Find the Gaps: Physical Access

About this interactive

Physical security rarely fails because a company has no controls. It fails at the gap next to a control: the badge reader on a door that stays open long enough for two people, the fire exit someone propped open for a smoke break, the camera pointed at the boxes instead of the door the boxes leave through. This activity hands you the floorplan of TechKnowDJ's studio building and asks you to find those gaps. Every question either describes something going wrong (a stranger following an employee inside, a laptop leaving unseen, a car rolling out of the drop-off lane) or names a control that is missing, and you click the spot on the plan where the weakness lives. The plan shows most controls done properly somewhere, so you can compare: the Engineering laptops are cable-locked and the hot-desk laptops are not; the loading dock has bollards and the glass lobby front does not; the server room door has a badge reader and a fingerprint reader, and a window in the wall beside it. Some spots on the plan are fine, so reading the plan beats guessing. After every click you get the gap named, the control that closes it, and whether that control is preventative (it stops the attempt), deterrent (it discourages the attempt) or detective (it notices the attempt). Each run draws a fresh selection of questions from the pool.

What you'll learn

Find the weak points in a building's physical security, where a barrier, door control, surveillance camera, alarm or equipment lock is missing, misplaced or defeated
Name the physical control that closes each gap and classify it as preventative, deterrent or detective

Aligned to

NIST 800-53

PE-3 Physical Access Control

PE-6 Monitoring Physical Access

NIST CSF

PR.AA-06 Physical access to assets is managed, monitored, and enforced commensurate with risk.

DE.CM-02 The physical environment is monitored to find potentially adverse events.

CompTIA Security+

1.2 Summarize fundamental security concepts.

1.1 Compare and contrast various types of security controls.

CompTIA A+ Core 2

2.1 Summarize various security measures and their purposes.

ISC2 CC

5.4 Understand asset protection

1.4 Understand cybersecurity controls

Cisco CCST Cybersecurity

1.1 Define essential security principles

Key terms

Physical Access Control: Security measures that restrict and manage physical entry to facilities, equipment, and IT infrastructure to prevent unauthorized access.
Preventative Control: A security control designed to stop a threat or incident from occurring in the first place. Firewalls, encryption, and access control policies are common examples of preventative controls.
Deterrent Control: A security control that discourages threat actors from attempting an attack by making the environment appear more difficult or risky to compromise. Warning banners, visible cameras, and security signage are common deterrent controls.
Detective Control: A security control that identifies and alerts on security incidents or anomalous activity as they occur or after the fact. Intrusion detection systems, security logs, and audit trails are examples of detective controls.
Tailgating: A physical security breach where an unauthorized person follows an authorized individual through a secured entry point without presenting credentials.
Piggybacking: A physical security attack where an unauthorized person follows an authorized person through a secured entry point with the authorized person's consent, typically by deceiving them.
Access Control Vestibule: A physical security entry point consisting of two interlocked doors — the first must close and lock before the second can open — ensuring only one person passes through at a time and preventing unauthorized tailgating into a secure facility.
Bollards: Heavy cylindrical barriers installed to prevent vehicles from accessing or ramming into a protected area.
Video Surveillance: The use of cameras and recording systems to monitor physical spaces, deter unauthorized access, and document activity within or around a facility.
Kensington Security Lock: A physical security mechanism that inserts into a small reinforced port on portable equipment such as laptops to anchor the device to a fixed object and deter theft.
Badge-Based Access Control: A physical access control system that uses programmable ID badges to grant or deny entry to secured areas and logs access events.
Biometrics: Authentication methods that use unique physical or behavioral characteristics such as fingerprints or retinal scans.
Physical Alarm System: A security mechanism that detects and alerts personnel to unauthorized physical access or environmental threats such as fire or moisture within a facility.
Security Escort: A designated authorized individual who accompanies an unauthorized or uncleared person within a restricted area to monitor their activity and maintain security controls.
Smart Locker: A electronically controlled storage unit that grants access to authorized users via a mobile app, PIN code, or digital credential rather than a traditional physical key.
Asset Tags: Labels or electronic markers attached to equipment to track and manage physical assets within an organization.

Topics

Interactive Physical Security Hotspot

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →