Physical Security

Physical security means using barriers and people to control who can get near the hardware: the computers, servers and storage devices that hold data. It is a prevention method because it stops unauthorised people reaching the equipment at all, so an attacker never gets to touch the machine.

Common measures

• Locks on doors and server racks keep out anyone without a key, so even someone standing in the room cannot open a case and take a hard drive.
• Key cards open only the doors a member of staff needs, and the system records who entered and when.
• CCTV cameras record activity, which discourages an intruder and gives evidence if something goes missing.
• Security guards can check identity at an entrance, challenge a stranger and respond immediately to an incident.

Access is also restricted to a few named people. A small theatre, for example, keeps the laptop holding its ticket and card payment records in a locked safe overnight, so a break-in after the show gains an intruder nothing.

Why it limits threats

Devices hold data, so stealing a laptop or pulling a disk out of a server steals the data on it. Physical security reduces theft of devices and therefore limits data theft. It also stops direct access: someone sitting at the machine could log on with a stolen password, copy files onto a memory stick, or plug in an infected USB device that installs malware. If nobody can touch the hardware, those routes close.

Physical security is part of cybersecurity even though no software is involved. Software defences assume the machine is in trusted hands, so an attacker who takes the disk out can read it on another machine, getting past firewalls, passwords and anti-malware.

Used with other methods

It works alongside encryption, so a stolen drive is unreadable without the key, and alongside user access levels, so a visitor who reaches a logged-on computer cannot open other people's files. No single method stops every threat, which is why organisations combine several.