Physical Security

# Physical security - defender perspective

> Lab and authorised engagements only. This page describes physical
> attack patterns so defenders can build controls, training, and
> detection. Any live physical engagement requires signed Rules of
> Engagement (RoE), site-specific authorisation letters, and law
> enforcement notification. We do not publish lockpicking, social
> bypass, or surveillance techniques as how-to.

## What attackers actually try (high level, defender lens)

- Tailgating into the building behind an authorised person
- Pretexting as delivery, cleaner, contractor, or auditor
- Lost-and-found drop: USB drives left in lobbies and lifts
- After-hours entry through poorly monitored fire exits
- Insider risk: disgruntled employee with badge access
- Targeting comms cabinets, printers, and unattended laptops

## Controls that work

- Mantrap or interlock door for the first floor of secure zones
- Visitor management: photo ID, signed NDA, escorted at all times
- Cleaner and contractor controls: pre-approved list, escorted, no after-hours alone
- Disable USB autorun and require BitLocker/FileVault on every laptop
- Cameras with retention long enough for forensic review
- Tamper-evident seals on comms cabinets; access logged
- Badge audit: quarterly review of who has access to which zones
- Screen lock enforced (group policy / MDM), short timeout

## Detection signals

- Badge swipes outside normal patterns (out of hours, wrong zone)
- Multiple failed badge attempts followed by a success
- USB device insertion on locked-down endpoints (log + alert)
- Unattended laptops in semi-public areas (cleaner sweep can report)
- Print jobs sent and abandoned at shared printers

## Awareness training

- 'Hold the door' politeness defeats tailgating - teach polite challenge
- Lost USBs: report, do not plug in
- Visitor handover: never escort someone you do not know
- After-hours visitors: route through security desk, even known colleagues
- 'Tailgating drill' once a year (announced) is a strong signal

## Reporting on a physical engagement

- Anonymised observations by role, not individual
- Pair findings with controls (mantrap, badge audit, MDM policy)
- Quick wins (screen lock policy, USB autorun disable) + longer programmes (CCTV retention review)
- Confirm all engagement equipment removed; reset any temporary badges

# Physical engagements need explicit "get out of jail" letters signed by
# someone with authority + a contact reachable on the day.
# Test concepts: tailgating, lock controls, badge cloning, dumpster diving.
# Document findings without naming individuals.