A security auditor is reviewing an organization's physical security controls for their data center. The data center houses critical servers and network equipment. The auditor observes that while perimeter fences and entry gates are present, the server racks inside the data center are not individually locked, and there are no surveillance cameras directly monitoring the server aisles. Which foundational physical security principle is primarily being violated?
- AAccess Control
- BLayered Security (Defense-in-Depth)
- CDetection
- DDeterrence
Show answer & explanationAnswer & explanation
Correct answer: B. Layered Security (Defense-in-Depth)
Layered security (or defense-in-depth) applies to physical security by implementing multiple concentric rings of protection. The scenario describes perimeter controls but a lack of internal controls (locked racks, aisle cameras). This indicates a failure to implement multiple, overlapping layers of physical security to protect the inner, most critical assets.
Why the other options are wrong
- A. While individual access control to racks is missing, the broader failure is the absence of *multiple* controls at different points, which is characteristic of layered security.
- C. Detection systems (like cameras) are a component of a physical security strategy, but the primary principle being violated is the *design* of multiple protective layers, not just the absence of one detection tool.
- D. Deterrence aims to discourage intruders, but the issue here is the lack of internal barriers, not just discouraging initial entry.
Physical Layered Security
Physical layered security, or defense-in-depth, involves implementing multiple, concentric rings of physical controls to protect assets. Each layer provides a barrier that an intruder must overcome, increasing the time and effort required for unauthorized access and enhancing detection opportunities.
- Uses multiple physical controls (e.g., fences, guards, locks, cameras).
- Each layer adds delay and detection capabilities.
- Protects critical assets by preventing single points of failure.
- Examples include perimeter, building, room, and rack-level controls.
Memory trick: Circles of protection, like an onion.