Physical protection, deception, and control-gap analysis

Physical protection, deception, and control-gap analysis

Physical protection starts by identifying the asset and its approach paths, not by buying a badge reader in isolation. Imagine a server room on a floor used by visitors and suppliers. A fence and entry barrier channel movement and deter casual intrusion. An access vestibule can reduce tailgating when the second door cannot open before the first closes. A badge checks an access entitlement, but a badge may be stolen or lent; one successful scan is not complete identity assurance. A guard is an operational control that checks exceptions and visitors. A camera supplies detective evidence but does not itself stop a person at the door. Corridor lighting and a door sensor make concealment harder, yet their value depends on whether alarms are watched and acted upon. Classify each safeguard on two axes: category—physical, technical, operational, or managerial—and function—preventive, deterrent, detective, corrective, compensating, or directive. One safeguard can carry more than one label. Do not confuse where it operates with what it does. Draw a visitor path from reception to rack, and put an authorization condition, a log, and a failure response at each transition. Test both an authorized entrance and an unauthorized attempt instead of accepting a photograph of a locked door.

Deception technology does not replace real access control. A decoy might be an account that normal work never uses, a marked synthetic file, or a bounded service that resembles an attractive target. Touching it supplies an investigation signal because legitimate workflows should not need it. The alarm does not identify an attacker by itself: an authorized scanner may read it, or a worker may open it accidentally. Place the decoy in an isolated network with no real records or production secrets, and give it no path into live systems. Name its owner, alert recipient, evidence-preservation steps, and removal date. A honeypot imitates a service, a honeyfile is a planted document, and a honeytoken may be a marked value or credential. Never plant a credential that can actually unlock production; that creates an attack route instead of observing one. Trigger the alarm with a known synthetic action, then test that ordinary inventory tools do not flood the team. Compare deception with foundational controls: if someone can read real payroll files without authorization, adding a fake file does not close the exposure; it may only reveal some use after access has occurred.

Gap analysis turns 'we have cameras' into a comparison between required and measured states. For each boundary, record the requirement, existing safeguard, operational evidence, test method, gap, impact, treatment owner, and closure date. Example requirement: no visitor enters the server room without authorization and an escort. Current evidence shows tailgating and an incomplete visit log; the gap is passage without an individual decision. Buying a camera is not the repair. Change reception procedure, door behavior, and escort logging, then retest the three cases. A second requirement may say a prolonged door opening must alert an operator within one minute. The disconnected sensor leaves no alert path; repair it and assign an on-duty recipient. Prioritize gaps by plausible route, asset impact, and observability, not the number of tools. Keep a baseline such as uncorrected tailgating attempts and time from door-open event to response, then measure again after a week. If measures improve but the loading door stays open for long periods, the plan is not complete: add temporary supervised passage and a review date. In an exam scenario, select the safeguard that actually closes the missing condition. A sophisticated product may be less relevant than a simple procedure that changes the decision at the boundary.

The common error is treating a camera as prevention or a decoy as authorization repair. Ask whether the safeguard changes passage or only reports it later, and whether an accountable responder evaluates the alert.