EDUCATION, PHYSICAL SECURITY

🛡️ Physical security in cyber security

Physical security is the core layer of cyber security: if an attacker has physical access to the device, logical controls are no longer protected. Multilayer protection, safe zones, 5 D model and standards (ISO 27002 Chapter 7, NIST SP 800-53 PE, NIST SP 800-88). Examples are fictional, designed for training.

Legend: codes in brackets (e.g. 7.4) refers to controls in Chapter 7 (physical) of ISO/IEC 27002:2022.

Why It Is Important

Physical access to circumvent logical controls

Physical access to circumvent logical controls The network attacker is stopped by the logical control barrier, but the physical access bypasses it and reaches the server along the lower path. Physical access to bypass logic If the attacker has physical access to the device, it's no longer just your device Network attacker (remote) Logical controls Firewall MFA, SAM Encryption EDR / AV Segmentation, logging stopping network path SERVERIS, DATA console, discs, RAMs, ports (physical boundary) Physical access (room presence) circumvent all logical controls Vectors: console, BadUSB, disk removal, lock-boot RAM, evil made

Basic principle: physical and cyber security have merged together. Physical presence allows to bypass firewall, MFA and encryption - therefore, physical controls are as important as network controls. This is also reflected in ISO 27001 Annex A.7 mandatory physical controls.

Why is it cyber security

Physical access allows you to connect devices, remove disks, read RAMs or connect to console - bypassing network and authentication controls. Therefore, server rooms, data centres and terminals are part of the attack surface.

Classical physical attacks

Evil bag (unsupervised device), hold-boot (RAM key reading), DMA via Thunderbolt/PCIE, BadUSB and read stolen disks. Countermeasures: full disc encryption, Secure Boot/TPM, port blocking, BIOS password.

Objective

Restricts who physically approaches the assets (lat privailege also premises) and arranges protection in layers (safe harbours) so that a breach of one layer does not give immediate access to the data.

Multilayer protection

Concentric safety zones - from perimeter to device

Concentric physical security areas Six nested areas from the outer perimeter to the medium in the centre, each with its own ISO 27002 control. Safety zones (deep protection) Each layer adds deterrence, detection and delay Perimeter / area ISO 7.1 - Fence, CCTV, lighting Building ISO 7.2 - controlled entry, register Safe area / Office ISO 7.3.7.6 - badge, clean desk Data Centre ISO 7.4 - Monitoring, Mantrap Cabinet lock Device Core: TPM, full disk encryption, port blocking, seals

Multilayer protection: no individual controls are sufficient. Layers are independent of each other, so one violation (e.g. intrusion into the building) is still faced with the next one (budge to the safe area, mantrap data center, lock in the closet).

Perimeter and input (7.1,7.2)

Clearly defined perimeter (fence, wall, security item), controlled entry points with badge/PIN, registration and escorting of visitors. Purpose - only the trustees get inside and it is traceable.

Safe areas and work there (7.3/7.6)

Sensitive spaces are separated separately, with additional access control, clean desk / clean screen and rules for recording devices. Work in the safe area shall be monitored and documented.

Particular features of data centre (7.4)

Continuous monitoring (CCTV, alarms, badge logs), mantrap/loose against timekeeping, separate access to server queues and environmental controls. Access logs shall be kept and periodically reviewed.

Protection objectives

5 D model - deter, detect, deny, delay, react

Physical safety 5 Model D Five consecutive protection goals - Deter, Detect, Danny, Delay, Reply - each with examples. 5 D - successive protection objectives The attacker moves left → right. Objective: delay longer than response time 1. Abstention - fence, gates - lighting - visible CCTV - warning signs - security item Deter 2. Discover - motion sensors - CCTV entry - alarm - badge magazines - door contacts Detect 3. To freeze - locks - badge / PIN - biometrics - mantrap / slues - guard Danny 4. Delay - multiple layers - safes, cabinets - fixed doors - grids, barriers - seals Delay 5. Respond - security - call (112) - incident plan - escalation - evidence Respond Main formula: delay time > detection + response time

CPTED and 5 D: physical security is not a guarantee of non-refoulement, but of an attack being spotted and stopped before reaching the target. Therefore, the delay should be longer than the time needed for detection and response.

International practice

ISO/IEC 27002:2022 Chapter 7 and NIST SP 800-53 PE

ISO 27002:2022 control topics Four ISO 27002:2022 control topics. Physical controls (Chapter 7, 14 controls) are highlighted. ISO/IEC 27002:2022 - 4 control topics Organisational chapter 5, 37 controls Staff chapter 6, 8 controls Physical chapter 7, 14 controls ← this section Technological chapter 8, 34 controls ISO 27001 Annex A.7 reflects these 14 physical controls, NIST SP 800-53 equivalent - PE family
ISO 7.1
Physical security perimeters

Defined perimeters around areas with sensitive information.

ISO 7.2
Physical entrance

Entry control, visitor register and accompanying.

ISO 7.3
Provision of offices, premises and equipment

Physical protection and arrangement of sensitive spaces.

ISO 7.4
Physical security monitoring

Continuous surveillance (CCTV, alarms, magazines).

ISO 7.5
Protection against physical and environmental risks

Fire, floods, earthquakes, civil unrest, etc.

ISO 7.6
Working in safe areas

Rules and supervision for working in sensitive premises.

ISO 7.7
Clean table and clean screen

Documents and screens are not left unattended.

ISO 7.8
Location and protection of equipment

Equipment shall be so positioned as to minimise risks.

ISO 7.9
Security of assets outdoors

Protection of laptops, mobile devices outside the office.

ISO 7.10
Media

Circulation, storage and transport of media.

ISO 7.11
Support Utilities

Electricity, cooling, water - continuity.

ISO 7.12
Cable safety

Protection of power and data cables against damage/hearing.

ISO 7.13
Maintenance of equipment

Planned maintenance to maintain availability and integrity.

ISO 7.14
Safe disposal or reuse

Safe deletion of media before discarding/re-use.

NIST SP 800-53 - PE family

Physical and Environmental Protection: PE-2 (access mandates), PE-3 (access control), PE-6 (monitoring), PE-8 (visitor log), PE-13 (fire protection), PE-14 (temperature/humidity), PE-15 (water), PE-18 (component location).

NIS2 and national legislation

The risk management measures of Article 21 of the NIS2 (EU 2022/2555) include the security of the physical environment, access control and asset management. Latvian laws and regulations set minimum requirements, including physical protection for critical resources.

Other relevant standards

PCI DSS Requirement 9 (physical access to card data), ISO 27001 Annex A.7 (audit reference) and NIST SP 800-116 (for PIV/PACS card access control).

Compliance in Latvia - the main requirement is national laws and regulations: National laws and regulations are mandatory regulations in Latvia that determine what is mandatory (in the national cyber security framework, implementing NIS2). Implementing Regulation (EU) 2024/2690 and GDPR complement the requirements. International standards (ISO 27001/27002, COBIT, SABSA, TOGAF, NIST) provide a recognised auditable method for their implementation.

Levels of compliance - from EU law to implementation Three layers: EU legal basis (NIS2, Implementing Regulation 2024/2690, GDPR), national legislation and international enforcement standards (ISO, COBIT, SABSA, TOGAF, NIST). From requirement to implementation: law defines KO, standards - VU EU LEGAL BASIS NIS2 Directive (EU) 2022/2555 Implementing Regulation (EU) 2024/2690 DGPR (EU) 2016/679 transposed nationally National Cybersecurity Law and its subordinates WHAT to do is mandatory, national cybersecurity legal framework introduced by recognised standards INTERNATIONAL IMPLEMENTATION STANDARDS - HOW ISO 27001 / 27002 COBIT SABSA TOGAF NIST CSF / 800-53

Regulatory acts shall determine the result to be achieved. The international standard is a verifiable way to achieve it - without it compliance remains declarative.

Regulatory acts - mandatory requirement

Latvia's binding regulation sets minimum requirements for physical and environmental safety for critical resources. Implementation is based on ISO 27002 Chapter 7 and NIST SP 800-53 PE - they give specific areas, controls and inspections.

Implementing Regulation (EU) 2024/2690

The Annex requires environmental and physical security measures: protection against physical and environmental threats, control of access to premises and security of support infrastructure (electricity, cooling) - ISO 27002 Chapter 7 controls.

GDPR - media

Physical access to and secure destruction of data media (NIST SP 800-88) is part of the protection of personal data (GDPR). A stolen or discarded disk with data is a data protection breach like a network intrusion.

Attacks and countermeasures

Physical threats and their controls

Taigating and mantrap To the left timeold - two people go out with one badge. The mantrap on the right with two locked doors is released one by one. Taigating vs. mantrap Tilgating / piggybacking badge without badge → follows Mantrap / Mesh one badge = one person external internal both doors are never open at once
Tailging
Follow open doors

An unauthorised person shall enter by proxy.

√ mantrap, turnips, notification, security
Badge / RFID cloning
Copying cards

Weak encrypted RFID cards are read and cloned.

Encrypted maps, PIN+Bedge, biometric
Shoulder surfing
Viewing over the shoulder

Reading passwords/PINs from screen or keyboard.

√ privacy screens, clean screen, location
Dumpster diving
Waste disposal

Disposal of documents and media without destruction.

7.14)
Evil mad
Unsupervised device

Temporary physical access modifies the installation.

PDE, Secure Boot/TPM, seals, safes
Theft/loss
Loss of devices and carriers

Laptops, discs and phones disappear or are stolen.

encryption, remote deletion, inventory
Lock picking
Circumvention of mechanical locks

Weak locks open without a key.

quality locks, electronic control, magazines
TEMPEST
Electromagnetic leakage

Interception of signals from cables/screens.

√ shielding, cable safety (7.12), zoning

Environment, Utilities and Carriers

Safe disposal of environmental control and media

Environmental control of data centre Server cabinet in the centre with four environmental controls - powering, cooling, fire fighting and water leakage detection. Environmental and Utility Control (ISO 7.5, 7.11) Server cabinet availability = safety objective Feeding UPS + generator redundance (A/B) Cooling HVAC, temperature humidity control Fire-fighting inert gas, detectors Early detection of VESDA Water / leak release sensors raised floors

Availability is security: environmental and utility control (ISO 7.5, 7.11) protects the availability of information - a feed, cooling or fire incident is as serious as an attack. Cables shall be individually protected (ISO 7.12).

SP 800-88, Clear
Logical deletion

Rewriting with standard commands - protects against simple renewal. SSD is not enough (reserve cells) - used in Purge. The carrier remains usable.

SP 800-88, Purge
In-depth deletion

Cryptographic quenching, tasting or built-in safe terrace - the data is not renewable even in the laboratory.

SP 800-88, Destroy
Physical destruction

Shredding, incineration, melting - for the highest classification. The carry can no longer be used.

Physical-Cyber Convergence

Modern access control (PACS), IP cameras and BMS systems are in the network - the same is the surface of the attack. Segment them from the production network, update the software and do not use default passwords.

Transmission of media (ISO 7.10/7.14)

Carriers are labelled by classification, controlled transport, stored safely and destroyed by NIST SP 800-88 and IEEE 2883-2022 (methods for modern carriers). The method of erasure is consistent with the classification of the data higher class, a more stringent method.

Abbreviations

Abbreviations used in the Roadmap: the original name and what it means.

CPTED
Crime Prevention Through Environmental Design - crime prevention with environmental planning - lighting, visibility, roads.
PACS
Physical Access Control System - physical access system - maps, readers, doors.
CCTV
Closed-Circuit Television - video surveillance.
RFID
Radio-Frequency Identification - contactless cards and tags.
PIV
Personal Identity Verification - U.S. national employee identity card.
Mantrap
Two door locks - the other open only when first closed.
Tailgating
Entry following an authorised person through the door.
TEMPEST
Protection against data reading from electromagnetic radiation of devices.
BadUSB
A USB device that claims to be a keyboard and enters commands.
DMA
Direct Memory Access - devices for direct access to memory (Thunderbolt, PCIe) - can read keys.
TPM
Trusted Platform Module - a microchip that stores encryption keys and checks loading.
FDE
Full Disk Encryption - full disc encryption.
UPS
Uninterruptible Power Supply - continuous power supply.
HVAC / BMS
Heating, Ventilation, Air Conditioning / Building Management System - climate system / building management system.
VESDA
Very Early Smoke Detection Apparatus - very early smoke detection in server rooms.