Overview
Physical controls protect the tangible parts of a system — buildings, equipment, media, and people — from physical access and environmental harm. They are easy to overlook in a digital field, but physical access often defeats even excellent digital security.
Learning objectives
- Define physical controls.
- Give examples across control functions.
- Explain why physical security is a prerequisite for digital security.
Core concept
Physical controls restrict and monitor physical access and guard against environmental threats. Like other controls, they have functions:
- Preventive physical: locks, fences, walls, mantraps, badge/biometric door readers, security guards, bollards.
- Detective physical: CCTV cameras, motion sensors, door alarms, visitor logs.
- Corrective/environmental: fire suppression, backup power (UPS/generators), climate control, off-site media storage.
How it works
Physical controls layer just like digital ones (a fence, then a locked door, then a locked server rack). They matter because physical access frequently trumps digital defenses: someone with hands on a machine can steal its drive, plug in a malicious USB device, reset credentials, or simply carry it away. Environmental controls also protect availability — a server destroyed by fire or heat is as down as one hit by DDoS.
Practical example
A data centre uses badge access at the building entrance, a mantrap and biometric reader at the server floor, locked racks, CCTV throughout, fire suppression, and backup generators. An intruder who somehow entered the lobby still cannot reach or remove a server, and a power cut or fire will not take services down. Digital controls protect the data; physical controls protect the hardware it lives on.
Cybersecurity relevance
The physical attack surface (unlocked workstations, exposed USB ports, discarded drives) is a real avenue attackers use, and physical security is a required domain in frameworks and audits. "Evil maid" attacks and USB-drop attacks specifically exploit weak physical controls.
Common mistakes
- Focusing entirely on digital defenses while leaving machines physically accessible.
- Ignoring environmental threats (power, fire, climate) that destroy availability.
- Failing to securely dispose of media, leaking data from discarded drives.
Key takeaways
- Physical controls protect facilities, equipment, media, and people, and include preventive, detective, and environmental forms.
- Physical access can bypass digital security, so physical security is foundational.
- Environmental controls protect availability against fire, power loss, and climate.
Check your understanding
- Give one preventive and one detective physical control for a server room.
- Explain how physical access to a laptop can defeat strong disk encryption's intent if the machine is left running and unlocked.