2.3 - Protecting Physical Spaces
Managerial Controls for Physical Security
Managerial controls are the policies and procedures that set security expectations and guide how employees behave.
Security Awareness Training
Employees are both the weakest link and the strongest defense, depending on how aware they are.
What training should cover:
Spotting social engineering attempts, like recognizing phishing emails asking for credentials or urgent action, identifying sketchy phone calls from people claiming authority, and questioning unusual requests even from sources that seem legit.
Preventing unauthorized physical access, like never badging someone else into a restricted area no matter how legitimate their reason seems, always verifying identity before granting access, challenging unfamiliar people in secure areas, and reporting any tailgating or piggybacking attempts.
Protecting against device theft, like using cable locks, never leaving devices unattended in public, securing devices when stepping away, and reporting missing equipment right away.
Example: employees watch a training video showing someone carrying boxes toward a secured door asking "can you grab that for me?" The training explains this is piggybacking, shows the right response (politely asking the person to badge in themselves), and reinforces that politeness shouldn't override security procedure. It normalizes saying something like "sorry, but company policy says everyone has to use their own badge."
Regular training, ideally quarterly or twice a year, reinforces these concepts and keeps up with new threats. Phishing simulations and physical security tests like attempted tailgating help identify who needs more training and measure how well the program is working.
Workstation Security Policies
A workstation security policy is a managerial control that spells out the measures employees must take to protect their physical workspace: the computer, the desk, and the documents on it. It can set different tiers of workstation security based on the type of data handled at each workstation, and most policies include the rules below.
Tiered security levels based on how sensitive the data is: standard workstations with general corporate data, sensitive workstations handling customer PII or financial data, and highly sensitive workstations in HR, finance, legal, or executive areas.
Locking devices when unattended stops anyone from accessing an active session. On Windows that's Windows key plus L, on Mac it's Control, Command, Q, and most systems also auto-lock after 5 to 15 minutes of inactivity.
Example: an employee steps away without locking their computer. A coworker notices the unlocked screen showing an open inbox, locks it, and reminds them about policy. That kind of peer reinforcement helps build a security-conscious culture. Leaving a workstation unlocked lets anyone read confidential emails, send messages as that person, access systems with saved logins, install malware, or copy data to a USB drive.
Clean desk policy means sensitive documents get put away before you leave your desk. That means filing documents in locked drawers, never leaving printed customer data or financial records out in view, shredding rather than trashing sensitive paperwork, and clearing whiteboards before leaving a conference room.
Example: a law firm adopts a clean desk policy after a client visiting for a meeting spotted confidential files belonging to a different client sitting on an attorney's desk. Now all client files must be locked away any time attorneys step out, even briefly, and security does after-hours audits, with violations requiring retraining. Leaving documents visible invites shoulder surfing by cleaning staff or visitors, photographing sensitive info, or casual info gathering during a tour, and can even lead to dumpster diving if things get thrown out carelessly.
Privacy screen filters limit how far off-angle someone can view a screen, usually to about 60 degrees straight ahead, so anyone looking from the side just sees a dark blur. These make sense in public-facing areas like reception, for laptops used in coffee shops or on planes, for sensitive data in open floor plans, and in healthcare settings where HIPAA requires protecting patient info.
Example: a financial analyst works on unreleased quarterly earnings in an open office. Without a privacy screen, anyone walking by could read the confidential numbers. With one installed, only the person directly in front of the screen can actually see it clearly.
Surge protectors and UPS (uninterruptible power supplies): surge protectors guard against voltage spikes that could fry equipment or corrupt data, while a UPS is a battery backup that keeps things running briefly during an outage so systems can shut down properly instead of just dying. Policy should require every workstation to at least have a surge protector, with UPS for anything running critical operations, and servers and network gear need UPS with enough capacity for a proper shutdown.
Example: a lightning strike causes a power surge. Workstations plugged into surge protectors keep running fine since the protectors absorb the spike, while ones plugged straight into the wall suffer motherboard damage that needs replacing. That surge protector policy ends up saving the company $45,000 in replacement costs.
Figuring Out Effective Mitigation Strategies
Thinking Like an Attacker
To pick the right controls, defenders need to actually understand how attackers exploit weaknesses, which means threat modeling: identify the asset that needs protecting, figure out who might target it and why, map out possible paths to reach it, note what controls already exist along each path, spot where those controls are missing or weak, and then put preventative, detective, or corrective controls in place to close those gaps.
Example: for a server room holding a customer database, possible adversaries include external attackers after the data, insider threats, and opportunistic criminals. Possible attack paths include piggybacking through the main entrance, sneaking in through an unsecured loading dock, or using compromised credentials to badge in after hours. Existing controls include badge access at the main entrance and lobby cameras, but the server room lock is often propped open and there's nothing covering the loading dock, no cameras at the server room, no alert if the door's left open, and no visitor escort requirement. Based on those gaps, the recommendations would be a badge reader at the loading dock, a door alarm for the server room, a camera at the server room entrance, an enforced no-propping-doors policy, and a visitor escort requirement.
Physical Security Controls and Mitigations
Perimeter Controls
Fencing creates a physical boundary that deters unauthorized access. Height matters, generally 6 to 8 feet to deter casual intrusion, or 10+ feet with angled tops or barbed wire for high-security areas, and it can use chain-link, wrought iron, concrete, or anti-climb designs, either around the full perimeter or just around high-value zones.
Example: a data center surrounds itself with 10-foot anti-climb fencing topped with barbed wire, funneling all traffic through a single manned checkpoint. Even a determined attacker could potentially scale it, but the fence deters opportunistic attacks and forces anyone determined to expose themselves at a monitored entry point.
Gates control access points, whether manual gates staffed by security, electronic ones with card readers or keypads, vehicle gates with anti-ramming barriers, or separate pedestrian gates.
Bollards are posts that stop vehicles from reaching pedestrian areas or sensitive zones, useful for protecting entrances from ramming attacks, keeping vehicles off walkways, securing outdoor equipment like generators or fuel tanks, and creating safe zones around high-value targets.
Example: after assessing terrorism risk, a government building installs reinforced bollards at the entrance. Months later, someone tries to ram the entrance with a vehicle, but the bollards stop it 30 feet out, preventing structural damage and protecting the people inside. That physical barrier alone prevented what could've been a disaster.
Perimeter controls aren't impenetrable, but they force attackers to expose themselves at monitored points, increase the time and effort an attack takes, act as a psychological deterrent, and create the outer layer of a bigger layered defense.
Locks and Physical Access Controls
Door locks secure entrances, ranging from traditional key locks (basic but vulnerable to picking and key duplication), to electronic PIN locks (no physical key to lose, codes can be changed), to badge readers (which log access and let you set granular permissions), to biometric locks like fingerprint or facial recognition for high-security spots.
Server rooms and network closets should have locks at minimum, along with sensitive document storage, and executive or finance offices deserve extra security. Locks should be regularly maintained and tested.
Example: an organization swaps traditional key locks on their server room for badge readers. Within a month, audit logs show an employee accessing the server room at 2 AM on weekends, unusual for their role. Investigation reveals they were installing cryptocurrency mining software on company servers, something the old lock's lack of logging would never have revealed.
Card readers (badge readers) do two jobs at once. They deny access to badges that aren't authorized for that entry, and they record which badge was used at which entry and at what time. That record is what made the 2 AM visits above visible, and it's also how piggybacking and tailgating get caught in entry logs (Topic 2.4).
Server cabinet and rack locks add another layer even inside a locked room, so if someone gets past the door, they still can't touch the actual equipment.
Example: during a piggybacking incident, an attacker gets into the server room, but every rack is separately locked with keys held only by senior IT staff, so they can't actually access anything. The layered defense worked even though the room lock itself was bypassed.
Computer locks (cable locks) physically secure devices to something immovable, using things like Kensington locks (a standard slot on most laptops), serialized locks for asset tracking, or alarm locks that trigger if tampered with. These make sense for laptops in open offices, computers in public-facing areas, high-value equipment, and anywhere contractors or visitors have access. They're cheap, $20 to $40 a device, compared to $800 to $2,000 to replace a stolen laptop, so the return on investment is excellent.
Access Control Vestibules and Turnstiles
Access control vestibules (mantraps) are small rooms with two doors, only one of which can be open at a time. A person badges at the outer door, it opens and closes behind them, they badge at the inner door, and the system checks (with weight sensors, cameras, or motion detectors) that only one person is present before letting them through. This stops piggybacking because each person has to individually authenticate, and attempts to sneak two people through trigger alarms and lock both doors.
Example: a high-security research facility uses a mantrap at the entrance to its prototype lab. An attacker tries to tailgate behind an engineer, but the weight sensors detect two people when only one badge was scanned, both doors lock, and guards respond within 30 seconds.
Turnstiles are rotating barriers that let one person through per authentication, ranging from waist-high (low security, can be jumped) to full-height (floor-to-ceiling, high security) to optical turnstiles that use sensors instead of physical barriers. These work well for lobby access, separating public from secure areas, or high-traffic spots like gyms and transit stations.
Example: a corporate HQ uses full-height turnstiles at the main entrance. A visitor tries to squeeze through right behind an employee, but the mechanical design physically only fits one person, forcing the visitor to check in at reception like they were supposed to.
USB Port Controls
USB ports are convenient but risky, since they enable malware installation and data theft. Organizations can physically block ports with covers, use software policies to disable USB storage while still allowing keyboards and mice, whitelist specific approved drives by serial number, or use data loss prevention tools to monitor and control what gets transferred.
Example: a financial services company disables USB ports on workstations handling customer financial data. An employee tries to copy account info to a personal drive, but the system doesn't recognize it since the ports only accept keyboards and mice, preventing what could've been a data breach.
Completely disabling USB can hurt productivity, so organizations often balance it by allowing keyboards and mice but blocking storage, permitting only encrypted company-issued drives, requiring approval for exceptions, or just monitoring rather than fully blocking in lower-risk areas.
Power Redundancy and Protection
A UPS (uninterruptible power supply) is a battery backup that kicks in instantly during an outage, typically running 5 to 30 minutes for workstations and longer for critical servers, allowing systems to shut down gracefully instead of crashing, plus it usually includes surge protection and clean power delivery. Priority for deployment goes to critical servers first, then network infrastructure, then security systems, then critical workstations, with standard workstations last.
Example: a hospital puts UPS on everything in patient care areas. During a 2-hour storm-related outage, the UPS keeps electronic health records, medication dispensing systems, and monitoring equipment running long enough for backup generators to kick in, so patient care continues uninterrupted with no data loss.
Generators provide longer-term backup, whether portable units for specific equipment, standby generators that auto-activate when power fails, or continuous generators that run constantly in places like data centers. A UPS typically bridges the 30 to 60 seconds it takes a generator to start, and then the generator takes over for hours or days.
Example: a data center's UPS handles the instant transition while diesel generators start within 45 seconds and can run indefinitely with fuel resupply. During an 8-hour regional outage, the data center stays fully operational while competitors without that redundancy go down.
Matching Controls to Physical Attacks
When recommending controls, start from the attack or weakness and ask what would prevent it, detect it, or correct it. Common matches:
Attack or weakness | Controls that address it |
Piggybacking and tailgating | Access control vestibules or turnstiles, training employees not to badge others in, cameras and door-open alerts at entries |
Shoulder surfing | Privacy screen filters, locking screens when stepping away, keeping screens out of view of windows and walkways |
Dumpster diving | Shredding sensitive documents, a clean desk policy |
Card cloning | Reporting lost badges right away so they get deactivated, requiring a PIN or fingerprint along with the badge at sensitive doors, reviewing badge logs for unusual use |
Device theft | Cable locks, locked server rooms and cabinets, never leaving devices unattended in public |
Malicious USB drives and keyloggers | Disabling USB ports, locking unattended workstations, limiting who can physically reach the device |
Power disruption | Locks on electrical rooms, surge protectors and UPS for critical devices, generators for the building |
Vehicles reaching entrances | Bollards, gates, fencing |
Natural disasters | UPS and generators for outages, backups kept at another location |
Prioritizing Risk Mitigations
Organizations need to prioritize fixes based on how severe the risk is and how much the fix costs. Critical risks need immediate attention, high risks get addressed within weeks to months, moderate risks within months to a year, and low risks can be accepted or handled when convenient.
Example prioritization: a broken server room lock rated as critical risk ($8,500,000 potential impact) costs just $4,500 to fix, an incredible return on investment, so it becomes immediate priority. Missing perimeter fencing rated as high risk ($2,000,000 potential impact) costs $350,000 to fix, still a strong return, so it becomes a high priority. Missing cable locks on 200 workstations rated as moderate risk ($150,000 potential impact) costs just $6,000, an excellent return, but isn't urgent, so it's medium priority. Sensitive info sometimes left on conference room whiteboards, rated low risk ($25,000 potential impact), costs $3,500 to fix, a decent return, but can be deferred as low priority.
A sensible order might be: server room access control first since it's most critical and cheap, then cable locks since they're quick and low cost, then the bigger fencing project once it's planned and budgeted, and finally the conference room controls after everything more urgent is handled.
Real-world constraints matter too: budgets don't allow fixing everything at once, there's limited staff to implement and maintain controls, some fixes disrupt operations during installation, and compliance requirements sometimes force certain fixes ahead of others regardless of risk score. For example, a healthcare organization might have to prioritize badge readers on medication rooms over a UPS for low-risk admin workstations simply because the former is a compliance requirement, even if both risks look similar on paper.
A good approach balances quick wins, like policy changes, training, cable locks, and USB restrictions, with strategic investments that take more planning, like fencing, access vestibules, or a facility-wide generator system. For example: month one, roll out a clean desk policy and awareness training; month two, add cable locks and privacy screens; months three through six, plan and install a badge reader system; months six through twelve, build an access control vestibule at the main entrance. That way you're getting immediate risk reduction while planning bigger fixes.