Lesson 1: Physical and Logical Security Controls

Core path: 42 minutes

Security starts before the password box.

A technician protects people, rooms, devices, accounts, data, and services with different controls because each risk crosses a different boundary.

Physical security controls

Recognize the purpose of:

• bollards — help block vehicle access to protected areas;
• access-control vestibules — control entry through staged doors;
• badge readers — verify possession of an approved credential;
• video surveillance — records/monitors activity;
• alarms and motion sensors — detect defined physical events;
• door locks and equipment locks — restrict physical access;
• guards and fences — add human/perimeter controls;
• lighting — improves visibility/deterrence;
• magnetometers — detect metallic objects in controlled-entry contexts.

Physical access credentials can include:

• key fobs;
• smart cards;
• mobile digital keys;
• physical keys;
• biometrics such as retina, fingerprint, palm, facial, or voice recognition.

No one control is perfect. A badge reader does not stop someone from holding the door open for an unauthorized person.

Least privilege

Least privilege means giving an identity only the access needed for the legitimate task.

A permission error does not automatically mean the user should become an administrator.

Zero Trust concept

Zero Trust is a security model built around continuously verifying access rather than automatically trusting a user/device because it is "inside" a network.

At A+ depth, remember:

location alone is not trust.

Access control lists

ACLs define which identities or systems are allowed or denied specific access to a resource.

Multi-factor authentication

MFA combines independent authentication factors. Implementations can involve:

• hardware tokens;
• authenticator apps;
• TOTP/OTP codes;
• SMS;
• voice;
• email-based codes in some systems.

Two passwords are still one factor category.

SSO and SAML

Single sign-on (SSO) lets one authenticated identity access multiple authorized services without separate sign-ins for each.

SAML is a federation/identity standard commonly used to exchange authentication/authorization assertions between identity and service providers.

SSO improves usability but also makes protection of the central identity especially important.

Just-in-time and privileged access

Just-in-time access provides elevated capability only when required and for a limited period.

Privileged Access Management (PAM) controls and monitors privileged accounts/access.

This is stronger than giving permanent administrator rights "just in case."

Security management systems

Recognize:

• MDM — manages mobile/endpoint configuration and policy;
• DLP — helps prevent unauthorized data loss/exfiltration;
• IAM — manages identities and access;
• directory services — centralize identity/object information and authentication-related services.

Guided case

A server room has badge access but the door is frequently propped open.

The badge system is working. The physical-security process is still weak because the access-control boundary can be bypassed through behavior.

A stronger response can combine:

badge reader
+ door-close monitoring/alarm
+ surveillance
+ user policy/training

Student action

For eight fictional assets, choose one physical and one logical control where appropriate:

asset:
risk:
physical control:
logical control:
why each control fits:
what each control does NOT prevent:

Evidence checkpoint

Security controls should map to a named risk. More controls are not automatically better if they do not address the actual requirement.