TechKnowSurge
NIST 800-53 PE-3 NIST CSF PR.AA-06 ISC2 CC 5.4 CompTIA Server+ 3.4 ISC2 CC 1.4 NIST 800-53 PE-6 NIST CSF DE.CM-02 Cisco CCST Cybersecurity 1.1
TechKnowSurge Catalog Videos IAM - Physical Access Control
VideoSecurityFree

IAM - Physical Access Control

Physical access control covers the policies, technologies, and physical measures used to restrict unauthorized entry to facilities, equipment, and sensitive data. Key concepts include building security design, access mechanisms, surveillance systems, detection tools, and equipment protection.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Physical access control encompasses the full range of measures an organization uses to restrict unauthorized access to its facilities, assets, and data. These measures fall primarily into three categories of security controls: preventative controls that stop incidents before they occur, deterrent controls that discourage attempts, and detective controls that identify breaches when they happen. Understanding how these categories apply to the physical environment is essential for building a comprehensive security posture. At the building and perimeter level, organizations have a wide variety of options available to them. Bollards, fencing with barbed wire, and carefully selected building materials can physically block or slow unauthorized entry. Design choices such as reflective glass, the absence of windows, signal-blocking construction, and even deliberate camouflage of sensitive facilities like data centers help reduce visibility and exposure. Access control vestibules, formerly called man traps, create a controlled single-person entry point that forces individuals to authenticate before proceeding further into the building. Magnetometers, badge readers, RFID key fobs, smart cards, and biometric scanners such as fingerprint and retinal readers all provide layered options for authenticating authorized personnel, while access logs generated by these systems create an auditable record of entry events. Once inside, detection and surveillance tools provide ongoing monitoring and response capability. Security guards, escort protocols, bright lighting, guard dogs, tamper detection, and alarm systems all contribute to deterrence and detection. Surveillance can take multiple forms, including video monitoring, wireless signal monitoring for unauthorized access points, and electronic surveillance using infrared sensors, pressure plates, microwave detectors, and ultrasonic devices. Equipment within the facility is protected through physical locks, smart lockers, safes, locking cabinets and racks, and asset tagging for inventory tracking. Underpinning all of these technical and physical measures is employee training, which addresses behaviors such as tailgating and piggybacking and ensures that staff understand and consistently apply physical security policies and procedures.

What you'll learn

What's covered

Physical Access Control

Aligned to

NIST 800-53
PE-3 Physical Access Control
PE-6 Monitoring Physical Access
NIST CSF
PR.AA-06 Physical access to assets is managed, monitored, and enforced commensurate with risk.
DE.CM-02 The physical environment is monitored to find potentially adverse events.
ISC2 CC
5.4 Understand asset protection
1.4 Understand cybersecurity controls
CompTIA Server+
3.4 Given a scenario, implement physical security methods.
Cisco CCST Cybersecurity
1.1 Define essential security principles

Key terms

Access Control
A security mechanism that restricts access to resources based on policies, roles, or identity.
Biometrics
Authentication methods that use unique physical or behavioral characteristics such as fingerprints or retinal scans.
Access Control Vestibule
A physical security entry point consisting of two interlocked doors — the first must close and lock before the second can open — ensuring only one person passes through at a time and preventing unauthorized tailgating into a secure facility.
Bollards
Heavy cylindrical barriers installed to prevent vehicles from accessing or ramming into a protected area.
Tailgating
A physical security breach where an unauthorized person follows an authorized individual through a secured entry point without presenting credentials.
Asset Tags
Labels or electronic markers attached to equipment to track and manage physical assets within an organization.
Intrusion Detection System
IDS
A system that monitors network or system activities for malicious behavior and generates alerts.
Asset
Any resource of value to an organization, including hardware, software, data, and personnel.

Topics

Physical Security Access Control Surveillance Systems Identity And Access Management Security Controls Facility Security

Transcript

Types of controls

Physical access control is an important part of keeping our equipment, our assets and our data safe.

When it comes to battling risk, we have several different types of controls we can put into place, that is, categories of controls, and they fall under preventative, deterrent, detective, corrective, recovery, compensating and directive. But when it comes to physical access control, it mainly has to do with the first three: preventative, things that prevent something from happening; deterrent, things that are going to deter somebody from trying to gain access; and detective, those things that are going to detect that something has been breached.

Building access

There are some things that we can do to the building and the surrounding areas to really protect our assets. One of the things is that we could put up bollards. Bollards are the cylinders, sometimes they retract, but they are the round cylinders that prevent somebody from driving into a certain area. If they were to hit one of these, they go deep into the ground and it would cause a lot of damage, so it protects certain areas from having some sort of vehicle traffic.

There is also fencing, which could prevent vehicles but could also prevent people from getting in or crawling over, if they have to battle barbed wire at the top. Even the architecture of the building makes a difference. There are some building materials that can be signal blocking, to prevent signals from coming in or out of the building. There are things like reflective glass that you can put up so people cannot see into the building, or perhaps you do not have windows at all. There are things like camouflage that you could put in there, meaning that we could take this building, and if it is a data center we do not necessarily want people to know that it is a data center, so we make it blend into the buildings around it.

There are also things like access control vestibules, which used to be called man traps. Access control vestibules are areas where you would walk in, and it only really accepts one person, or a lot of them only accept one person. The door locks behind you and you have to enter a code to get into the next stage and access the building. Talk about a deterrent: there is not going to be somebody that is trying to break into the building that is going to want to be in one of those vestibules. Or you have magnets that you can use, magnetometers, also known as metal detectors, those are the things that you walk through that detect whether you have metal on your body.

Door access

There are lots of options for door access, once you are in the building or to get into the building. There are just regular keys, or key fobs, those things that can attach to your keys, but they are little RFID sensors. You have badge readers that are able to sense that RFID signal. You have got smart cards and swipe cards that all serve the same purpose of being able to access it. You have biometrics, like a retina scanner, fingerprint scanner or palm print scanner, things that read any kind of biometrics. And with all of this it is great, because you can create access logs.

Detection and surveillance

There are also a lot of things that we can put in place for detection, such as security guards or security escorts. Some businesses, when you walk into them, will have someone escort you to certain places. When my brother was going for a top secret clearance, that is one thing that he had to do, have a security escort until he was completely cleared.

Just lighting is another thing; having bright lights is a deterrent. Having guard dogs would obviously be a deterrent. There are things like tamper detection, so that if something were to be tampered with, it would set off some sort of signal or it would be evident that it has been tampered with. You have things like alarm systems and surveillance systems.

There are also lots of different types of surveillance, whether it be video cameras doing video surveillance, or maybe it is some sort of surveillance around the wireless system, seeing if there are stray wireless signals that are not supposed to be there, or electronic surveillance. There are different types of electronic switches and different types of electronic surveillance that we can put in place. There are a lot of detectors and sensors that we can use, like infrared sensors doing things like body heat, or pressure, like pressure plates sensing pressure, microwave or ultrasonic. So there are lots of different types of detectors and sensors that we can put into place.

Securing equipment

We not only want to protect some of the rooms within our buildings, or the buildings themselves, but we also want to secure equipment within the building. So we use things like laptop and equipment locks, smart lockers, safes, locking cabinets, locking racks, and even asset tags to track the equipment.

Employee training

One thing that goes a long way is employee training. You could have people that are doing things like piggybacking, where they are coming in behind somebody else. Even if you have something like an access control vestibule that only allows one person in, if they are holding the door open for somebody else to come in as well, then that is problematic. So making sure that you have employee training around all of the policies and procedures around physical access control, as well as how to use all of the things that we have just mentioned, is also important.

Using these all together is an important part of making sure you have physical access control and that you are maintaining secure ways of safeguarding your assets.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →