2.4 - Detecting Physical Attacks
Detective Security Controls for Physical Spaces
Detective controls spot incidents as they happen so a response can follow quickly.
Security Cameras
Cameras record who enters areas, what they do, and when, while also deterring casual attacks just by being visible. To actually be useful, cameras need to record footage (not just show a live feed), with retention long enough to catch incidents after the fact, typically 30 to 90 days. Someone also needs to be actively watching or periodically reviewing the footage, since an unmonitored camera only helps after the fact once you already know something happened. Coverage needs to be adequate, with enough resolution to actually identify people and actions.
Example: a data center has cameras at the server room entrance with 90 days of retention. Three weeks after unauthorized configuration changes are discovered on production servers, security reviews the footage and finds a contractor entering the server room on that date, someone whose badge only authorized network closets, not server rooms, meaning they piggybacked in behind an employee. Without that footage, there'd have been no way to know how the breach happened or who did it.
Security Guards
Guards bring human judgment, adaptability, and the ability to respond immediately, things automated systems can't do on their own. They can tell the difference between suspicious behavior and normal unusual activity based on context, confront people directly, verify identities, adapt to unexpected situations, and simply deter casual attacks through their visible presence, all while multitasking as monitors, access controllers, and visitor assistants.
Example: a guard at reception notices someone carrying a laptop trying to leave quickly without signing out. The guard asks to check the asset tag against the visitor log, the person gets nervous, claims they forgot something in their car, and leaves without the laptop. That attentiveness prevented a theft that an automated system wouldn't have caught.
Motion Sensors
Motion sensors detect movement in areas that should be empty, using passive infrared (detects body heat), microwave (detects reflections off moving objects), or dual-technology sensors combining both to cut down false alarms. They can trigger audible alarms, silent alerts to security, or automated lockdowns.
Example: a server room's motion sensor triggers at 11:30 PM on a Saturday, when the room should be empty. Security checks the camera and sees an unauthorized person trying to access the servers. Guards respond within 2 minutes and catch the intruder, all thanks to that initial motion alert.
Employee Awareness and Reporting
Employees often notice unauthorized people or odd activity before anyone else does, since they know what's normal for their own areas and spend time in spots security doesn't constantly watch. For this to actually work, employees need training on what suspicious activity looks like, a simple way to report concerns without feeling like they're "bothering" anyone, a culture that welcomes reporting even when it turns out to be nothing, and recognition for those who do speak up.
Example: an admin notices someone unfamiliar using a conference room after hours, claiming to be from "the IT vendor" doing network upgrades. Remembering her security training, she calls security instead of assuming it's fine. Security confirms no vendor work was scheduled, and it turns out to be an attacker who'd piggybacked into the building. Her awareness stopped a potential breach.
Common things employees notice: unfamiliar people in restricted areas, someone trying doors without a badge, people photographing facilities or equipment, unusual questions about security or system locations, tailgating attempts, or missing or moved equipment and documents.
Strategic Placement of Detective Controls
Camera Placement
Priority locations include all entry and exit points, hallways leading to sensitive areas, server rooms and network closets, spots storing valuable equipment or documents, parking lots and perimeter areas, and reception or lobby areas.
Positioning matters too: wide angles cover more ground but lose facial detail, narrow angles capture more detail at specific spots like doorways, cameras should be mounted high enough to avoid tampering but low enough to still capture faces well, and overlapping coverage from multiple angles avoids blind spots. Cameras should be tamper-resistant, mounted out of easy reach, and placed so that disconnecting one is immediately noticeable, with adequate lighting or night vision for round-the-clock use.
A quick checklist for any camera spot: coverage (what area it sees, and whether there are blind spots), angle (whether it catches faces and actions clearly), tampering (whether an adversary could reach, block, or unplug it), and value (what it could catch an adversary doing there, and how that footage would help). Points of ingress and egress, the places where people enter and exit, are almost always on the list, since everyone has to pass through them.
Example placement: a corporate office puts cameras at every exterior door at eye level for facial detail, a wide lobby camera plus a focused one on reception and one covering the elevators, two at the server room (one on the door, one inside), two covering the hallway to executive offices, and two at the loading dock (one exterior, one interior). This ensures every entry to a sensitive area is documented and movement can be traced.
The value of a camera depends on what it can actually capture. A server room entrance camera is high value since it shows who accessed critical systems and whether multiple people entered on a single badge swipe. A camera on an unremarkable conference room is lower value unless that room connects to something more sensitive. With a budget for 20 cameras, a reasonable priority order is entry and exit doors first, then server room and network closet entrances, then hallways toward sensitive departments, then the parking lot, then the loading dock, deferring general office areas and break rooms.
Motion Sensor Placement
The best spots for motion sensors are places with naturally low traffic where any movement is worth investigating, like server rooms (should have zero traffic outside maintenance windows), network closets, document storage, executive offices after hours, and secure labs.
Example: a server room's motion sensor is expected to trigger during business hours when IT accesses it, verified via camera, but after 6 PM or on weekends any alert means unauthorized access and gets investigated immediately. Over six months, three alerts occur, two turning out to be legitimate emergency maintenance and one a cleaning contractor who wandered into the wrong room.
Motion sensors in high-traffic areas backfire, since constant legitimate movement triggers so many false alarms that security starts ignoring them entirely, a problem called alert fatigue. For example, sensors in a main hallway might trigger 200+ times a day from people just walking to meetings or the bathroom, and eventually a real intrusion gets dismissed as just another false alarm. The fix is to reserve motion sensors for low-traffic areas where an alert actually means something.
Lock Placement Priorities
Top priority goes to critical systems like server rooms, network closets, power rooms, and security control rooms. Next comes sensitive data like document archives, file rooms, executive offices, and HR or legal areas. After that comes valuable assets like equipment or inventory storage. The most sensitive spots deserve access control vestibules to prevent piggybacking and tailgating entirely.
Example: a research facility uses basic electronic locks with badge access for general offices, badge access plus cameras for labs with proprietary research, and a full mantrap system for the lab storing its most valuable IP, ensuring only one person can enter per badge swipe with perfect accountability. This layered approach balances real security needs with everyday practicality, since not every door needs maximum protection, but the most sensitive ones absolutely do.
Security Guard Placement
Stationary guards work best at traffic funnels where all access flows through one point, like main entrances, security checkpoints, reception desks, or entrances to highly restricted areas, and also directly protecting high-value assets like server rooms or executive floors.
Example: a financial firm stations a guard at the main lobby entrance, verifying every visitor's identity, calling hosts for authorization, issuing temporary badges, and monitoring sign-ins. Since there's no other way in, this single checkpoint effectively controls all building access.
Patrolling guards move on unpredictable routes, which makes it hard for an attacker to time anything around them, puts pressure on attackers who don't know when a guard might show up, and lets a single guard cover much more ground than staying in one spot. This works especially well for perimeters, parking areas, and campuses with multiple buildings.
Example: a manufacturing campus with five buildings across 20 acres uses two roaming guards on unpredictable routes instead of five stationary ones, checking doors, watching parking, and verifying fencing, making it very hard for anyone to time an attack around them.
A lot of organizations combine both: stationary guards at the main entry points, with patrols covering the wider facility.
Applying Detection Techniques
Camera-Based Detection
In real time, security personnel watch for things like people trying locked doors without badges, someone following closely behind another person through a secure door, loitering near entrances, attempts to disable cameras or security gear, repeated failed badge attempts, or activity in areas that should be empty.
Example: an operator watching camera feeds sees someone repeatedly fail to badge into the server room, then look around and try forcing the door open. Guards respond immediately and intercept a contractor who wasn't authorized for that area.
For forensic investigation after an incident, the process is: figure out the timeline of the incident, find which cameras cover the relevant areas, review the footage before, during, and after, trace the attacker's path across different camera views, and document everything into a clear timeline with images for identification.
Example: after documents go missing from an executive's office, security traces someone in a janitorial uniform entering the building at 2:15 PM, walking toward the executive offices at 2:22, entering the office while the employee briefly stepped out at 2:25, leaving with papers under a clipboard at 2:27, and exiting the building at 2:31. That footage gives law enforcement everything needed to identify and arrest the person.
Facial recognition can automate a lot of this by comparing faces against watchlists of unauthorized people, alerting when someone doesn't match any known employee or visitor, flagging VIPs for enhanced protocols, and automatically logging who entered where and when.
Example: an R&D floor with facial recognition immediately flags a former employee, terminated two months earlier, trying to enter with a cloned badge. The system locks the doors and alerts security before he can access anything, catching what badge access alone would've missed. That said, facial recognition raises real privacy concerns, so organizations need to disclose its use, follow applicable laws, protect biometric data properly, and set clear retention policies.
Motion Detector and Camera Integration
Pairing motion sensors with cameras lets security visually confirm an alert before responding, cutting down on false positives from things like cleaning staff or equipment vibrations, prioritizing response toward verified threats, and still documenting everything on camera even when no immediate response happens.
Example: a motion sensor triggers at 9:45 PM, and the camera shows an IT administrator doing legitimate emergency maintenance. Security calls to confirm, logs it, and no guard is dispatched. Compare that to a different server room where a 2:15 AM trigger shows an actual unauthorized person, prompting an immediate guard response. Advanced systems can even automatically pull up the associated camera feed the moment a motion sensor triggers.
Badge Access Analytics for Piggybacking Detection
Electronic access systems log every badge use, and analyzing how long doors stay open or how access patterns look can reveal piggybacking or tailgating. A normal door open time is about 2 to 5 seconds, so anything in the 8 to 15+ second range suggests more than one person came through, or someone held the door open.
Example: an access log shows a badge used at 6:45 AM with the door staying open for 14 seconds, way longer than the usual 3. Camera footage shows the employee held the door for two other people who never badged, one an authorized developer who forgot their badge, and one an unauthorized visitor. Without checking door duration, this would've gone unnoticed. Modern systems can automatically alert when doors stay open past a set threshold, and thresholds can vary by location, tighter for server rooms, looser for general offices where people might be carrying things.
Other useful analytics include catching "impossible travel," like a badge used at two far-apart buildings within minutes of each other, which points to a cloned badge, flagging unusual after-hours access, like a marketing employee's badge showing up at the server room at 11 PM on a Saturday, and watching for repeated failed access attempts, which could mean a lost or stolen badge being tested, an employee overreaching their access, or a partially failed cloning attempt.
An access anomaly report might flag something like a badge with a 16-second door open time at a server room late at night for camera review, a badge that shows impossible travel between two distant buildings for investigation into potential cloning, another badge with dozens of failed attempts at an executive floor entrance to check whether it's malfunctioning or unauthorized, and a badge accessing the data center for the first time ever at nearly 3 AM to confirm whether legitimate maintenance actually happened. This kind of analytics-driven approach catches patterns that would be totally invisible without systematically reviewing access data.
Reading an entry log: here's what a short log for one server room door might look like. The normal open time for this door is 3 to 5 seconds.
Time Badge Employee Result Door open (sec) 08:02:14 4471 A. Patel GRANTED 4 09:47:30 4518 R. Kim GRANTED 3 12:31:05 4471 A. Patel GRANTED 14 13:10:42 5236 D. Lopez DENIED 0 13:10:55 5236 D. Lopez DENIED 0 13:11:09 5236 D. Lopez DENIED 0 23:48:17 4518 R. Kim GRANTED 4
12:31: the door stayed open 14 seconds, about three times normal, so someone may have piggybacked or tailgated in behind A. Patel. Pull the camera footage for that door at 12:31 and count how many people went in.
13:10 to 13:11: one badge was denied three times in under 30 seconds. That could be an employee trying to get into an area they aren't authorized for, or someone testing a lost or stolen badge. Check the camera and follow up with D. Lopez.
23:48: the entry itself looks normal, but it's almost midnight. Confirm whether R. Kim had scheduled maintenance. If R. Kim wasn't there, the badge may have been cloned.