QAing · Physical Security for QA Engineers

Physical security protects people, facilities, equipment and information from unauthorised physical access, tampering, theft and disruption. For QA and security engineers, the important lesson is that strong cyber controls can still be undermined if an attacker can reach a workstation, server room, network cabinet or trusted internal area physically. This guide focuses on defensive assessment: understanding entry types, access-control layers, door and lock concepts, facility testing, monitoring and the rules required for safe authorised physical-security exercises.

On this practical guide

Entry types Locks & barriers Defence in depth Door security Access control Server rooms Monitoring QA assessment Rules of engagement Standards Checklist

Why physical security matters

Cybersecurity assumes that systems operate inside some level of trusted physical environment. If that assumption fails, an attacker may gain opportunities that remote attackers do not have.

Devices

Workstations, laptops, servers, removable media and network equipment can be stolen, altered or connected to directly.

Identity

Badges, keys, visitor passes and unattended credentials can become alternative access paths.

Infrastructure

Network cabinets, power systems and communications lines may expose critical services physically.

People

Social engineering and tailgating can bypass technical access controls by exploiting normal human behaviour.

Availability

Damage to power, cooling, networking or physical equipment can make otherwise secure services unavailable.

Evidence

Poor physical logging and monitoring can make unauthorised access difficult to reconstruct after an incident.

Physical and cyber security are one system. A locked server room, least-privilege administrator account, monitored badge reader and hardened endpoint all protect the same business assets from different attack paths.

Overt, covert and surreptitious entry

Physical-security assessments often classify entry methods according to how visible the evidence is afterwards.

Type	Meaning	Defensive interpretation
Overt	The entry method leaves obvious damage or destruction.	Controls should detect or respond to forced entry quickly.
Covert	The entry may appear normal to an untrained observer but can leave evidence detectable during professional inspection.	Periodic inspection and tamper evidence matter.
Surreptitious	The entry is designed to leave little or no detectable evidence.	Do not depend only on post-event damage; use access logging, alarms and layered identity checks.

The distinction matters because a control that only reveals destructive entry may still fail silently against cleaner methods. Good security therefore combines physical resistance with identity verification, monitoring and audit trails.

Locks are one layer, not the whole control

Mechanical locks are useful barriers, but a secure facility should not treat a lock as the only thing standing between an unauthorised person and a sensitive asset.

A lock contributes to security by:

Delaying entry.
Requiring an authorised key, code or credential.
Creating a visible control boundary.
Supporting accountability when key issuance is managed.
Working together with alarms, access logs and monitoring.

A lock does not automatically provide:

Identity assurance.
Detection of tailgating.
Audit history.
Protection against every form of manipulation or physical damage.
Security if the surrounding door, frame or wall is weaker than the lock.

Test the complete barrier. A high-quality lock on a weak door, exposed hinge, poorly fitted frame or uncontrolled alternate entrance can create false confidence.

Basic lock and door anatomy for defenders

A tester does not need to become a locksmith to assess whether access controls are appropriate. However, understanding the basic components helps identify weak system design.

Common mechanical concepts

Component	Defensive relevance
Lock cylinder / core	Accepts the authorised key and controls the locking mechanism.
Keyway	Physical interface through which the key operates the lock.
Pin stack / internal mechanism	Determines whether the correct key can rotate the core.
Latch	Holds a normally closed door in the frame.
Deadbolt	Provides stronger positive locking by extending a bolt into the frame.
Strike / frame	Receives the latch or bolt and must be physically strong enough to resist force.
Shackle	Exposed locking element found on many padlocks.

The practical QA question is not “how do I defeat this mechanism?” but rather “is the chosen hardware appropriate for the value and risk of the asset it protects?”

Defence in depth for facilities

A strong physical-security design uses multiple barriers so that one failed control does not provide direct access to the critical asset.

Public area
   ↓
Reception / visitor control
   ↓
Building access
   ↓
Restricted floor
   ↓
Secure room
   ↓
Locked rack / cabinet
   ↓
System authentication
   ↓
Application authorisation

Example: server-room protection

Controlled building entrance.
Visitor registration and escort policy.
Badge-controlled restricted area.
Separate server-room access permission.
Door-open alarm or monitoring.
Locked racks for critical systems.
Endpoint and server authentication.
Audit logging for sensitive administrative actions.

An attacker who passes one layer should still face additional controls.

Assess the whole door, not just the lock

Door security depends on the interaction between the door, frame, latch, hinges, closing mechanism, access-control hardware and surrounding construction.

QA / assessment questions

Does the door close and latch automatically after authorised entry?
Can the door remain partially closed without actually locking?
Does the frame securely retain the locking hardware?
Are hinges and mounting hardware appropriate for the door orientation?
Are gaps around the door larger than intended?
Are emergency-exit requirements preserved without creating unnecessary external exposure?
Are alternate doors protected to the same risk level?
Does propping the door open create an alert where required?

Safety always wins. Physical-security controls must not defeat emergency egress, fire safety or accessibility requirements.

Electronic physical access control

Many facilities use electronic access-control systems rather than relying only on mechanical keys.

Typical components

Badge or credential reader.
Access-control controller.
Electric locking hardware.
Door-position sensor.
Request-to-exit mechanism.
Central access-management system.
Access logs and alerts.

What to verify

Scenario	Expected behaviour
Valid authorised badge	Access granted only to the permitted area and time window.
Valid badge without permission	Access denied and event logged.
Expired or revoked badge	Access denied promptly.
Door forced open	Alert generated according to site policy.
Door held open too long	Event or alarm generated where required.
Controller/network failure	Door behaves according to the documented safe design.
Employee leaves organisation	Physical credentials revoked as part of offboarding.

Fail-safe vs fail-secure

Electronic locking systems must have a deliberate behaviour when power or control systems fail.

Mode	General idea	Typical consideration
Fail-safe	Loss of power releases the lock.	May support life-safety and emergency egress requirements.
Fail-secure	Loss of power keeps the secure side locked.	May better protect sensitive areas, subject to safety and code requirements.

The correct choice depends on life-safety regulations, door purpose and the risk assessment. QA should verify the documented behaviour rather than assume one mode is always correct.

Badges, keys and combinations

Physical credentials are security assets and should have a lifecycle just like passwords and API tokens.

Credential lifecycle

Issue
  ↓
Assign owner
  ↓
Authorise minimum access
  ↓
Audit / review
  ↓
Change role if needed
  ↓
Revoke promptly
  ↓
Recover / destroy credential

Controls to assess

Keys and badges have assigned owners.
Lost credentials are reported and revoked quickly.
Spare/master keys are controlled.
Access combinations are not shared casually.
Permissions are reviewed after role changes.
Temporary visitor credentials expire automatically.
Access rights follow least privilege.

Physical access systems can be defeated socially if an authorised person unintentionally allows an unauthorised person to follow them into a restricted area.

Defensive measures

Clear visitor policy.
Visible visitor badges.
Employee awareness training.
Reception or security presence where justified.
Mantraps or controlled vestibules in high-risk environments.
Anti-passback or occupancy controls where appropriate.
A culture where politely challenging unknown people is supported.

QA scenario

Given:
A visitor has permission for Reception only.

Verify:
- Visitor badge cannot open restricted doors.
- Escort requirement is documented.
- Badge expires after visit.
- Access attempts are logged.
- Visitor record contains required sponsor information.

Server rooms, network cabinets and critical equipment

Server rooms deserve additional protection because physical access to infrastructure can bypass several cyber controls at once.

Areas to review

Restricted room access.
Locked network and server racks where justified.
Power and cooling resilience.
Fire detection/suppression appropriate to the environment.
Environmental monitoring.
Protected console and management ports.
Controlled removable media.
Documented visitor and maintenance access.
Protection of network cabling and distribution points.

QA / audit evidence

Current list of authorised personnel.
Access-log samples.
Door alarm tests.
Recent offboarding evidence.
Environmental alert records.
Physical asset inventory.
Maintenance/visitor records.

Physical monitoring and detection

A barrier is more effective when unauthorised interaction can be detected and investigated.

Detection mechanisms

Door-position sensors.
Intrusion alarms.
CCTV.
Access-control logs.
Security patrols.
Tamper-evident seals.
Asset inventory and periodic inspection.

Test the detection chain

Event:
Restricted door forced open

Expected:
1. Sensor detects state
2. Access system records event
3. Alert is generated
4. Correct team receives alert
5. Camera / context is available if required
6. Response procedure exists
7. Incident can be reconstructed afterwards

An alarm nobody receives is not an effective control. Validate the complete path from detection to response.

CCTV is supporting evidence, not automatic prevention

Cameras can deter, detect and support investigation, but they do not physically stop unauthorised entry.

Assessment questions

Do cameras cover the required entry and critical areas?
Are timestamps synchronised with access logs?
Is retention aligned with policy and applicable privacy requirements?
Who can access recordings?
Is recording availability monitored?
Can an incident be correlated with badge events?

Physical security and the CIA triad

Security property	Physical example
Confidentiality	Prevent unauthorised people from reaching documents, displays, media and systems.
Integrity	Prevent or detect tampering with equipment, cabling and stored media.
Availability	Protect power, cooling, network connectivity and equipment from disruption.

Physical security therefore belongs directly in the same risk model as application and infrastructure security.

A safe physical-security assessment methodology

Physical-security testing must be explicitly authorised. Unlike normal application testing, a poorly scoped physical assessment can create safety concerns, property damage or legal issues.

1. Define the objective

Test visitor controls?
Assess server-room access?
Validate offboarding?
Review access logs?
Test alarm handling?

2. Define scope

Buildings and areas included.
Dates and times.
Permitted entry methods.
People who may be contacted.
Systems or assets that must not be touched.

3. Define safety constraints

No destructive entry unless separately and explicitly authorised.
No interference with emergency-exit systems.
No disruption to fire, medical or life-safety controls.
No testing that endangers staff or the public.
Stop conditions and emergency contacts are known.

4. Execute controlled test cases

Prefer evidence-based checks of access policy, logging, visitor handling, credential revocation and alarm response before considering more intrusive testing.

5. Restore and report

Remove test credentials.
Confirm no doors or controls remain altered.
Document evidence.
Separate vulnerability from business risk.
Recommend layered remediation.

Rules of engagement for authorised physical testing

Rules of engagement (RoE) should be written before the assessment begins.

RoE area	Example definition
Authorisation	Named executive/facility owner approves the activity.
Locations	Only listed buildings/rooms are in scope.
Hours	Tests allowed only during approved periods.
Damage	No destructive methods unless explicitly authorised.
Social engineering	Define which staff groups may be included or excluded.
Safety	Emergency and accessibility systems are out of scope.
Evidence	Define photography, video and data-handling rules.
Stop conditions	Named contacts can terminate the exercise immediately.

High-value QA test cases

Badge revocation

Given:
Employee access is revoked at 10:00

Verify:
- Badge no longer opens restricted area
- Access attempt is logged
- Digital accounts are revoked according to offboarding process
- Any issued physical keys are accounted for

Role change

Given:
Employee moves from Infrastructure to Sales

Verify:
- General building access remains if required
- Server-room permission is removed
- Old privileged areas are no longer accessible
- New role permissions are correct

Door-held-open event

Given:
Restricted door remains open beyond policy threshold

Verify:
- Event detected
- Alert generated
- Alert reaches responsible team
- Event timestamp correlates with CCTV/access logs

Visitor lifecycle

Verify:
- Sponsor identified
- Visitor credential has limited scope
- Expiry is enforced
- Restricted areas remain unavailable
- Credential is returned/disabled after visit

Physical and logical access should agree

One of the best cross-domain checks is comparing physical permissions with digital permissions.

Role	Physical access	Logical access
Reception	Lobby / office	Visitor system
Developer	Office	Development systems
Infrastructure engineer	Office + server room	Infrastructure administration
External visitor	Escorted approved area only	No internal account by default

Large mismatches should trigger review. For example, a former infrastructure engineer might lose cloud permissions but retain server-room badge access if offboarding processes are not integrated.

NIST Physical and Environmental Protection

NIST SP 800-53 Rev. 5 includes a dedicated Physical and Environmental Protection (PE) control family. It treats physical protection as part of the same overall security and privacy control catalogue as access control, incident response and system integrity.

Representative physical-control themes include:

Physical access authorisations.
Physical access control.
Monitoring physical access.
Visitor access records.
Emergency power and lighting.
Fire protection.
Temperature and humidity controls.
Water-damage protection.
Equipment location and delivery/removal.

CISA facility-access guidance similarly emphasises risk-based physical access policies, verification of authorisation, controlled keys/credentials and monitoring of access points.

Common physical-security mistakes

Mistake	Better approach
Expensive lock on a weak door/frame.	Assess the complete barrier.
Badge system with no access reviews.	Review permissions and revoke promptly.
All employees can enter the server room.	Apply least privilege.
Visitor badges never expire.	Use time-limited credentials.
CCTV exists but nobody checks health.	Monitor recording availability.
Door alarms are configured but untested.	Test alert delivery and response.
Mechanical keys have no inventory.	Assign, inventory and recover keys.
Cyber offboarding and badge revocation are separate manual processes.	Use a joined offboarding workflow.
Emergency exits are “secured” unsafely.	Meet life-safety and building-code requirements first.
Physical tests start without written authorisation.	Define scope and RoE before testing.

Physical Security QA checklist

Critical physical assets and locations are identified.
Access controls match the value and risk of the protected assets.
Restricted areas use least-privilege access.
Doors close and latch reliably.
Door frames and surrounding construction are appropriate for the barrier.
Alternate entrances receive equivalent protection.
Emergency egress is preserved.
Electronic credentials have documented owners.
Lost badges and keys have a clear response process.
Offboarding promptly removes physical and logical access.
Role changes remove obsolete permissions.
Temporary visitor permissions expire.
Visitors are identifiable and escorted where required.
Server rooms and network cabinets have additional protection.
Door-held-open and forced-entry events are detected where required.
Physical access logs are retained according to policy.
CCTV and access-control clocks are synchronised where correlation is required.
Monitoring failures are themselves detectable.
Critical power and environmental systems are monitored.
Physical credentials and master keys are inventoried.
Security controls are periodically inspected for tampering.
Physical test scope and Rules of Engagement are documented.
Destructive methods are excluded unless separately authorised.
Life-safety systems are never compromised during testing.
Findings are prioritised according to business impact and realistic attack paths.

Physical Security cheat sheet

Concept	Remember
Overt entry	Leaves obvious physical damage.
Covert entry	May require trained inspection to detect.
Surreptitious entry	Designed to leave little or no observable evidence.
Defence in depth	Use multiple independent security layers.
Least privilege	Grant only the physical access required.
Fail-safe	Loss of power releases the lock.
Fail-secure	Loss of power keeps the secure side locked.
Tailgating	Unauthorised person follows an authorised entrant.
Access log	Evidence of credential and door activity.
RoE	Written Rules of Engagement for authorised testing.

Key takeaways

Physical security is part of cybersecurity because physical access can bypass digital controls.
Locks should be evaluated as part of the complete door, frame, access and monitoring system.
Overt, covert and surreptitious entry classifications help explain why visible damage is not sufficient detection.
Electronic access control should enforce least privilege, credential lifecycle and auditable access decisions.
Critical areas such as server rooms require additional layers beyond general building access.
Monitoring must cover the complete chain from detection to human response.
Physical and logical offboarding should be coordinated.
Facility security must always respect fire, accessibility and life-safety requirements.
Physical-security assessments require explicit authorisation and documented Rules of Engagement.
QA engineers can contribute through access-control testing, visitor-flow validation, alarm testing, permission reviews and cross-checking physical and digital identity lifecycle controls.

Useful links

NIST SP 800-53 Rev. 5 ↗ — security and privacy controls including the Physical and Environmental Protection family.
NIST SP 800-53 Controls ↗ — current control catalogue and assessment resources.
CISA Facility Access Control ↗ — risk-based facility access-control guidance.
CISA Physical Security ↗ — physical-security resources and guidance.