Topic 2.4 · Unit 2: Securing Spaces · 15 minute session
2.4 Detecting Physical Attacks
Physical attacks are detected by cameras, security guards, motion sensors and alert employees. Placement matters: cameras cover entries and exits and resist tampering, motion sensors go where traffic is unexpected, locks go on every sensitive entry, and guards are stationary at chokepoints or patrol perimeters. Badge logs that show a door held open too long can reveal piggybacking or tailgating.
Big idea Detection controls see the attack, raise the alert and leave a record. They work best when placed well and paired together.
Course and exam description (CED) codes covered: 2.4.A.12.4.A.22.4.A.32.4.A.42.4.B.12.4.B.22.4.B.32.4.B.42.4.C.12.4.C.22.4.C.3
Last reviewed against the CED:
By the end of this session you can
- 2.4.A Identify ways security controls can detect physical attacks.
- 2.4.B Determine effective placement of security controls for detecting physical attacks.
- 2.4.C Apply detection techniques to identify physical attacks.
1. What detects physical attacks (2.4.A)
| Detector | How it helps |
|---|---|
| Cameras 2.4.A.1 | Capture a visual record of malicious activity. Record and monitor the feed; recordings are especially useful in investigations after an incident. |
| Security guards 2.4.A.2 | Watch an area and respond to suspicious activity. |
| Motion sensors 2.4.A.3 | Alert security to movement in an area. |
| Employees 2.4.A.4 | Often the first to notice someone who does not belong, and can alert security. |
2. Placing detection controls (2.4.B)
- Cameras: consider coverage, angle and how easily an adversary could tamper with them, plus what the camera would capture and how that would help. Points of ingress and egress (entries and exits) are common choices 2.4.B.1.
- Motion sensors: place them where traffic is unexpected, such as server rooms or storage for sensitive materials. In busy areas they cause false alarms, and real alerts get ignored 2.4.B.2.
- Locks: on every entry to areas with sensitive information or systems. For the most sensitive areas, an access control vestibule stops piggybacking and tailgating 2.4.B.3.
- Guards 2.4.B.4:
| Stationary guards | Patrolling guards |
|---|---|
| Constant protection of one area, entrance or high-value item | Harder for an adversary to plan around; create time pressure |
| Best where traffic funnels: entry gates, main lobbies, entrances to secure areas | Best for perimeters and exterior areas |
3. Detection techniques in action (2.4.C)
- Cameras give live and recorded footage. With facial recognition software they can alert when an unauthorized person enters a controlled area, and after a breach, defenders use footage to trace the adversary’s path and actions 2.4.C.1.
- Motion detectors work best with cameras: when a sensor fires, defenders check the camera to confirm a real breach 2.4.C.2.
- Badge logs: when a door is unlocked with an electronic badge, a sensor records how long it stays open. A door open longer than normal can signal piggybacking or tailgating 2.4.C.3.
Try reading a real-style badge log below.
Lock it in: memory hooks
One picture per idea. If you remember the hook, you can rebuild the details.
- GuardsStand at the funnel, walk the fence: stationary guards at chokepoints, patrolling guards on perimeters.
- Motion sensorsQuiet rooms only: a sensor in a busy hallway is a boy who cried wolf.
- Badge logsA door open too long is a door used twice.
Common misconceptions
"More motion sensors everywhere means better security."
Not quite. In busy areas they trigger constantly, and people stop taking the alarms seriously. Put them where traffic is unexpected, like server rooms.
"A camera that records is enough."
Not quite. The feed should be recorded and monitored. Monitoring catches attacks as they happen; recordings help investigations afterward.
Simulation · [2.4.C.3]
Log hunt: spot the tailgating in a badge reader log
Entry log for the server room door. The door normally closes about 5 seconds after a badge opens it. Tap every entry that suggests piggybacking or tailgating. Tap each part you think is a red flag. There are 2.
-
Fine. A normal open time for one person walking through.
-
Fine. Normal.
-
Red flag. Open eight times longer than normal. Someone may have held the door for a second person (piggybacking) or a follower slipped in (tailgating).
-
Fine. The reader worked as designed and refused an unauthorized badge. Worth a glance, but the door never opened.
-
Fine. Within the normal range.
-
Red flag. Another long open, right after the same badge already went in. Check the camera footage for this time.
Exam traps
- Motion sensor: the place where nobody should be. Stationary guard: the place everyone must pass.
- A camera that records but is never monitored helps the investigation, but does not stop an attack in progress.
By the numbers
Say each list out loud, then tap to check.
4 detection controls Say them, then tap
- cameras
- security guards (stationary or patrolling)
- motion sensors
- employees
In 30 seconds
- Detectors: cameras (record and monitor), guards (watch and respond), motion sensors (alert on movement), employees (notice strangers).
- Cameras: think coverage, angle, tamper resistance and what they would capture; watch ingress and egress points.
- Motion sensors where traffic is unexpected. Locks on every sensitive entry; vestibules for the most sensitive.
- Stationary guards at chokepoints; patrolling guards on perimeters, harder to plan around.
- Pair motion detectors with cameras to verify alerts. Use facial recognition alerts and footage to track an intruder. Long door-open times in badge logs suggest piggybacking or tailgating.
Cover this list, say the points out loud, then take the checkpoint without scrolling back up.
Checkpoint · 6 questions
Checkpoint: Detecting Physical Attacks
Pick an answer to mark it. Every answer is explained, and you can try any question again. Your saved score counts first tries only, and stays in this browser.
Key terms: flip the cards
Read the term, say the definition out loud, then flip to check. Struggling a little to remember is what makes it stick.
-
Motion sensortap to flip
A detective control that alerts security to movement, best placed where traffic is unexpected and paired with cameras.
Example and CED codes -
Access control vestibuletap to flip
A small entry space with two doors that lets one authorized person through at a time, so nobody can be admitted with them.
Example and CED codes -
Piggybackingtap to flip
A physical attack where the adversary uses social engineering to get an authorized person to let them into a restricted area.
Example and CED codes -
Tailgatingtap to flip
A physical attack where the adversary follows close behind an authorized person into a restricted area without that person noticing.
Example and CED codes -
Security controltap to flip
A safeguard that protects confidentiality, integrity or availability, classified by type (physical, technical, managerial) and function (preventative, detective, corrective).
Example and CED codes
Questions students ask
Where should motion sensors be placed?
In areas where traffic is unexpected, such as server rooms or storage for sensitive materials. In high-traffic areas they cause false alarms that people start to ignore.
How can a badge log reveal tailgating?
The door sensor records how long the door stayed open after each badge swipe. A door open much longer than normal suggests a second person came through.
What is the difference between stationary and patrolling guards?
Stationary guards constantly protect one area, entrance or item and work best at places that funnel traffic. Patrolling guards are harder to plan around, create time pressure for adversaries, and suit perimeters and exterior areas.