Entrances should be properly secured using layered controls to prevent adversaries from breaching the facilities.
Control Type: Physical
Control Function: Preventive
Securing the physical entrances to facilities is the next line of defense after securing the physical perimeter. Depending on the organization, there may be ample opportunities for adversaries to walk into the organization and begin attacking the organization’s network infrastructure. This risk varies according to the size of the organization and the scope of its services. For example, a publicly accessible bank has a greater risk of intrusion than a small real estate office. This is why a proper risk assessment is so important when planning for security controls.
There are two common tactics adversaries may use to physically breach an organization:
- Tailgating: the adversary slips through a door behind an authorized individual without their knowledge or consent. The adversary could sit outside the entrance reading a newspaper early in the morning when everyone is arriving for work. When an individual approaches the door and unlocks it with their keycard, the adversary can stealthily get up and slip in before the door closes.
- Piggybacking: the adversary uses an authorized person as their “in”. They try to take advantage of the basic human instinct to hold the door for someone behind. Even in environments like college campuses that employ key cards for authorization, most people still decide to hold the door for those behind them without them authenticating. Other scenarios used in piggybacking include adversaries posing as third party delivery staff or external authority figures.
There are several strategies commonly used to secure entrance. The size of the organization, and the available budget for physical security greatly influence what controls are ultimately chosen. Organizations should employ the most effective option that also falls within budget.
- Badge Readers: as previously discussed, physical access control systems are recommended for larger facilities that are comprised of many employees with varying access needs. NFC or RFID based badge scanners are more efficient than old fashioned keys. Employees need to be educated on the responsibility they hold for keeping their badges safe. They should also be trained to not hold the door for any individuals who have not swiped their own badge.
- Turnstiles: commonly found in corporate lobbies, turnstiles are mechanisms that only allow one individual to enter at a time. This helps mitigate tailgating attacks, as the delay between the individuals allowed to enter provides a better opportunity for the adversary to be noticed and scrutinized. There are a variety of turnstile types that address different scenarios, including optical turnstiles and tripod turnstiles.
- Mantraps: these systems break entrances down into enclosed spaces with two doors. One door is opened by authenticating with a key card. The individual enters the door and finds himself in a small room with a second door permitting access to the full facilities. In most mantraps, the first door must close completely before the second can be opened. This helps mitigate piggybacking and tailgating, as adversaries can be more readily noticed.
- Human Security Guards: in larger organizations with extensive entrances, such as corporate lobbies and airports, human security staff may be employed to actively or passively monitor foot traffic. Security guards could actively stop individuals walking in and request to see their credentials (company card, ID, etc.) before allowing them to proceed. They could also simply observe foot traffic, ensuring the proper functionality of controls like turnstiles and mantraps.