Every technical control in this course assumes the attacker is somewhere else. Firewalls, MFA and encryption matter much less once someone can stand at a server rack, pull a drive, or plug a small device into an open switch port in a wiring closet.
On the CompTIA Security+ SY0-801 exam, objective 2.3 lists locks and keys, access vestibules and access passes among the physical threat vectors, so you need to know how these controls work and how attackers get around them. Physical security is also one of the control categories in objective 1.1, and surveillance footage appears as investigation data in objective 4.8. This lesson walks through the layers of physical protection, the common bypass for each, and how exam questions frame them.
Physical security works in layers from the property line to the rack
Physical protection is designed as a series of rings. Each ring should slow an intruder down or raise an alarm before they reach the next one.
- The perimeter: fencing, gates, bollards, lighting and signage around the site.
- The building entrance: locked doors, badge readers, reception, guards and access vestibules.
- Internal zones: separate access for server rooms, wiring closets, records storage and executive areas.
- The equipment itself: locked racks and cages, cable locks on laptops, port blockers and tamper-evident seals.
At the perimeter, fencing marks the boundary and delays a person on foot. A commonly cited rule of thumb is that 3 to 4 feet deters casual trespassers, 6 to 7 feet is hard to climb, and 8 feet topped with barbed wire deters determined intruders. Bollards are short, sturdy posts that stop vehicles, not people. They protect entrances and lobbies from a car driven into the building, by accident or on purpose.
The control types from the controls section apply here too. Warning signs and visible cameras are deterrent, locks and bollards are preventive, motion sensors are detective, and a guard posted because the badge system is down is compensating. Many physical controls serve two types at once, which is why exam questions ask for the BEST fit.
Locks buy time, and every lock type has a known bypass
No lock stops an attacker forever. Treat every lock as delay, and pair it with an alarm and a response that arrives before the delay runs out.
Mechanical locks with keys are the most common and the easiest to defeat:
- Picking and raking manipulate the pins of a standard pin tumbler lock with simple tools.
- Bumping uses a specially cut bump key, tapped while turning, to jolt the pins and open the lock in seconds.
- Shimming slides thin metal into a padlock to release the shackle, and latch slipping pushes a card or tool against a spring latch that has no deadlatch to block it.
- Key copying needs only a clear photo of a key or a few minutes alone with it, and a lost master key compromises every door it opens.
Defenses include high-security cylinders that resist picking and bumping, restricted keyways whose blanks aren't sold to the public, deadbolts and latch guards, non-removable hinge pins on outward-opening doors, and key control: an inventory of who holds which key, and rekeying when a key is lost or not returned.
Electronic locks remove the physical key but add their own weaknesses. A keypad code can be watched as it's typed, and worn buttons reveal which digits it uses. Many electronically locked doors have a request-to-exit motion sensor inside that unlocks the door when someone approaches, and testers have opened such doors from outside by pushing an object through the gap to trip it.
Electronic locks also have to decide what happens when power fails. A fail-safe lock unlocks, which protects people during a fire or outage. A fail-secure lock stays locked from the outside, which protects assets. Fire and building codes require that people can always get out, so exit doors are fail-safe or have mechanical egress hardware, while a server room door can usually be fail-secure. On the exam, fail-safe favors people and fail-secure favors assets.