How Threats Exploit Physical Vulnerabilities

AP Cybersecurity · Securing Spaces

Exploiting Physical Vulnerabilities

Physical access is a shortcut past every technical control — and one threat has no attacker at all.

key ideaPhysical access is a shortcut past every technical control — and one threat is not even an adversary.

The idea

Threat

Anything that could cause harm. The CED includes human adversaries and natural disasters — flood, fire, storm. A disaster has no intent and does the same damage, which is why availability planning is a security concern.

Vulnerability

A weakness or flaw that could let an asset be compromised. Physically that means an unlocked door, an exposed port, an unattended screen, an unprotected electrical box — anything that shortens the distance between an adversary and a device.

Each arrow is a control opportunity. Notice that no step involves defeating software — which is exactly why physical security is treated as the first layer rather than an afterthought.

[Figure: A propped door is the whole vulnerability. The lock, the badge reader and the policy all still work perfectly — the control was simply removed from the path.]

A propped door is the whole vulnerability. The lock, the badge reader and the policy all still work perfectly — the control was simply removed from the path.

CompromiseAny of: unauthorized access to data or space, disruption of services, theft or destruction of resources, or unauthorized modification.

KeyloggerA device plugged between keyboard and computer that records every keystroke — including passwords typed after login.

Power disruptionDamaging fuses or breakers, cutting wiring, or attacking substations and transformers. The device and its services become unavailable.

Natural disasterA non-human threat that causes physical damage to computers and data, and disrupts the services they provide.

AvailabilityThe principle physical attacks most often target. A stolen or unpowered machine serves nobody.

Vulnerability	How a threat exploits it	Compromise type
an unsecured door or propped exit	the adversary walks in	unauthorized access to a restricted space
an unattended workstation	reads or copies what is on screen	unauthorized access to sensitive data
an exposed USB port	plugs in a keylogger or a drive carrying malware	data collection, possible device control
a device that can be picked up	takes it, or physically damages it	theft or destruction
an unprotected electrical box	damages fuses or breakers, cuts wiring	disruption — the service goes down
a server room below flood level	a natural disaster damages equipment	destruction and disruption

Row 6 has no adversary at all. The CED counts natural disasters as threats, because the loss to availability is identical whether the cause was malice or weather.

Why it works that way

Technical controls assume the attacker is on the other side of an interface — a login screen, a network port, an API. Physical access removes that assumption entirely: the adversary is inside the boundary the software was designed to guard.

why physical access is decisive

A keylogger captures the password after it is typed, so encryption and complexity are irrelevant.
An external drive can carry malware in and data out with no network involved at all.
Cutting power needs no credentials and takes down every service on the device.
A stolen device gives the adversary unlimited time to work on it, off-site.

Reach the spacean unsecured door or exit

Reach the devicean unattended screen or open port

Actcopy, plug in, cut power, or take it

Worked analysis

EX 1

Trace one vulnerability to a compromise

A reception PC is left logged in and unattended during lunch, in a public lobby. State the threat, the vulnerability and the compromise.

Name the vulnerability

An unattended, unlocked workstation in an unrestricted space.

Name the threat

Any visitor — no skill or tooling required.

State the mechanism

Read the screen, copy files to a drive, or plug in a keylogger for later.

Classify the compromise

Unauthorized access to sensitive data, and potentially ongoing collection.

Give the control

Automatic screen lock plus reposition the screen — both cheap, both preventative.

EX 2

The attack that needs no login

An adversary opens an unlocked electrical cabinet and pulls the breaker feeding a server rack. What is compromised?

Note what was not needed

No credentials, no software, no network access.

Name the vulnerability

An unprotected electrical box in an accessible area.

Name the compromise

Disruption — the device and every service it provides become unavailable.

Note the second-order effect

If cameras or door controllers share that supply, detection goes down with it.

Give the controls

Lock the cabinet, and add UPS and generators so a cut supply does not become an outage.

EX 3

A threat with no attacker

A ground-floor server room floods after a storm. Is this a security concern or a facilities problem?

Apply the CED definition

Threats include natural disasters as well as human adversaries.

Identify the vulnerability

Siting critical equipment below flood level with no water detection.

Identify the compromises

Destruction of equipment and data, and disruption of every service it provided.

Compare with an attack

The loss of availability is identical — the cause differs, the outcome does not.

Answer

Both. It belongs in the risk assessment because availability is a security principle.

Common traps

Threats are not only adversaries

Natural disasters are threats under the CED. Omitting them from a physical assessment leaves out the causes of most real downtime.

A locked door is not the whole boundary

Ports, screens, bins and power all sit inside the perimeter and each is its own vulnerability.

Encryption does not stop a keylogger

The keystrokes are captured before anything is encrypted. This is a physical problem needing a physical control.

Cutting power is an attack

It requires no credentials and compromises availability completely — and may disable the very cameras that would have recorded it.

Check yourself

What kinds of threat does the CED include for physical security?

Show answer

Human adversaries seeking harm or disruption, and natural disasters, which damage or destroy computers and data and disrupt the services they provide.

List the four compromise types.

Show answer

Unauthorized access to sensitive data or restricted space; disruption of services; theft or destruction of digital or physical resources; unauthorized modification.

What can an adversary do with physical access to a device's ports?

Show answer

Plug in a keylogger to collect keystrokes, or an external drive carrying malware — potentially gaining control of the device. They can also damage or remove it.

Why does disrupting power count as an attack?

Show answer

The device and every service it provides become unavailable. Adversaries can damage fuses or breakers, cut wiring, or attack substations and transformers — none of which requires a credential.

Course map. Topic 2.2.b · LO 2.2.B — explain how threats can exploit common physical vulnerabilities to cause loss, damage, disruption or destruction to assets (EK 2.2.B.1–2.2.B.5: human adversaries and natural disasters as threats; vulnerabilities and the four compromise types; power disruption; access to areas with sensitive information; physical access to devices and their ports).