

• Alert ≠ confirmed breach
• Valid badge use ≠ legitimate person
• Entry evidence ≠ evidence of actions inside
• Live monitoring helps response, and recordings help investigation

Classic Detection Scenario to Remember

One employee badges into a restricted area. The door stays open much longer than normal. The entrance camera shows a second person entering on that same authorization. Later, a motion sensor triggers in the server room, and interior footage tracks that person there.

That layered evidence tells the story:

• Badge log shows credential accepted
• Door sensor shows unusual open duration
• Entrance camera confirms two people entered
• Interior camera shows route and actions
• Motion sensor flags activity in a low-traffic sensitive area