[Figure: FiveStudy logo]
FiveStudy
Cybersecurity · Unit 2 · 2.4.c
AP Cybersecurity · Securing Spaces
Applying Physical Detection Techniques
One sensor rarely resolves anything. Pair the trigger with a camera and the ambiguity goes.
key ideaOne sensor rarely resolves an incident. Pair a trigger with a camera and the ambiguity disappears.
What to look for
Detection in practice is a two-stage operation: something notices, and something else confirms. A motion alert alone leaves you guessing; a motion alert plus the camera covering that room answers the question in seconds.
| Technique | What it gives you | Pair it with | Why the pairing matters |
|---|
| cameras | visual monitoring and a visual record | motion alerts, badge events | turns a record into a live answer |
| facial recognition | alerts when unauthorized individuals enter controlled areas | camera coverage at entries | removes the need for a person to be watching |
| motion detectors | movement in a low-traffic space | cameras | lets defenders verify visually before responding |
| door-open duration | how long a door stayed open per badge event | entry-log review | long openings suggest piggybacking or tailgating |
Row 4 is the quietest and often the most useful. A badge event with an unusually long door-open time is a measurable signature of a second person entering on one swipe.
the four techniques
- Once a breach is detected, defenders use live or recorded footage to identify and track the adversary.
- Motion detectors work best paired with cameras — the alert says where to look.
- Door sensors record how long the door was open; review entry logs for openings longer than normal.
- Facial recognition can alert on unauthorized entry without anyone watching a screen.
Reading the evidence
Notice that the third stage is where a person re-enters. Sensors narrow the question; footage answers it — and the last stage exists so the next analyst knows what happened.door-open durations, one door, one shiftthe same door, six badge events
door=lab-b badge=E0441 open_ms=2800 -- typical single entry
door=lab-b badge=E0441 open_ms=2740
door=lab-b badge=E0441 open_ms=2810
door=lab-b badge=E0102 open_ms=9600 -- 3.4x the median
door=lab-b badge=E0102 open_ms=2900
door=lab-b badge=E0779 open_ms=10250 -- again, same shift
open_ms=2800the baseline — one person, door closes behind themopen_ms=96003.4× the median — long enough for a second personbadge=E0102 twicethe same badge again, normally — so the badge is not faultyopen_ms=10250a second long opening on the same shift — a pattern, not an accidentwhat to dopull the camera for those two timestamps and confirm
Worked analysis
EX 1
Resolve a motion alert
At 02:14 a motion sensor fires in the archive room. Nothing else has alerted. Walk through the response.
1
Do not dispatch blind
A lone motion alert could be an animal, an HVAC vent, or a person.
2
Verify visually
Open the camera covering the archive — live first, then the preceding minutes.
3
Correlate with access
Check for a badge event near that time. None means nobody entered legitimately.
4
Decide
Person on camera plus no badge event → confirmed breach; dispatch and lock down.
5
Record the outcome
Log what was seen and what was done — false alarms are useful data too.
EX 2
Find the piggybacking in a log
A lab door's median open time is 2.8 s. Twice in one shift it stayed open over 9 s. What does this suggest, and how do you confirm it?
1
Establish the baseline
2.8 s across many events is what one person looks like.
2
Note the deviation
Over 9 s is more than three times the baseline, twice.
3
State the hypothesis
Piggybacking or tailgating — the door held for a second person.
4
Confirm it
Pull the camera footage for those two timestamps.
5
Note why this works
The sensor records duration whether or not anyone was watching, so the evidence exists before the suspicion does.
EX 3
What facial recognition adds
An organization already records every entry on camera. What does adding facial recognition change?
1
State the current position
Footage exists, but detection depends on someone watching or reviewing later.
2
State what recognition adds
An automatic alert when an unauthorized individual enters a controlled area.
3
Name the shift
From after-incident review to detection at the moment of entry.
4
Note the requirement
It needs an accurate roster of who is authorized, kept current.
5
Note the limit
It identifies faces, not intent — a person with a cloned badge and a legitimate face still passes.
Check yourself
Why do motion detectors work best paired with cameras?
Show answer
When a motion alert is raised, defenders can use the camera to check the space visually and verify whether there is a real breach — instead of dispatching on an ambiguous signal.
How can entry logs reveal piggybacking or tailgating?
Show answer
A door sensor records how long the door was open. Reviewing the logs for openings longer than normal surfaces the events where a second person came through on one swipe.
What can defenders do once a physical breach is detected?
Show answer
Use live or recorded footage to identify the adversary and track their movement through the space, which drives both the immediate response and the investigation.
What does facial recognition add to a camera system?
Show answer
It can alert automatically when unauthorized individuals enter controlled areas, so detection no longer depends on a person watching the feed.