[Figure: FiveStudy logo]
FiveStudy
Cybersecurity · Unit 2 · 2.3.b
AP Cybersecurity · Securing Spaces
Layered Physical Mitigation
Choose each control by the mechanism it interrupts — then layer prevention, detection and recovery.
key ideaPick the control that interrupts the mechanism. Then layer prevent, detect, correct.
Matching controls to threats
A control is chosen because it breaks a specific step in a specific attack — never because it sounds secure.
the reasoning chain
- Name the vulnerability.
- Say how an adversary would exploit it.
- Choose the control that interrupts that step.
- State its function: prevent, detect or correct.
| Vulnerability | Exploited by | Control | Function |
|---|
| Open approach to the site | ramming or driving up | fencing, gates, bollards | preventive |
| Unsecured doors and racks | walking off with a device | locks on doors and cabinets | preventive |
| No record of entry | a lost or borrowed badge | card readers | preventive + detective |
| Tailgating at a door | following staff through on one swipe | vestibules, turnstiles | preventive |
| Exposed USB ports | plugging in a drive to load malware | disable USB ports | preventive |
| Power loss | waiting for cameras to go dark | UPS, generators | corrective |
Read the middle column first. If you cannot say how the adversary acts, you cannot justify the control.
Preventivestops it happening — bollards, locks, turnstiles
Detectivereveals it happened — reader logs, guards
Correctiverestores service — UPS, generators
Layering
No single control suffices. Layering forces an adversary through several and creates chances to detect them in between.
Each ring interrupts a different mechanism, so the layers add rather than duplicate. A card reader stops a bad badge but not tailgating — that needs the next ring in.[Figure: The same layering as a real site: fence and gated approach, then the building shell, then controlled interior rooms. Each boundary is a separate decision, and an adversary must defeat all of them in order.]
The same layering as a real site: fence and gated approach, then the building shell, then controlled interior rooms. Each boundary is a separate decision, and an adversary must defeat all of them in order.how to layer
- Each layer stops a different mechanism — more of the same control is not a layer.
- Detection belongs in the stack, not just prevention.
- Prioritize by risk severity against control cost.
- High severity + low cost goes first; expensive controls for minor risks may be deferred.
Worked analysis
EX 1
Choose controls for a vulnerability
A clinic keeps its patient-record server in an unlocked closet off a public corridor, with no badge reader. Recommend mitigations and give each one's function.
1
Name the vulnerability
Uncontrolled physical access to a critical asset, on a route the public already uses.
2
Describe the exploitation
Walk in, open the closet, then steal the server, copy records to a drive, or plug in malware.
3
Interrupt each step
Room access → card reader. Hardware → cabinet lock. Malware → disable USB ports. All preventive.
4
Add detect and correct
The reader's log is detective — the clinic has none today. A UPS is corrective, keeping records available.
5
Prioritize
Lock and reader are cheap against a high-severity risk (regulated data), so they go first. Building generators can wait.
EX 2
A control that misses the mechanism
After a visitor followed an employee through a badge door and photographed a whiteboard, a manager proposes buying more card readers. Evaluate.
1
Name what happened
Tailgating — the visitor never needed a credential, because one swipe admitted two people.
2
Test the proposal
A card reader authenticates a badge. It does not count people, so the mechanism is untouched.
3
Name the right control
A vestibule or turnstile enforces one person per authorization — exactly the step that failed.
4
Keep what works
The readers stay valuable as a detective control: the log shows which swipe was followed, and when.
5
Generalize
More of a control you already have is not a mitigation unless it addresses the mechanism that failed.
EX 3
Prioritize under a budget
Four rated risks: (a) vehicle ramming, high, bollards $18k; (b) unlocked equipment cages, high, padlocks $400; (c) no entry logging, medium, readers $6k; (d) power cuts to the alarm panel, medium, UPS $700. Order the spend.
1
Rank by reduction per pound
Severity alone is not the criterion — cost is the other half.
2
Cheap and high-severity first
(b) padlocks, $400. The clearest win; do it immediately.
3
Then cheap and medium
(d) UPS, $700 — corrective, and it keeps detection alive during an outage.
4
Then mid-cost
(c) readers, $6k, giving the site its first detective capability.
5
Document the deferral
(a) bollards are high severity but $18k. Defer only with a recorded decision to accept or transfer the residual risk.
Check yourself
Which control defeats tailgating, and why do card readers not?
Show answer
A vestibule or turnstile, because it enforces one person per authorization. A reader validates a badge but cannot stop a second person walking through on the same swipe.
Name a control here whose function is corrective rather than preventive.
Show answer
A UPS or generator. It does not stop the power loss; it maintains availability through it. Bollards, locks, turnstiles and disabled USB ports are all preventive.
Why bollards rather than just a fence?
Show answer
A fence delays and marks a boundary; bollards physically stop a vehicle reaching the building. Different mechanism, so they layer rather than duplicate.
Give one preventive and one detective benefit of card readers.
Show answer
Preventive: they deny access to unauthorized badges. Detective: they record which badge opened which entry at what time, producing an audit trail.
Why disable USB ports on a machine already locked in a cabinet?
Show answer
Defense in depth. The lock can fail or be bypassed by someone with legitimate room access; disabling ports removes the malware-loading step even at the machine.
Two risks are both high. One control costs $400, the other $18,000. What drives the order?
Show answer
Severity of the risk together with the cost of the mitigation — so the $400 control goes first, and the expensive one is scheduled, deferred, or its residual risk formally accepted.