Topic 2.3 · Unit 2: Securing Spaces · 15 minute session
2.3 Protecting Physical Spaces
Physical spaces are protected with managerial controls, such as security awareness training and a workstation security policy, and with physical and technical controls such as fences and bollards, locks, card readers, access control vestibules and turnstiles, disabled Universal Serial Bus (USB) ports and uninterruptible power supplies (UPS). Organizations prioritize mitigations by the severity of each risk and the cost of the fix.
Big idea Match the control to the vulnerability: how could an adversary use this weakness, and how do we prevent, detect or correct the attack?
Course and exam description (CED) codes covered: 2.3.A.12.3.A.22.3.B.12.3.B.22.3.B.32.3.B.42.3.B.52.3.B.62.3.B.72.3.B.8
Last reviewed against the CED:
By the end of this session you can
- 2.3.A Identify managerial controls related to physical security.
- 2.3.B Determine mitigation strategies for risks from physical vulnerabilities.
1. Managerial controls for physical security (2.3.A)
Security awareness training teaches employees how they keep the organization safe 2.3.A.1:
- detecting social engineering attempts such as phishing
- not badging other people into restricted areas
- preventing device theft
A workstation security policy sets out how to protect a physical workplace. It may have tiers depending on the data a workstation handles 2.3.A.2. Policies often require:
- locking devices before leaving them unattended
- clearing sensitive documents away (a clean desk policy)
- a privacy screen filter or other barrier so others cannot read the screen
- plugging devices into surge protectors or an uninterruptible power supply (UPS)
2. Choosing mitigations (2.3.B)
To pick a control, a defender asks how an adversary could use the vulnerability, then how to prevent, detect or correct that attack 2.3.B.1.
| Control | What it does | Stops |
|---|---|---|
| Fences, gates, bollards 2.3.B.2 | Deter adversaries from trying to reach the building | Unauthorized approach |
| Locks on doors, server cabinets and computers 2.3.B.3 | Prevent devices from being accessed or stolen | Theft, tampering |
| Card readers 2.3.B.4 | Record which badge opened which entry and when, and deny unauthorized badges | Unauthorized entry |
| Access control vestibules and turnstiles 2.3.B.5 | Stop an authorized person from admitting an unauthorized one, on purpose or by accident | Piggybacking, tailgating |
| Disabled USB ports 2.3.B.6 | Stop external drives from loading malware | Malware on external drives |
| UPS and power generators 2.3.B.7 | A UPS keeps a device running in a power outage; generators power a building or critical devices | Power disruption |
Prioritize by the severity of each risk and the cost of the mitigation 2.3.B.8.
Case file: the library makerspace
The makerspace has 3D printers, a shared laptop with student design files, and a back door to the loading dock that is often propped open. Ranked plan: lock the back door and fit a closer (high risk, low cost), lock the laptop to the bench with a cable and set an auto-lock (moderate, low cost), then consider a card reader on the main door later (moderate, higher cost).
Lock it in: memory hooks
One picture per idea. If you remember the hook, you can rebuild the details.
- Workstation policyLock, clear, screen, plug: lock the device, clear the desk, use a privacy screen, plug into surge protection or a UPS.
- Choosing a controlThink like the adversary first: how would they get in, and what would prevent, detect or correct it?
Common misconceptions
"A card reader alone stops tailgating."
Not quite. A card reader denies unauthorized badges and records who entered, but a follower can still slip through an open door. Access control vestibules and turnstiles stop one badge admitting two people.
"A clean desk policy is about tidiness."
Not quite. It means clearing sensitive documents away before leaving a workstation, so nobody can read or take them.
Exam traps
- "Which control would best mitigate...?" Find the exact attack first. A camera records piggybacking; a vestibule prevents it.
By the numbers
Say each list out loud, then tap to check.
2 managerial controls Say them, then tap
6 controls for physical risks Say them, then tap
- fences
- gates and bollards
- locks
- card readers
- vestibules and turnstiles
- disabled USB ports
- UPS and generators
In 30 seconds
- Security awareness training teaches staff to spot phishing, not badge others in, and prevent device theft.
- Workstation policies: lock devices, clear sensitive papers (clean desk), privacy screens, surge protectors or UPS. Tiers can depend on the data handled.
- Fences, gates and bollards deter. Locks prevent access and theft. Card readers log and deny badges. Vestibules and turnstiles stop one person admitting another.
- Disable USB ports against malware drives. A UPS or generator keeps power on.
- Prioritize by risk severity and mitigation cost.
Cover this list, say the points out loud, then take the checkpoint without scrolling back up.
Checkpoint · 6 questions
Checkpoint: Protecting Physical Spaces
Pick an answer to mark it. Every answer is explained, and you can try any question again. Your saved score counts first tries only, and stays in this browser.
Key terms: flip the cards
Read the term, say the definition out loud, then flip to check. Struggling a little to remember is what makes it stick.
-
Security awareness trainingtap to flip
Training that teaches employees to detect social engineering, avoid badging others in and prevent device theft.
Example and CED codes -
Workstation security policytap to flip
A policy that sets the measures for protecting a physical workplace, such as locking devices, clearing sensitive papers, privacy screens and power protection.
Example and CED codes -
Access control vestibuletap to flip
A small entry space with two doors that lets one authorized person through at a time, so nobody can be admitted with them.
Example and CED codes -
Uninterruptible power supply (UPS)tap to flip
A battery backup that keeps a device running during a power outage; generators provide power at larger scale.
Example and CED codes -
Bollardtap to flip
A short, sturdy post that stops vehicles from reaching a building entrance or area.
Example and CED codes -
Security controltap to flip
A safeguard that protects confidentiality, integrity or availability, classified by type (physical, technical, managerial) and function (preventative, detective, corrective).
Example and CED codes
Questions students ask
What is an access control vestibule?
A small entry space between two doors that lets only one authorized person through at a time, so an authorized person cannot intentionally or accidentally admit someone else into a restricted area.
What does a workstation security policy require?
Typically: lock devices before walking away, clear sensitive documents off the desk, use a privacy screen filter, and connect devices to surge protectors or an uninterruptible power supply.
How do organizations choose which physical risks to fix first?
They weigh the severity of each risk against the cost of the recommended mitigation.