📷 Detecting Physical Security Breaches
Layered detection controls that catch what prevention misses⏱ ~2 min
A medieval castle didn't rely on just one wall. It had a moat, a drawbridge, outer walls, inner walls, a keep, and guards at every level. Each layer slowed attackers and gave defenders time to respond. Physical security works the same way. If the outer perimeter is breached, the next layer detects and slows the attacker. If that layer fails, the next triggers an alert. No single control is sufficient — the goal is layered detection.
Five Categories of Physical Security Controls
| Control Category | Examples | What It Detects/Prevents | Placement |
|---|---|---|---|
| Access Control | Badge readers, biometric scanners, key card systems, PIN pads | Unauthorized entry; logs who entered when | All entry points: doors, elevators, parking garages |
| Surveillance Systems | CCTV cameras, video analytics, body cameras | After-the-fact review; real-time monitoring for suspicious behavior | Entry/exit points, server rooms, parking areas, common areas |
| Environmental Controls | Motion sensors, infrared detectors, glass break sensors | Movement in restricted areas when no one should be present | After-hours in restricted zones, server rooms, storage areas |
| Physical Barriers | Fences, bollards, mantraps, turnstiles, window film | Prevents or slows physical entry; forces all access through monitored points | Perimeter, vehicle access points, building entry |
| Intrusion Detection Systems (IDS) | Door/window contact sensors, vibration sensors, pressure plates | Any unauthorized opening or forced entry attempt | All external doors, windows, roof hatches, utility access points |
Strategic Placement Matters
- •Zone by sensitivity — not all areas need the same protection. Server room ≠ break room. Layer controls proportional to the asset value inside
- •Cover blind spots — cameras positioned to cover 100% of entry points with overlapping fields of view; no uncovered angles
- •Delay, detect, respond — physical barriers slow the attacker (delay), sensors and cameras identify the intrusion (detect), guards and alarms enable response (respond). All three must be present
- •Motion sensors: after hours — configure to activate when the building is empty; daytime false positives kill effectiveness
- •Badge access logs — more useful than cameras for proving who was where; courts accept badge logs as evidence
- •Lighting — well-lit exterior eliminates concealment; motion-activated lights around the perimeter deter casual intruders
Activity: Design Your Defense
Imagine you're securing a small medical clinic. It has: a public waiting room, a reception desk, exam rooms, a records room with patient files, and a server room. For each area, consider: What threats exist? What's the most valuable asset? Which detection controls fit? Where would you place cameras vs. motion sensors vs. access control?
- •CCTV footage reviewed after an incident
- •Badge access logs examined when breach discovered
- •Audit trail of file access on server
- •Advantage: catches everything, stores evidence
- •Disadvantage: damage already done before review
- •Best for: legal/forensic evidence, pattern analysis
- •Motion sensor triggers alarm immediately
- •Intrusion detection system pages security staff
- •AI video analytics flags unusual behavior live
- •Advantage: enables real-time response to stop attack
- •Disadvantage: false positives; requires 24/7 monitoring
- •Best for: server rooms, after-hours protection, high-value assets
A server room has badge access at the door. A motion sensor detects movement inside at 2 AM when no one should be there. An alert goes to the security desk. The guard reviews the badge log — no entries after 6 PM. What does this combination of controls tell the security team, and what should they conclude?