Security practitioners often focus on technical controls, but one of the most important lines of defence for an organization is the set of physical controls that it puts in place. *Physical access* to systems, facilities, and networks is *one of the easiest ways to circumvent technical controls*. ### Site Security Site security looks at the entire facility or facilities used by an organization and *implements a security plan based on the threats and risks* that are *relevant to each specific location*. That means that facilities used by an organization in different locations, or as part of different business activities, will typically have different site security plans and controls in place. Many facilities use **fencing** as a *first line of defence*. Fences act as a deterrent by both making it look challenging to access a facility and as an actual physical defence. Highly secure facilities will use multiple lines of fences, barbed wire or razor wire at the top, and other techniques to increase the security provided by the fence. A second common physical control is the placement of **bollards**. Bollards are posts or other obstacles that *prevent vehicles from moving* through an area. Bollards may look like posts, pillars, or even planters, but their purpose remains the same: preventing vehicle access. Many are placed in front of entrances to prevent both accidents and intentional attacks using vehicles. **Lighting** plays a part in exterior and interior security. Bright lighting that *does not leave shadowed or dark areas* is used to discourage intruders and to help staff feel safer. Automated lighting can also help indicate where staff are active, allowing security guards and other staff members to know where occupants are. >[!danger] Drone Defence >A newer concern for organisations is the broad use of drones and unmanned aerial vehicles (**UAVs**). Drones can be used to capture images of a site, to deliver a payload, or even to take action like cutting a wire or blocking a camera. > >Antidrone systems include systems that can detect the wireless signals and electromagnetic emissions of drones, or the heat they produce via infrared sensors, acoustic systems that listen for the sounds of drones, radar that can detect the signature of a drone flying in the area, and of course optical systems that can recognise drones. **Access badges** can play a number of roles in physical security. In addition to being used for entry access via magnetic stripe and radio frequency ID (RFID) access systems, badges also often include a picture and other information that can quickly allow personnel and guards to determine if the person is *who they say they are, what areas or access they should have, and if they are an employee or guest*. This also makes badges a target for social engineering attacks. Some organisations use **access control vestibules** (often called mantraps) as a means to ensure that only authorized individuals gain access to secure areas and that attackers do not use piggybacking attacks to enter places they shouldn't be. An access control vestibule is a *pair of doors that both require some form of authorised access* to open. ![[Access Control Vestibule.png]] The first door opens after authorisation and closes, and only after it is closed can the person who wants to enter provide their authorisation to open the second door. That way, a person following behind (piggybacking) will be noticed and presumably will be asked to leave or will be reported. ### Guards **Security guards** are used in areas where human interaction is either necessary or helpful. Guards can make decisions that technical control systems cannot, and they can provide additional capabilities by offering both detection and response capabilities. Guards are commonly placed in reception areas, deployed to roam around facilities, and stationed in security monitoring centres with access to cameras and other sensors. Visitor logs are a common control used in conjunction with security guards. Security guards also bring their *own challenges*; humans can be *fallible*, and *social engineering attempts* can persuade guards to violate policies or even to provide attackers with assistance. ### Video Surveillance, Cameras, and Sensors