Physical Security

Why physical security matters for IT

Physical security is the protection of people, buildings, equipment and media against unauthorized physical access, theft, damage and environmental threats. It is easy to forget in IT, where most attention goes to networks and accounts, but almost every logical control assumes that the attacker cannot simply walk up to the hardware. Someone with physical access can:

• carry off a laptop, a backup disk or a whole server;
• remove a disk and read it in another computer, or boot the device from their own Universal Serial Bus (USB) stick, bypassing the operating system's permissions;
• plug a rogue device into a network port, or leave a "lost" USB stick for someone to pick up;
• reset network equipment to factory defaults through its console port;
• read passwords from sticky notes and confidential printouts from the printer tray.

Full-disk encryption, firmware passwords, Secure Boot and port security on switches (see Network Security Basics) reduce the damage, but they work best together with doors that stay closed. Physical controls fall into the same categories as other security controls:

Layers from perimeter to device

Physical security applies defense in depth: several layers, each of which an intruder must pass. Each inner layer is smaller, holds more valuable assets, and admits fewer people.

At the perimeter, the way a site is laid out also matters. Crime prevention through environmental design (CPTED) uses landscaping, lighting and sight lines so that intruders feel observed and entrances are naturally controlled; bollards stop vehicles from reaching the building. Inside, the same thinking leads to a single staffed main entrance instead of many side doors.

Site access: badges, visitors and escorts

Most organizations control entry with access badges: proximity or smart cards read by a reader at the door, which a central system checks against the holder's access rights and logs. A badge is something you have; combined with a personal identification number (PIN) or a biometric at sensitive doors, it becomes multi-factor authentication. Badges usually carry a photo and should be worn visibly, so anyone can see who belongs.

• Visitor management: visitors sign in at reception, show identification, receive a visitor badge that is clearly different from staff badges and only valid for that day, and sign out and return the badge when they leave. The visitor log shows who was in the building — also needed for an evacuation.
• Escorts: visitors, contractors and delivery staff in non-public areas are accompanied by a host at all times. A maintenance engineer in the server room is escorted and watched, however routine the job.
• Badge life cycle: badges are issued after approval, rights match the job, and a leaver's badge is disabled on the last day. Lost badges are reported and blocked at once.

Tailgating and piggybacking

Tailgating is following an authorized person through a controlled door without presenting your own credentials. Many sources reserve piggybacking for the variant where the authorized person knowingly lets the other in — holding the door for someone carrying boxes, or letting a "colleague who forgot their badge" through. Either way, the access system records one person and two walk in. It works because most people are polite and dislike confrontation; social engineers rely on exactly that (see Social Engineering and Phishing).

Handling it is part of everyone's job, and it can be done politely but firmly:

• Let the door close behind you, and make sure nobody slips in.
• If someone tries to follow: "Sorry, I can't let you in on my badge — reception can help you." No accusation, no discussion; this is a rule, not a judgment of the person.
• If they insist, or you see someone without a badge in a secure area, do not confront them physically. Note what you saw and report it to security or reception right away.

Access control vestibules

An access control vestibule, traditionally called a mantrap, is a small space between two interlocked doors, of which only one can be open at a time. A person enters through the first door, which closes and locks behind them; the second door opens only after they authenticate again. Some vestibules use sensors to detect when more than one person is inside. Vestibules prevent tailgating into data centers and other high-security areas, and give guards a chance to check someone before the inner door opens. Turnstiles and single-person security revolving doors serve a similar purpose at busier entrances.

Surveillance, guards and locks

Cameras

Closed-circuit television (CCTV) is a video surveillance system whose cameras send images to a limited set of monitors and recorders rather than broadcasting them. Visible cameras deter; recordings help detect and investigate incidents. Point cameras at entrances, the server room door and loading docks, check that they still work and that their clocks are synchronized (otherwise footage is hard to match with badge logs), and protect the recorder itself — a camera system on the office network is also a computer that needs patching.

Camera images of people are personal data. In Europe, the General Data Protection Regulation (GDPR) applies: a clear purpose, signs that tell people they are being filmed, no cameras where privacy is expected, restricted access to footage and a short retention period — typically a few weeks unless the footage is needed for an incident. Monitoring employees needs extra care, and systematic monitoring of a publicly accessible area on a large scale requires a data protection impact assessment (see Privacy and Data Protection).

Guards, sensors and alarms

Security guards add what technology lacks: judgment. A guard can check an identification, notice someone who does not fit, respond to an alarm and decide what to do. Sensors extend their reach: door contacts raise an alarm when a door is forced or held open too long, and motion sensors (infrared, microwave, ultrasonic) or pressure sensors detect presence in areas that should be empty. Good lighting makes both cameras and guards more effective.

Locks

Locks range from traditional keys and combination locks to electronic locks controlled by the badge system, which can be changed centrally and log every opening. Keys need key management: a register of who holds which key, and changing the lock when a key is lost. Two terms often come up for electronic doors:

• Fail-safe: the lock opens when power fails, so people can always get out — required for many escape routes.
• Fail-secure: the lock stays locked when power fails, protecting what is inside — used for server rooms and storage, where people can still exit with a mechanical handle.

Smaller locks protect devices: cable locks attach laptops and monitors to a desk through the device's security slot, racks and cabinets have their own locks, and USB port blockers or locked cases keep people from plugging things in. Cable locks deter opportunistic theft in offices and at events; they will not stop a determined thief with tools.

Secure areas and data centers

Server rooms and data centers combine every layer above. Typical measures:

• Zones: public lobby, office area, data hall, individual cages or rooms. Each zone has its own access list, and access to the data hall is limited to the people who need it.
• Logging and review: every entry is logged by the badge system, sometimes with a separate visitor book; logs and camera footage are reviewed, and access lists are checked periodically.
• Two-person rule for the most sensitive areas or actions: nobody works there alone.
• No anonymous equipment: equipment coming in or going out is registered against the asset inventory.

Environmental controls

Availability depends as much on the environment as on intruders:

• Fire: early smoke detection, and suppression that does not destroy the equipment — clean-agent gas systems, or pre-action sprinklers whose pipes only fill with water after a detector has triggered. Staff need to know the evacuation and safety procedures for gas systems (see Safety and Handling).
• Heating, ventilation and air conditioning (HVAC): hot and cold aisles, temperature and humidity monitoring with alerts. Common guidance recommends an inlet temperature of about 18 to 27 °C.
• Power: uninterruptible power supplies (UPSs) to bridge short outages and allow a clean shutdown or a switch to generators, redundant power feeds, and power distribution units per rack (see Power Supplies).
• Water: leak detection under raised floors and near cooling units; no water pipes above the racks.

In the cloud, the provider takes care of all of this; its audit reports are your evidence (see Cloud Security and Compliance). Your own network closets, branch offices and substations remain your responsibility.

Clean desk and clear screen

A clean desk policy requires employees to clear sensitive papers, notes and removable media from their desks and lock them away when they are not present, especially at the end of the day. Its companion, clear screen, requires locking the computer whenever you step away. Together they make sure that a cleaner, visitor or intruder walking past finds nothing to read, photograph or take.

• Lock the screen every time you leave your desk: on Windows Windows+L, on macOS Control+Command+Q. An automatic lock after a few minutes of inactivity is the safety net, not the plan.
• Collect printouts immediately, or use secure print release, where the job only prints after you badge in at the printer.
• Wipe whiteboards after meetings; never write passwords on sticky notes.
• Use privacy screens and position monitors away from windows and walkways to limit shoulder surfing.
• Put confidential paper in the locked shredding bin, not in the ordinary waste.

Secure disposal

Secure disposal is removing data from storage media and paper, or destroying them, so that the information cannot be recovered before they leave the organization's control — for reuse, resale, recycling or the dumpster. Deleting files or formatting a disk is not enough: the data usually stays on the disk until it is overwritten (see Disks, Partitions and Volumes).

National Institute of Standards and Technology (NIST) Special Publication 800-88 Rev. 2 (2025), Guidelines for Media Sanitization, which refers to the Institute of Electrical and Electronics Engineers (IEEE) standard 2883 for the techniques, describes three levels:

• Clear: overwrite user-addressable storage with standard tools. Protects against ordinary recovery tools; suitable when media stays inside the organization.
• Purge: methods that protect even against laboratory recovery, such as the drive's built-in sanitize or secure erase command, cryptographic erase (destroying the encryption key of a self-encrypting or fully encrypted drive) and degaussing of magnetic media.
• Destroy: physically make the media unusable — shredding, disintegrating, pulverizing, melting or incinerating.

Degaussing erases magnetic storage media by exposing them to a strong magnetic field, which scrambles the magnetic domains that hold the data. It works on hard disk drives and magnetic tapes, and usually leaves a hard disk permanently unusable because its factory-written servo information is erased too. It does nothing to solid-state drives, USB sticks, memory cards or optical discs, which do not store data magnetically.

Do not forget devices with hidden storage: printers and multifunction copiers often contain a disk with copies of scanned and printed documents, and phones, network equipment and smart devices hold configurations and credentials (reset them to factory settings and remove them from management systems). When an external company does the destruction, keep a chain of custody from pickup to destruction and ask for a certificate of destruction listing the serial numbers; then update the asset inventory. The environmental side of disposal, such as certified e-waste recycling, is covered in Safety and Handling.

Lost and stolen devices

Laptops and phones get lost on trains and stolen from cars. The damage depends almost entirely on what was prepared beforehand:

• Before: full-disk encryption on every laptop (BitLocker on Windows, FileVault on macOS; see Endpoint Security), a passcode and enrollment in mobile device management (MDM) on phones (see Mobile Operating Systems), data stored centrally rather than only on the device, and an asset inventory that tells you what was on it.
• Report immediately to the service desk, even outside office hours and even if you hope it will turn up.
• Then: lock or wipe the device remotely, sign the user out of all sessions, reset passwords and revoke tokens or certificates stored on it, and record the incident.
• Assess the personal data breach: it must be documented in any case. A lost laptop with strong full-disk encryption and an uncompromised key is usually unlikely to cause risk, so it need not be reported. An unencrypted one with customer files usually must be reported to the Autoriteit Persoonsgegevens (see Privacy and Data Protection).

Checking badge logs in Python

Badge systems produce logs that can reveal tailgating and misuse. When a door has readers on both sides, every authorized person badges in and out. An exit without a matching entry suggests that the person came in behind someone else; an entry at 06:00 may be fine or may be a stolen badge. This sketch checks a fictional log for those patterns.

# Badge events at the door of a server room: (time, badge, direction).
# Fictional data. The door has a reader on both sides, so every
# authorized pass is logged going in and coming out.
EVENTS = [
    ("06:12", "B-1042", "in"),
    ("06:40", "B-1042", "out"),
    ("08:55", "B-2208", "in"),
    ("09:20", "B-2208", "out"),
    ("10:03", "B-3317", "in"),
    ("10:31", "B-3317", "out"),
    ("10:32", "B-4150", "out"),
    ("16:10", "B-5021", "in"),
    ("22:47", "B-2208", "in"),
    ("23:05", "B-2208", "out"),
]
WORKING_HOURS = ("07:00", "19:00")  # HH:MM strings compare correctly as text

inside = set()
for time, badge, direction in EVENTS:
    if direction == "in":
        if not WORKING_HOURS[0] <= time < WORKING_HOURS[1]:
            print(f"{time}  {badge}  entry outside working hours")
        inside.add(badge)
    elif badge in inside:
        inside.remove(badge)
    else:
        print(f"{time}  {badge}  exit without entry: possible tailgating")

for badge in sorted(inside):
    print(f"end of day  {badge}  still inside, or left without badging")

06:12  B-1042  entry outside working hours
10:32  B-4150  exit without entry: possible tailgating
22:47  B-2208  entry outside working hours
end of day  B-5021  still inside, or left without badging

Badge B-4150 left one minute after B-3317 without ever badging in — the classic sign that B-4150 followed someone in earlier. Badge B-5021 never badged out: the person may still be inside, or may have left behind someone else. None of these lines proves wrongdoing; there may be an on-call engineer or a broken reader. They are leads for the security team to check against the camera footage and the change calendar, which is how a security monitoring team treats such alerts (see Security Monitoring and the SOC).