CISSP 10.2 - Implement Site & Facility Security Controls (Part 2 of 4)

This episode of the ISC2 Certified Information Systems Security Professional (CISSP) exam prep series carries the Domain 3 facility controls forward into detection, alarms, and recording — the layer of physical security focused on catching intruders in the act and keeping a clean record you can rely on afterward.

Frequently Asked Questions

What is a physical intrusion detection system, and how can it be defeated?

It is a system, automated or staffed, that spots an unauthorized entry or an event happening at the wrong time — in physical form these are burglar alarms, often using contact switches plus foil strips or wire grids that catch broken glass. Two weak points can silence one: if it loses power it stops working, so a reliable system carries a battery backup good for at least a full day, and if its communication line is cut, a heartbeat sensor that constantly checks the pathway trips the alarm the moment that signal drops.

How do motion detectors sense someone moving?

Each type watches a different physical signal. A digital detector flags meaningful changes in a camera-like image, a passive infrared type reads shifts in heat, a wave-pattern or microwave detector bounces a signal and watches the reflection, a capacitance detector senses changes in the electromagnetic field, a photoelectric detector notices changes in light, and a passive audio detector listens for abnormal sounds. A dual-technology sensor combines two of these, usually infrared and microwave, and only reacts when both agree.

What does an alarm actually do once it triggers?

It launches one of three kinds of response: a deterrent alarm makes further intrusion harder by engaging extra locks or closing doors, a repellent alarm drives the intruder off with a siren and flooding light, and a notification alarm stays silent while recording the event and quietly summoning administrators, guards, or police. Alarms are also grouped by where the response lives — local systems sound on-site, central station systems are monitored off-site, and auxiliary systems loop in emergency services.

How do people abuse physical access?

Common abuses include wedging a secured door open, bypassing a lock, or using someone else’s credential to impersonate a valid person. Tailgating and piggybacking mean slipping in behind an authorized employee, either without their notice or with their misguided courtesy. The defense is watchful people plus audit trails and access logs, tied to camera footage so you can reconstruct exactly what happened during an incident.

How do you store media so it stays safe?

A media storage facility holds blank, reusable, and installation media, all locked away rather than left on an open shelf. Reusable media is risky because standard deletion only marks space as free and leaves data remnants recoverable by a simple undelete tool, so you erase them with secure wiping or zeroization and verify with a hash check. Put a librarian in charge, track everything with check-in and check-out, and know the difference between a safe, a movable strongbox, and a vault built permanently into the structure.

Reference: This article is based on concepts discussed in CISSP 10.2 - Implement Site & Facility Security Controls (Part 2 of 4).