4.2.1. Physical Access Controls

💡 First Principle: Physical access control follows defense-in-depth—multiple layers of barriers between an attacker and the target. Each layer must be defeated independently, making unauthorized access progressively harder.

Physical Access Control Layers (Outside to Inside)

Control Types

• Bollards: Reinforced posts that prevent vehicle ramming attacks. Required near public-facing facilities.
• Fencing: Physical perimeter barrier. Security value depends on height and construction.
• Security guards: Human monitoring and response. Can exercise judgment that automated systems cannot.
• Security cameras (CCTV): Deterrence and evidence. Cameras without monitoring/recording have limited value.
• Locks: Basic physical barrier. Types range from keyed locks to electronic (card reader), biometric (fingerprint, retina), and RFID.
• Mantraps (access traps): Two-door interlocks where the second door doesn't open until the first closes and the person is authenticated. Prevents tailgating (following an authorized person through a secure door).
• Biometric controls: Authentication based on physical characteristics (fingerprint, retina, facial recognition). Higher assurance than cards but more expensive and raises privacy concerns.
• RFID access cards: Common for data center access. Can be cloned if not properly protected; should be combined with PIN for high-security areas.

Architectural Reinforcements

• Signal blocking (Faraday cage elements): Prevents wireless signals from entering or leaving a secure area—protects against wireless eavesdropping and remote attacks.
• Reflective glass: Prevents visual observation from outside.
• Data center camouflage: Non-obvious building appearance to reduce targeted attacks.

⚠️ Exam Trap: A mantrap prevents tailgating but not identity theft. If an attacker steals a valid access card, the mantrap doesn't help. Mantraps are most effective when combined with biometrics or PIN, so card theft alone isn't sufficient for entry.

Reflection Question: An employee holds the data center door open for a colleague who forgot their access badge. The colleague is a legitimate employee. What physical security control does this violate, and what is the security risk?