TechKnowSurge
NIST 800-53 PE-3 CompTIA Security+ 3.2 ISC2 CISSP 3.9 NIST CSF PR.AA-06 CompTIA Security+ 1.1 NIST 800-53 PE-6 NIST CSF DE.CM-02
TechKnowSurge Catalog Videos Physical Access Control
VideoSecurityFree

Physical Access Control

Physical access control covers the strategies, technologies, and policies used to protect facilities, equipment, and data from unauthorized physical entry. Topics include building perimeter defenses, door access mechanisms, surveillance systems, equipment security, and employee training.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Physical access control encompasses the full range of strategies used to protect a facility's assets, equipment, and data from unauthorized physical access. Security controls in this domain generally fall into three categories — preventative, deterrent, and detective — each serving a distinct role in reducing risk. Preventative controls stop unauthorized access before it occurs, deterrent controls discourage attempts, and detective controls identify when a breach has taken place or is in progress. Understanding how these categories apply to physical environments is foundational to building an effective security posture. At the building and perimeter level, organizations can deploy bollards to block vehicle-based threats, use fencing with anti-climb features, apply signal-blocking construction materials, and install reflective or opaque glazing to limit visibility into sensitive areas. Camouflaging high-value facilities such as data centers helps reduce their profile as targets. Access control vestibules — single-occupancy entry chambers requiring credential verification before granting further access — serve as a strong combined deterrent and preventative measure. Metal detectors add another screening layer at controlled entry points. Inside and at building entry points, access can be managed through traditional keys, key fobs, RFID-enabled smart cards and swipe cards, and biometric systems such as fingerprint, retinal, and palm scanners, all of which support the creation of detailed access logs for auditing purposes. Detection capabilities are extended through security guards, security escorts, perimeter lighting, guard dogs, tamper-evident mechanisms, alarm systems, and video surveillance. Specialized sensors — including infrared, pressure plate, microwave, and ultrasonic detectors — provide additional layers of monitoring across facility spaces. Equipment security is addressed through physical locks, smart lockers, safes, locking cabinets and racks, and asset tagging for inventory tracking. Rounding out a comprehensive physical access control program is employee training, which ensures staff understand and consistently follow access policies, and are equipped to recognize and respond to risks such as tailgating and improper door-holding behaviors that can undermine even well-designed technical controls.

What you'll learn

What's covered

Physical Access Control

Aligned to

NIST 800-53
PE-3 Physical Access Control
PE-6 Monitoring Physical Access
CompTIA Security+
3.2 Given a scenario, apply security principles to secure enterprise infrastructure.
1.1 Compare and contrast various types of security controls.
ISC2 CISSP
3.9 Design site and facility security controls
NIST CSF
PR.AA-06 Physical access to assets is managed, monitored, and enforced commensurate with risk.
DE.CM-02 The physical environment is monitored to find potentially adverse events.

Key terms

Access Control
A security mechanism that restricts access to resources based on policies, roles, or identity.
Biometrics
Authentication methods that use unique physical or behavioral characteristics such as fingerprints or retinal scans.
Access Control Vestibule
A physical security entry point consisting of two interlocked doors — the first must close and lock before the second can open — ensuring only one person passes through at a time and preventing unauthorized tailgating into a secure facility.
Bollards
Heavy cylindrical barriers installed to prevent vehicles from accessing or ramming into a protected area.
Preventative Control
A security control designed to stop a threat or incident from occurring in the first place. Firewalls, encryption, and access control policies are common examples of preventative controls.
Deterrent Control
A security control that discourages threat actors from attempting an attack by making the environment appear more difficult or risky to compromise. Warning banners, visible cameras, and security signage are common deterrent controls.
Detective Control
A security control that identifies and alerts on security incidents or anomalous activity as they occur or after the fact. Intrusion detection systems, security logs, and audit trails are examples of detective controls.
Surveillance System
A set of monitoring technologies, including video cameras and electronic sensors, used to observe and record activity in and around a facility.
Asset
Any resource of value to an organization, including hardware, software, data, and personnel.
Piggybacking
A physical security attack where an unauthorized person follows an authorized person through a secured entry point with the authorized person's consent, typically by deceiving them.

Topics

Physical Security Access Control Surveillance Systems Perimeter Defense Security Controls Facility Security

Transcript

Physical access control is an important part of keeping our equipment, our assets, and our data safe.

Types of Controls

When it comes to battling risk, we have several different types of controls we can put into place, that is, categories of controls. They fall under preventative, deterrent, detective, corrective, recovery, compensating, and directive. But when it comes to physical access control, it mainly has to do with the first three: preventative, things that prevent something from happening; deterrent, things that are going to deter somebody from trying to gain access; and detective, those things that are going to detect that something has been breached.

Building Access

There are some things that we can do to the building and the surrounding areas to really protect our assets. One of the things is we could put up bollards. Bollards are the cylinders that go — sometimes they retract — but they're the round cylinders that prevent somebody from driving into a certain area, that if they were to hit one of these, they go deep into the ground and it would cause a lot of damage. So it protects certain areas from having some sort of vehicle traffic.

Or fencing, which could prevent vehicles but also could prevent people from getting in or crawling over, if they have to battle this barbed wire at the top. Or just even the architecture of the building makes a difference. There are some building materials that can be signal blocking, to prevent signals from coming in or out of the building. There's things like reflective glass that you can put up so people can't see into the building, or perhaps you don't have windows at all. There's things like camouflage that you could put in there, meaning that we could take this building, and if it's a data center, we don't necessarily want people to know that it's a data center, so we make it blend into the buildings around it.

There's also things like access control vestibules, which used to be called man traps. Access control vestibules are areas where you would walk in, and it only really accepts one person — a lot of them only accept one person. The door locks behind you, and you have to enter a code in to get into the next stage and access the building. And talk about a deterrent: there's not going to be somebody that's trying to break into the building that's going to want to be in one of those vestibules. Or you have magnetometers that you can use, magnetometers also known as metal detectors. Those are the things that you walk through, and they detect whether you have metal on your body.

Door Access

There's also lots of options for door access, once you're in the building or to get into the building. There's just regular keys, or key fobs — those are the things that can attach to your keys, but they are little sensors, little RFID sensors. You have badge readers that are able to sense that RFID signal. You've got smart cards and swipe cards that all kind of serve the same purpose of being able to access it. Biometrics, like retina scanner, fingerprint scanner, palm print scanner, things that read any kind of biometrics. And then also, with all of this, it's great because you can create access logs.

Detection and Surveillance

There's also a lot of things that we can put in place for detection, such as security guards or security escorts. Some businesses, actually, when you walk into it, they'll have an escort that will escort you to certain places. When my brother was going for a top secret clearance, that's one thing that he had to do, is have a security escort until he was completely cleared. Things like just lighting is another thing — having bright lights is a deterrent. Having guard dogs would obviously be a deterrent. There are things like tamper detection, that if something were to be tampered with, then it would set off some sort of signal or be evident that it has been tampered with. You have things like alarm systems and surveillance systems.

There's also lots of different types of surveillance, whether it be video cameras doing video surveillance, or maybe it's some sort of surveillance around the wireless system, seeing if there's stray wireless signals that aren't supposed to be there, or electronic surveillance. There's different types of electronic switches and different types of electronic surveillance that we can put in place. There's a lot of detectors and sensors that we can use, like infrared sensors doing things like body heat, or pressure like pressure plates sensing pressure, microwave or ultrasonic. So there's lots of different types of detectors and sensors that we can put into place.

Securing Equipment

We not only want to protect some of the rooms within our buildings, or the buildings themselves, but we also want to secure equipment within the building. So we use things like laptop and equipment locks. We use things like smart lockers, safes, locking cabinets, locking racks, and even asset tags to track the equipment.

Employee Training

One thing that goes a long way is employee training. You could have people that are doing things like piggybacking, where they're coming in behind somebody else. Even if you have something like an access control vestibule that only allows one person in, if they're holding the door open for somebody else to come in as well, then that's problematic. So making sure that you have employee training around all of the policies and procedures around physical access control, as well as how to use all of the things that we've just mentioned, is also important.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →