[Figure: FiveStudy logo]
FiveStudy
Cybersecurity · Unit 2 · 2.3.a
AP Cybersecurity · Securing Spaces
Managerial Controls for Physical Security
A policy is a control only when people can follow it and someone checks that they do.
key ideaA policy is a control only when people can follow it and someone checks that they do.
Matching controls to threats
Locks and cameras cannot decide whether to hold a door. Managerial controls — training and policy — are what answer attacks that work by persuading a person rather than by defeating a device.
| Attack | Why devices fall short | Managerial control |
|---|
| phishing and pretexting | the message reaches a person, not a lock | training to detect social engineering |
| piggybacking | the door was opened deliberately | a rule against badging others in |
| device theft | an unattended laptop has no defender | policy on securing devices |
| shoulder surfing | the screen is doing its job | workstation policy — screen position, privacy filters |
| an unlocked, unattended machine | the lock is a habit, not a device | lock before leaving, enforced by policy and timeout |
Each row is an attack a physical control cannot reach. These three areas are exactly what EK 2.3.A.1 names — detecting social engineering, not badging others in, and preventing device theft.
Managerial controlA policy, procedure or training program — a control implemented through people rather than hardware or software.
Workstation security policyThe measures required to protect a physical workplace, often tiered by the type of data handled.
Clear deskNothing sensitive left visible or reachable when the desk is unattended.
ChallengePolitely asking an unbadged person who they are — the behavior training exists to make normal rather than rude.
Layering
The failure mode of a managerial control is not that it is wrong — it is that it is written and then ignored. Training, reinforcement and verification are what turn a document into a control.what the CED requires
- Train staff to detect social engineering — the entry point for most physical intrusions.
- State plainly that badging others into restricted areas is not permitted, and why.
- Make device theft prevention concrete: what to lock, where, and when.
- A workstation security policy may have tiers matched to the sensitivity of the data handled.
| Workstation tier | Data handled | Typical requirements |
|---|
| standard | internal, non-sensitive | lock before leaving, clear desk at end of day |
| elevated | customer or personal data | the above, plus privacy filter and screen positioned away from walkways |
| restricted | regulated or highly sensitive | the above, plus no personal devices, no removable media, supervised area |
Tiering is what keeps a policy credible. A single rule strict enough for the restricted tier would be ignored everywhere else, and a rule loose enough for everyone protects nothing.
Worked analysis
EX 1
Turn an incident into a control
After a tester was let through three doors, an organization asks what to change. Recommend managerial controls.
1
Identify the mechanism
Staff chose to hold doors — a decision, not a device failure.
2
Write the rule
Every person badges individually; no exceptions for people carrying things.
3
Remove the social cost
Train a scripted, polite challenge so refusing does not feel like an accusation.
4
Reinforce it
Supervisors badge in individually too. A rule leaders skip is not a rule.
5
Verify it
Periodic drills and door-held-open reports, with results fed back to teams.
EX 2
Write a workstation policy that will be followed
A clinic wants one policy covering reception, clinical rooms and the records office. Advise.
1
Reject the single tier
One rule cannot fit a public desk and a records office.
2
Tier by data handled
Reception standard, clinical elevated, records restricted.
3
Make each requirement checkable
‘Lock before leaving the desk’ is checkable; ‘be careful’ is not.
4
Pair with a technical control
An automatic screen lock catches the times the habit fails.
5
State the principle
Policies are followed when they are specific, tiered and physically possible — not when they are strict.
EX 3
The policy nobody read
An organization has a thorough security policy on the intranet. Staff still badge visitors in. What is missing?
1
Check existence
The policy exists — that part is done.
2
Check training
Publishing is not training. Nobody practiced the challenge.
3
Check reinforcement
If managers badge people in, staff correctly read the real rule.
4
Check verification
With no drills, nobody learns the policy has decayed.
5
Name the gap
Three of the four stages. A document is the start of a managerial control, not the control.
Check yourself
What three areas does the CED name for physical security training?
Show answer
Detecting social engineering attempts like phishing, not badging other people into restricted areas, and preventing device theft.
What is a workstation security policy, and why might it be tiered?
Show answer
A policy setting out measures to protect the physical workplace — typically locking devices before leaving them. Tiers match the sensitivity of the data handled at each workstation, so the rules stay proportionate and are actually followed.
Why can managerial controls answer attacks that physical controls cannot?
Show answer
Attacks like piggybacking and phishing work by persuading a person. The door and the mail server both operated correctly; only training and policy address the decision.
What turns a written policy into a working control?
Show answer
Training so people can follow it, reinforcement so it is socially normal, and verification so decay is noticed. A published document alone changes nothing.