What is a physical control?
A physical control protects the tangible world: land, buildings, rooms, racks, devices and the people inside them. Fences, locks, bollards, badge readers, access control vestibules, cameras, alarms and lighting are physical controls. It is one of the four Security+ control categories, with technical, managerial and operational. Safeguards for the conditions equipment runs in, such as fire suppression, cooling and power protection, are often grouped with them as physical/environmental controls.
Examples by layer
| Layer | Physical controls |
|---|---|
| Perimeter | Fencing, gates, bollards, lighting, signs |
| Building entry | Door locks, badge readers, turnstiles, access control vestibules |
| Interior | Locked server rooms and wiring closets, door and motion sensors, CCTV |
| Equipment | Locked racks and cages, cable locks, USB port blockers, tamper-evident seals |
| Environment | Smoke detection, fire suppression, HVAC, water sensors, UPS units and generators |
Why physical controls matter for cybersecurity
Most technical controls assume the attacker is somewhere else. A person standing at a server can boot it from a USB stick, pull its drives, or plug a small device into an open switch port in a wiring closet. A laptop left in a car can be stolen with everything on it. Physical controls keep attackers from getting that close, and full-disk encryption is the technical backstop when they fail.
Electronics don't make a control technical
Many physical controls contain chips and software. A badge reader runs firmware, an IP camera records to a server, and a motion sensor reports to an alarm panel. They stay in the physical category because what they protect is physical access or the physical safety of equipment. The test is the thing being protected: a fingerprint scanner on the data center door is physical, and the same kind of scanner used to sign in to a laptop is technical.
One device, several control types
Category and type are separate labels, and physical controls show it well because many do more than one job:
- Visible camera: deterrent, and its recording is detective. It prevents nothing on its own.
- Lighting: deterrent, and it helps guards and cameras detect.
- Door lock or vestibule: preventive, with the reader's log adding detection.
- Fire suppression: corrective, because it limits damage once a fire has started.
- An "Authorized personnel only" sign: directive.
Physical control on the CompTIA Security+ exam
Control categories are part of SY0-801 objective 1.1. SY0-801 no longer has a separate list of physical security devices such as bollards, fencing and lighting. Physical safeguards still come up through this category and through objective 2.3, which treats locks, access vestibules and access passes as physical threat vectors. A scenario where a barrier, the building or the operating environment does the protecting points to physical. The traps are guards, which Security+ treats as operational because a person performs the control, and electronic devices such as badge readers and cameras, which stay physical even though they run software. If a question asks which control would stop an intruder, a camera is wrong; if it asks which would show who entered, the camera is right.