Unit Scenarios
Scenario 2A: Securing Xtensr Labs
The Situation
As part of the physical security team at Xtensr Research Labs, the task is assessing a smaller research company's facility that Xtensr just acquired in the same town, reviewing the building plans and current controls, identifying vulnerabilities, assessing risk, and recommending both security controls and detective control placement.
The Building
It's a two-story facility. The first floor has reception, general labs, a break room, and a loading dock. The second floor has the server room, executive offices, and the proprietary research lab. There are 85 employees, and the building operates Monday through Friday, 7 AM to 6 PM.
Current protections include badge access at the main entrance (but only during business hours), a receptionist during business hours, basic locks on some offices, and just 4 cameras covering the lobby and parking lot. The gaps are pretty clear: minimal security after hours, no protection for the server room, and very limited monitoring overall.
Vulnerability 1: Server Room, Uncontrolled Access
The server room on the second floor holds all the research data and customer info, but it's secured with just a standard key lock shared among 15 different IT and facilities staff, with no access logging, no cameras, and it's often propped open during IT work for convenience. Anyone with the key has unaccountable access, and the propped door lets anyone slip in unnoticed. This is a critical risk. The asset value is critical, holding years of proprietary research, customer PII, backups, and network infrastructure. The likelihood is high given how many people have keys, how often the door is propped, and the total lack of monitoring. The potential impact is severe, a full data breach potentially worth $8,000,000 or more once you factor in stolen research, competitor advantage, and regulatory fines.
Vulnerability 2: After-Hours Building Access
The main entrance badge system shuts off after 6 PM, but a side door stays unlocked until 10 PM for facilities staff, with no guard presence and no camera on that entrance, and weekends have no badge system active at all. This is a high risk. The asset value is high, since the entire facility becomes accessible. Likelihood is medium, since it requires someone physically showing up during off-hours in a business district with some foot traffic. Impact is high, covering potential equipment theft ($200,000+ in lab gear), data theft if the server room gets reached, and sabotage risk, with nothing catching it until Monday morning at the earliest.
Vulnerability 3: Proprietary Research Lab, Weak Access Control
This second-floor lab holds the company's most valuable intellectual property, but it's secured with just a standard key shared among 8 senior scientists, no two-person rule, no logging, no cameras inside or out, and hallway windows that make shoulder surfing possible. This is a critical risk. Asset value is critical given next-gen formulas, experimental methods, and patent-pending processes worth an estimated $15,000,000 or more. Likelihood is medium, since it would take an insider or a sophisticated social engineer, but 8 separate key holders means 8 separate points of potential compromise. Impact is catastrophic, potentially wiping out years of R&D and competitive advantage if stolen.
Vulnerability 4: Loading Dock, Unmonitored Access Point
The rear loading dock has a roll-up door with no access control, opening 3 to 4 times a day for deliveries, providing direct internal access whenever it's open, with no cameras and no sign-in process for delivery personnel. This is a moderate risk. Asset value is moderate, providing entry to the ground floor and stairwell access upstairs. Likelihood is medium, since it requires timing with predictable delivery schedules and carries some risk of being noticed by staff. Impact is moderate, mostly an initial foothold or a path toward more sensitive areas, plus potential theft during deliveries.
Vulnerability 5: Reception Area After Hours
The receptionist's computer connects to the internal network with working USB ports, and after the receptionist leaves at 5 PM (and the badge system deactivates at 6 PM), anyone can walk up to that desk, with the computer often left logged in overnight. This is a moderate risk. Asset value is moderate, since the computer itself isn't valuable but the network access it provides is. Likelihood is medium, requiring the after-hours side door vulnerability plus the receptionist leaving the computer logged in. Impact is moderate to high, opening the door to network compromise, lateral movement, and malware spread.
Recommended Fixes
Server room hardening (critical priority, week 1, about $8,500): add a badge reader with fingerprint biometrics limited to 5 authorized IT staff with full logging, lock individual server racks with keys held only by the IT director and CISO, add a door sensor that alerts if the door stays open more than 5 minutes, install two cameras (one on the door, one inside) with 90 days of retention and real-time monitoring, enforce a written policy against propping the door open, and consider a mantrap-style access vestibule as a longer-term phase 2 addition.
After-hours access control (high priority, weeks 2 to 3, about $12,000 plus ongoing guard costs): enable 24/7 badge access at all entrances with role-based permissions, add a badge reader to the side door, contract security guards for evenings and weekends, and add exterior motion sensors tied into an alarm system.
Proprietary research lab (critical priority, weeks 1 to 2, about $11,000): require both a badge and a fingerprint for entry, limited to the 5-person project team, enforce a two-person rule so no one accesses the lab alone, add three cameras with 180 days of retention given the sensitivity, apply one-way privacy film to hallway windows, and eventually add a mantrap for the highest level of protection. Also add no-cost policies: no documents left out unattended, lab notebooks locked away, whiteboards photographed and erased after sessions, no personal phones or cameras allowed, and USB ports disabled on lab machines.
Loading dock security (moderate priority, week 3, about $6,500): add a badge reader on the internal door so delivery personnel stay contained to the dock, require sign-in with photo ID and an escort requirement to go further, add three cameras covering the exterior, interior dock, and hallway, and coordinate delivery schedules in advance so unexpected deliveries require verification.
Reception area protection (moderate priority, week 2, about $1,800): disable USB storage devices via group policy while still allowing keyboard and mouse, set a 5-minute auto screen lock, add a cable lock for the computer itself, put the reception computer on an isolated network segment with no access to internal file servers or databases, and relocate the visitor badge printer behind the desk so visitors can't reach it.
Detective Control Plan
A full camera system of 18 cameras (about $21,600) covering exterior entrances, parking, and the perimeter, entry and exit points like the lobby and stairwells, and sensitive areas like the server room, research lab, and executive hallway, all in 4K with night vision, 90 to 180 day retention depending on sensitivity, real-time monitoring, and facial recognition alerts for unauthorized people.
Eight motion sensors (about $4,000) in low-traffic areas like the server room, research lab, executive offices after hours, network closet, and loading dock interior, each tuned to alert appropriately (immediately for the server room, only outside scheduled hours for the lab, after 6 PM for executive offices, and after 5 PM plus weekends for the loading dock), with every alert visually verified by camera before dispatching a guard, which cuts down false alarms significantly.
Badge access control (about $15,000) requiring 24/7 badging at every entrance, biometrics added for the server room and research lab, plus analytics like door duration monitoring, impossible travel detection, after-hours alerts, and failed attempt logging.
Guard deployment mixes a stationary guard at reception during business hours handling visitors and monitoring cameras, with a roaming patrol guard after hours and on weekends doing exterior checks every 30 minutes and interior sweeps every hour on an unpredictable schedule, responding to alerts and verifying entry points are secure, running about $120,000 a year through a contracted service.
Putting It All Together
The critical risks are the server room and the research lab, needing immediate attention. The high risk is after-hours access, needing action within 30 days. The moderate risks are the loading dock and reception area, addressable within 90 days.
A phased rollout looks like: weeks 1 to 2 tackling the critical vulnerabilities (about $19,500), weeks 3 to 4 tackling the high risk plus starting the guard contract (about $18,500 plus ongoing costs), and months 2 to 3 adding enhanced controls like access vestibules and expanded cameras (about $45,000). All told, that's roughly $83,000 upfront plus $120,000 a year in ongoing guard costs, protecting over $25,000,000 in assets and potentially preventing a $10,000,000+ breach, meaning the investment is under 1% of the assets it protects annually.
On top of the physical controls, recommended policies include a clean desk policy for research materials and whiteboards, an escort policy requiring all visitors to be accompanied, quarterly access reviews with immediate removal of access for departed employees plus monthly log audits, and clear incident response procedures for physical breaches.
Bottom line: the facility has critical gaps in the server room and research lab needing immediate attention, plus a high risk from after-hours access and moderate risks at the loading dock and reception area. The proposed $83,000 initial investment plus $120,000 a year protects over $25 million in assets and heads off potentially multi-million dollar breach scenarios, with critical fixes done within 2 weeks and everything else within 90 days. These improvements also help position the company for certifications like SOC 2 and ISO 27001, which supports business growth and customer trust. Next step is presenting this to leadership for budget approval and kicking off phase 1 right away.