AP® Cybersecurity review sheet from Aim for Five (aimforfive.com/cybersecurity/units/2/2-4)
Unit 2 · Topic 2.4
2.4 Detecting Physical Attacks
Prevention eventually fails, so you also need ways to notice an intruder. This topic covers cameras, guards, motion sensors and alert employees, where to place each one, and how to use camera footage and badge logs to spot physical attacks like tailgating.
Key terms
- security camera
- motion sensor
- false alarm
- stationary vs. patrolling guard
- badge entry log
- detective control
Ways to detect a physical attack
- Cameras capture a visual record of what an adversary does. For the most value, the feed should be both recorded and watched. Recordings are especially useful in investigations afterward. Paired with facial recognition software, cameras can alert security when an unauthorized person enters a controlled area.
- Security guards watch an area and respond as soon as they see something suspicious.
- Motion sensors alert security when something moves in an area.
- Employees who work in a space are often the first to notice someone who doesn't belong, and they can alert security. Training makes them better at it.
Placing detective controls well
Where you put a control matters as much as which one you choose.
- Cameras: think about coverage, angle and whether an adversary could tamper with the camera, such as by mounting it high and out of reach. Ask what a camera at that spot would capture and how that would help. Points of ingress and egress (entrances and exits) are the usual first choice.
- Motion sensors: put them where movement shouldn't happen, like a server room or a records room few people enter. In a busy hallway they'd go off constantly. Too many false alarms teach people to ignore them, so a real alarm might be dismissed.
- Locks: on every entry to an area with sensitive information or systems. For the most sensitive areas, use an access control vestibule to stop piggybacking and tailgating.
- Guards: stationary guards give constant protection to one spot, and they work best where traffic funnels through, like an entry gate, main lobby or the door to a secure area. Patrolling guards are harder for an adversary to plan around and put them under time pressure, so they suit perimeters and outdoor areas.
Using the evidence
Detective controls work best together. When a motion sensor goes off, defenders can check a camera to see whether there's a real intruder or just a false alarm. Once a breach is confirmed, live and recorded footage lets them track where the adversary went and what they did.
Badge systems help too. When a door opens with a badge, a sensor can record how long the door stayed open. A normal entry might keep the door open for 4 to 6 seconds. A door that stays open much longer after a single badge swipe suggests a second person may have come through, a sign of piggybacking or tailgating. Investigators can then pull the camera footage for that time.
Worked examples
Try each one yourself first, then open the solution.
- Example 1
Reading a badge log
The badge log for the server room door at Lakeside Logistics shows: 08:02, badge 1174, door open 5 s. 08:41, badge 2039, door open 4 s. 12:15, badge 1174, door open 19 s. 12:16, no badge, door closed. 15:30, badge 3310, door open 6 s. Which entry suggests a physical attack, and what should the investigator do next?
Show the solutionHide the solution
- Step 1: Find the normal pattern: most entries keep the door open 4 to 6 seconds.
- Step 2: Find the outlier: at 12:15 the door stayed open 19 seconds after one badge swipe, more than three times as long as normal.
- Step 3: Interpret it: a long door-open time after one swipe can mean a second person followed the badge holder in, which is tailgating (if the employee didn't notice) or piggybacking (if they held the door).
- Step 4: Next step: review camera footage of the door at 12:15 to see who entered, and talk with the holder of badge 1174.
Answer: The 12:15 entry (badge 1174, door open 19 seconds versus the usual 4–6) suggests tailgating or piggybacking. The investigator should check the camera footage for 12:15 and interview the badge holder.
- Example 2
Placing a motion sensor
A school has budget for one motion sensor. The options are the main hallway, the cafeteria, or the locked room that holds the network equipment. Where should it go, and why?
Show the solutionHide the solution
- Step 1: Recall the rule: motion sensors belong where traffic is unexpected and few people have access.
- Step 2: The hallway and cafeteria are busy all day, so a sensor there would set off constant false alarms that people would learn to ignore.
- Step 3: The network room is rarely entered and holds critical equipment, so any motion there is worth checking.
Answer: Put it in the network equipment room: motion there is unexpected and the equipment is critical, while the hallway and cafeteria would cause constant false alarms.
Common mistakes
- Putting motion sensors in high-traffic areas. Constant false alarms make people stop taking alerts seriously.
- Thinking a camera is enough if nobody watches or records it. The feed should be recorded and monitored.
- Swapping the guard roles. Stationary guards go where traffic funnels in; patrolling guards suit perimeters and outdoor areas.
- Reading a badge log only for failed swipes. A door held open far longer than normal is the clue to piggybacking or tailgating.
On the exam
- Placement questions reward reasoning: say what the control would detect at that spot and why that's useful, and mention false alarms when motion sensors are involved.
- If given a badge or door log, find the normal pattern first, then point to the specific entry that breaks it.
Connected topics
Videos
Check yourself: 2.4 Detecting Physical Attacks
4 questions on 2.4 Detecting Physical Attacks. Pick an answer to see if you got it, and why.
| Time | Badge holder | Door | Seconds door was open |
|---|---|---|---|
| 08:02:15 | R. Ortiz | Lab B | 4 |
| 08:05:40 | K. Nguyen | Lab B | 5 |
| 08:11:02 | T. Brooks | Lab B | 19 |
| 08:14:27 | M. Haddad | Lab B | 4 |
| 08:20:51 | R. Ortiz | Lab B | 5 |
Entry log from the badge reader on the door to Lab B at an invented company
Which entry is the strongest sign of possible piggybacking or tailgating?
Which next step would best confirm whether an unauthorized person entered Lab B at 08:11?
A company is choosing where to place a new security camera for its warehouse. Which location is likely to be most useful?
Where would a motion sensor be most effective for detecting a physical attack?
0 of 4 answered