[Figure: FiveStudy logo]
FiveStudy
Cybersecurity · Unit 2 · 2.4.a
AP Cybersecurity · Securing Spaces
How Controls Detect Physical Attacks
Detection is worth having only if the signal reaches somebody who will act on it.
key ideaDetection is worth having only if someone or something receives the signal.
What to look for
A camera nobody watches records a crime for later. A motion sensor that cries wolf trains people to ignore it. Every detective control here has the same requirement: a signal that reaches somebody who will act on it.
| Control | What it detects | Requirement | Limitation |
|---|
| cameras | a visual record of malicious activity | recorded and monitored for maximum effect | unmonitored footage is evidence, not detection |
| motion sensors | movement in an area | an alert path to a person | false alarms where traffic is normal |
| security guards | activity, judged in context | coverage and clear escalation | cost; cannot be everywhere |
| employees | an unauthorized person in their space | knowing how and whom to tell | only works if reporting is easy and welcomed |
Row 4 is the one organizations forget to fund. Employees are often the first to notice an unfamiliar person — and the cheapest way to lose that is to make reporting awkward.
four detectors, four requirements
- A camera's value is recorded and monitored — recording alone serves the investigation, not the response.
- Recordings are especially helpful after an incident: what was taken, by whom, and when.
- Guards are the only control here that can respond rather than merely report.
- Employees detect for free, but only if reporting is easy and never punished.
Reading the evidence
Reading left to right, the controls get slower to deploy and better at judgment. Sensors detect; only people decide — which is why a detection design has to end at a human, not at a device.door controller and sensor log, one eveningbadge events with door-open duration, alongside motion
08:12 door=main-lobby badge=E1042 open_ms=3100 result=OK
08:12 door=main-lobby badge=E0887 open_ms=2950 result=OK
19:47 door=server-room badge=E0233 open_ms=11400 result=OK <-- held
19:47 motion=server-room confidence=0.94
19:48 door=server-room badge=- open_ms=0 result=none
23:05 motion=server-room confidence=0.91
23:05 door=server-room badge=- open_ms=0 result=none
open_ms=3100normal — one person, door closes behind themopen_ms=11400eleven seconds — long enough for a second person to followmotion=server-room 19:47movement immediately after — consistent with two entrantsbadge=- at 19:48motion with no badge event — someone inside who never swiped23:05motion hours later with no badge — the strongest single indicator in this log
Worked analysis
EX 1
Detection that detected nothing
A theft is discovered on Monday. Cameras recorded everything but nobody was watching. Was the camera a detective control?
1
Separate the two functions
Recording produced evidence; nobody produced detection.
2
Judge against the requirement
The CED says feeds should be recorded and monitored for maximum effect.
3
State what was lost
The chance to intervene while it was happening.
4
State what was gained
An after-incident investigation with a clear record — genuinely valuable.
5
Give the fix
Pair recording with monitoring — live review, or motion-triggered alerts routed to a person.
EX 2
Sensors that trained people to ignore them
Motion sensors in a busy corridor generate 300 alerts a day. Staff have muted the panel. Diagnose.
1
Identify the placement error
A high-traffic area where movement is entirely expected.
2
Name the consequence
Constant false alarms, so alarms stop being taken seriously.
3
Note the second-order harm
The muted panel also covers areas where an alert would have meant something.
4
Give the correct placement
Where traffic is unexpected — server rooms, storage for sensitive materials.
5
State the principle
A detection control is judged by signal-to-noise, not by how much it covers.
EX 3
The cheapest detector
An unfamiliar person in a lanyard walks through an open-plan office. Three employees notice; none say anything. What failed?
1
Note that detection succeeded
Three people noticed — the signal existed.
2
Identify where it stopped
It never left their heads. No report, no record.
3
Diagnose the cause
Usually uncertainty about whom to tell, or fear of embarrassing a colleague.
4
Give the fix
One well-known number, a scripted challenge, and no penalty for being wrong.
5
State the value
Employees are the first to notice an unauthorized person and cost nothing — the entire investment is making it easy to speak up.
Check yourself
What does the CED require for a camera to be maximally effective?
Show answer
The feed should be recorded and monitored. Recording alone helps after-incident investigations; monitoring is what makes it a detection rather than a record.
Where should motion sensors go, and why not everywhere?
Show answer
Where traffic is unexpected — server rooms, sensitive storage. In high-traffic areas they produce many false alarms, which makes every alarm less likely to be taken seriously.
What can a security guard do that no sensor can?
Show answer
Respond. Guards monitor activity, judge it in context, and act on suspicious activity once detected.
Why are employees an important detective control?
Show answer
They are often the first to notice an unauthorized person in their space. The control costs nothing to deploy and everything depends on making reporting easy and safe.