[Figure: FiveStudy logo]
FiveStudy
Cybersecurity · Unit 2 · 2.2.c
AP Cybersecurity · Securing Spaces
Assessing Physical Risks
Band each finding by what it exposes and what it leads to — then write down why.
key ideaBand a physical finding by asking what it exposes and what it leads to.
The stages
A physical assessment is the ordinary risk process applied to a building. What is distinctive is the premise: physical access to a device lets an adversary bypass many technical controls, so a door can be worth more to an attacker than a firewall flaw.
1
Walk the space and list vulnerabilities
Doors, windows, racks, ports, screens, bins, power. Record what is exposed and who can reach it — not just what is missing.
in a building out a vulnerability list
2
Name the asset behind each one
A weakness matters because of what lies beyond it. Record the asset and its value: customer data, prototypes, availability of a service.
out vulnerability–asset pairs
3
Ask what an adversary would do with it
Write the mechanism, in a sentence. If you cannot describe how it would be exploited, you cannot yet score it.
out an exploitation path
4
Assign the band
High if sensitive systems or information are exposed with insufficiently controlled access. Moderate if a non-critical area could act as a foothold toward something that matters. Low if the asset is low value and exploitation is unlikely.
out high / moderate / low
5
Document it so someone else can act
Asset and value, likely threats, the specific vulnerability, and how it would be exploited. A band with no reasoning cannot be reviewed or defended later.
out a usable register
| Band | Test | Illustrative finding |
|---|
| high | sensitive systems or data exposed, access not controlled | a customer-data server in an unlocked room off an unmonitored corridor |
| moderate | a non-critical area that could be a foothold | a reception area beyond the badge line with an unattended network port |
| low | low-value asset, exploitation unlikely | laptops left on desks inside a badge-controlled office during lunch |
Compare rows 1 and 3. Both involve unattended equipment; what separates them is the value behind it and how controlled the surrounding access already is.
Applying it
Two findings can describe the same object and land in different bands. The band is a property of the situation, not of the object — an unlocked door matters entirely differently depending on what is behind it and who can already reach it.
| Finding | What lies behind it | Access already controlled? | Band |
|---|
| unlocked door | a server holding customer data | no — unmonitored corridor | high |
| unlocked door | a stationery cupboard | yes — inside the badge line | low |
| open network port | reception, outside the badge line | partly | moderate — a foothold |
| unattended laptop | employee desk | yes — badge-controlled office | low |
| unattended laptop | a public lobby | no | high |
Rows 1–2 and 4–5 are the same vulnerability scored differently. Always record the asset and the surrounding access, or the band cannot be justified.
Worked analysis
EX 1
Score a high finding
A server storing customer data sits in a room with no lock, reached through an unmonitored corridor. Assess and document it.
1
Name the asset and value
Customer data — high value, and regulated.
2
Name the vulnerability
No lock, and the approach is unmonitored, so entry leaves no record.
3
Write the mechanism
Anyone reaching the corridor can enter, attach a drive, or remove the machine.
4
Apply the band test
Sensitive systems exposed without sufficiently restricted and controlled access → high.
5
Document it
Asset, value, threat, vulnerability, mechanism, band — all five, so a reviewer can act without revisiting the site.
EX 2
Recognize a foothold
An office has a reception area beyond the badge line with an active network port and no camera. Nothing sensitive is stored there. Band it.
1
Assess the local value
Low — a waiting area holds nothing worth taking.
2
Resist scoring it low immediately
Local value is only half the test.
3
Ask what it leads to
An active port offers initial access to the internal network.
4
Apply the moderate test
A non-critical area that could act as a foothold toward other resources.
5
Band and document
Moderate — and the documentation must say what it is a foothold toward, or the score looks inflated.
EX 3
A genuinely low finding
In a badge-controlled office, employees leave laptops on desks while at lunch. Is this high risk?
1
Identify the asset
Employee laptops — some value, but not the crown jewels.
2
Assess who can reach them
Only badge-holders. Access is already restricted and controlled.
3
Assess likelihood
Exploitation requires an insider or a successful tailgate — unlikely relative to an open lobby.
4
Apply the low test
Low-value asset, unlikely exploitation → low.
5
Note what would change it
Remove the badge control, or store sensitive data unencrypted on those laptops, and the band rises immediately.
Check yourself
Why do physical vulnerabilities deserve their own assessment?
Show answer
Because physical access to devices lets adversaries bypass many technical controls and layers of security. A door can be worth more to an attacker than a software flaw.
What makes a physical risk high?
Show answer
Sensitive information or systems exposed in physical spaces without sufficiently restricted and controlled access — both halves are required.
What distinguishes a moderate risk?
Show answer
A non-critical or non-sensitive part of the organization left unprotected in a way that could act as a foothold for gaining initial access to other resources.
Give the two conditions for a low risk.
Show answer
The vulnerable asset is of low value and the vulnerability is unlikely to be exploited. One alone is not enough.