Wk3 - Digi Business

Physical security

Protecting physical items, objects, or areas from unauthorized access or misuse

Why physical security matters

If someone gets physical access to hardware, they can bypass tech-based (logical) security controls entirely

5 levels of physical security

Minimum, Low, Mid, High, Maximum — security increases based on how sensitive/valuable the site is

Minimum security example

A home with basic locks and doors

Maximum security example

Nuclear facilities or military bases with 24/7 armed surveillance

Tailgating

When an unauthorized person follows an authorized person through a door without their own access credential

Why ID cards shouldn't be the only control

They can be stolen, duplicated, or modified

CCTV's main weakness

It's passive — it records but doesn't prevent an incident, often only reviewed after a break-in

Fail-safe lock

A lock that unlocks automatically during a failure/emergency (e.g. for fire safety)

Fail-secure lock

A lock that stays locked during a failure, prioritizing security over easy exit

CompuTrace

Software on a laptop that reports its location to a monitoring center if stolen

In-house vs outsourced physical security tradeoff

Outsourcing gives expert experience but costs more and means less control/trust placed in another company

Logical access control

Technical controls (like passwords/permissions) that enforce security policy on IT systems

3 objectives of access control

Confirm user identity, restrict user actions to authorized ones, confirm resources are authentic

Permissions - 3 parts

Entity (who), Action (what they can do), Object (what resource it applies to)

Principle of least privilege

Give users only the minimum access needed to do their job

Separation of duties

Split critical tasks across multiple people so no single person has full control

DAC (Discretionary Access Control)

The resource owner decides who gets access — flexible but inconsistent across an organization

MAC (Mandatory Access Control)

A central authority (not the owner) decides and the system enforces access — used where consistency/security matters most (e.g. military)

RBAC (Role-Based Access Control)

Access is tied to a user's role, so permissions update by changing the role, not each individual

Identification

Claiming who you are (e.g. entering a username/User ID)

Authentication

Proving your identity is real (e.g. password, fingerprint)

Authorization

Being granted specific access rights after identity is confirmed

Order of identification, authentication, authorization

Identification, then Authentication, then Authorization — always in that order