Unit 2: Securing Spaces

This topic is the course's core toolkit. It covers social engineering tactics (pretexting, authority, intimidation, consensus, scarcity, familiarity, urgency), adversary types such as script kiddies, hacktivists, insiders and cyberterrorists, and the six phases of an attack, from reconnaissance to evading detection. Risk is a threat exploiting a vulnerability to harm an asset (anything valuable); you rate it by likelihood and severity, then avoid, transfer, mitigate or accept it. Controls are physical, technical or managerial, and they prevent, detect or correct attacks; layering them is called defense in depth.

Physical attacks often use social engineering. In piggybacking, the attacker talks an authorized person into letting them in; in tailgating, they slip in behind someone who doesn't notice. Shoulder surfing, dumpster diving and card cloning are physical attacks too. Once inside, an attacker can cut power, steal or copy documents, or plug a keylogger or malware-loaded drive into a device, and natural disasters are physical threats as well.

Managerial controls include security awareness training and a workstation policy: lock your screen, keep a clean desk, use a privacy screen, and plug devices into surge protectors or an uninterruptible power supply (UPS). Other controls deter or block attackers, such as fences, bollards, locks, card readers, access control vestibules and disabled USB ports. Organizations choose among them by weighing how serious each risk is against what the fix costs.

Cameras, guards, motion sensors and alert employees detect physical intrusions, and placement matters. Put cameras on entrances and exits where they're hard to tamper with, and motion sensors in low-traffic spots like server rooms so they don't set off false alarms. Stationary guards work best where traffic funnels in, and patrolling guards on the perimeter. Badge logs help too: a door held open longer than normal can point to tailgating or piggybacking.