What is physical security? Controls, methods and measures for commercial buildings

What is physical security?

Physical security includes security measures designed to limit access to authorized individuals and protect personnel and property from damage. It involves securing organizational assets from harm due to physical events, including natural disasters like fires and floods, and human-inflicted dangers like theft and vandalism. Accidents and accidental damage are also covered by a physical security plan.

Physical security measures typically include locks, gates, video security cameras, and security guards. However, an effective plan should additionally include equipment and technology that can work alongside these areas:

• Training: Ensure your staff has the proper knowledge in implementing your physical security strategy.
• Site design and layout: Equipment and physical security components should be strategically placed to complement the design and layout of your facility.
• Emergency response readiness: Staff in your facility should be trained on what to do during certain situations and emergencies.
• Access control: Understand how you will assign access to your staff and limit access for restricted spaces.
• Environmental components: Create safety measures to mitigate damage from intentional or unforeseen natural disasters that may happen.

Key physical security measures

When it comes to preventing different types of physical security threats in any facility, there are many types of innovations that you can use — from encrypted access card systems and security cameras to mobile credentials and temperature sensors. But before you use any of these systems, it’s important to understand the different elements that can contribute to your overall plan. 

When creating a physical security strategy, you need to have all your security measures complementing one another. This means that you need to use different types of physical security measures in a layered approach to ensure that you’re protected from every angle.

So, what is good practice for physical security? Here are the most common elements in an effective physical security plan: 

1. Deterrence: This type of physical security technology focuses on keeping unwanted people, vehicles or animals away from a certain area. Deterrence can encompass various equipment such as signage, security cameras and door access systems. It also includes physical barriers such as doors, locks and walls. It is essentially any security systems or equipment that can help deter intruders from entering sensitive areas.

2. Detection: Deterrents can only do so much. If you want to fully protect your facility, you need to have devices that can identify potential intruders and ways to alert the correct authorities. Some technologies you can use for physical security detection measures are sensors, alarms and automatic notifications via video management software.

3. Delay: Several physical security controls are created to slow intruders down when breaking into a facility. Simple security measures such as additional doors, locks and security guards can help delay incidents. More advanced physical security technology, such as key card access and mobile credentials, can make it more difficult for unauthorized users trying to enter a building. With this technology in place, it’s easy to mitigate a breach before too much damage is caused. 

4. Response: Once a breach or intrusion happens, you must also have a response strategy in place, such as building lockdowns or automatically notifying emergency services. 

Successful and effective plans should include these technologies to ensure that a facility can prevent physical threats and take necessary action if a security breach occurs.

Components of physical security controls and systems

Physical security controls fall into three main areas of concern: access control, surveillance and testing. How well these security components function can make or break your physical security program. Their performance can also indicate how well your plan was implemented, where to improve and what to maintain.

Access control

The most effective way to maximize your physical security controls is by limiting and controlling who can access your commercial premises. This physical security component involves the means of restricting the exposure of specific assets and areas to authorized staff only. Companies can use physical security components like keypads, ID badges, biometric logins and security guards to limit access for unauthorized individuals.

So, how do physical access control systems work? The first line of defense of physical security is its architecture. This includes walls, gates, doors and guards that are strategically placed to deter criminal entry. In some locations, barbed wires, additional locks, visible security signs and equipment can help reduce attempts to enter a facility. 

There are also more advanced electronic access control measures that use a technology-supported approach to tighten up building security. One example of physical security is using proximity ID badges. Instead of just a plastic ID badge, employees are issued key card that use NFC or RFID technology to authenticate identity when entering various locations in the building. 

Apart from employees, companies can also provide visitor access cards to easily control which areas your visitors can access in your facility. Some companies use mobile authenticators instead of ID cards to validate identities to enter a building. These employee ID badge systems and authenticators will act as obstacles for anyone without authorization, making it more challenging for attackers to gain access to certain assets and information on your premises. 

Enabling multi-factor authentication (MFA) increases the time it takes for intruders to carry out any criminal offense they have in mind. This physical security best practice requires users to present at least two authorized credentials, such as typing in a PIN code and scanning an ID badge. The more strategically placed obstacles available, the more time companies can buy to act on threats and mitigate them. 

Additionally, access control can do much more than restricting unauthorized access. Physical barriers like walls and fences can help protect buildings from natural and environmental disasters including landslides and floods. Obviously, these risks depend on the location, but organizations must always consider threats like this when investing in physical security systems. 

Importance of access control for physical security

In addition to deterring intruders, organizations can use modern access control systems to understand staff and visitor movements. For example, a badge system allows administrators to access reports and read event logs. This can be used to better understand building usage, identify choke points, improve overall processes and traffic flow and take a data-driven and risk-based approach to security.

Access control can be also used in visitor management. One common tactic intruders use is unannounced visits to facilities they want to target. They check what security measures are in place, investigating if it’s a viable option to continue infiltrating the space. If you only manage your visitor access on paper, they may feel more confident about gaining unauthorized access. But if you have more advanced activity logs and detailed visitor records, they may think twice before entering the premises. 

Surveillance tools and technology

When it comes to prevention and post-incident recovery, surveillance is the most critical component of physical security. It refers to the staff, resources and technology used by organizations to monitor the activity of different areas of the facilities. This includes video cameras like dome surveillance cameras, sensors, guards and automatic notification systems. 

One of the most commonly used types of physical security technology for this component is security cameras or closed circuit television (CCTV) cameras. These devices continuously record the activity of a given area, allowing you to see what’s happening at a particular location in real time, or record it for later viewing.

Some commercial surveillance systems come with built-in analytics that can detect and classify objects intelligently, notifying you if there is something unusual going on. When you choose video equipment for your facility, make sure to enlist the help of a security camera installer who can carefully assess every entry point, checking for any blindspots that can be exploited and recommending the correct types of security cameras accordingly.

A security camera installer will also ensure that your video cameras are strategically placed in locations that require constant monitoring and protection. 

Importance of video cameras for physical security

When criminal activity happens, you need evidence to prove the event occurred. Often, video security gives the proof you need. Many camera types such as bullet security cameras allow for constant recording in a particular area, with some that have night vision capabilities to see through darker environments. If something suspicious happens at your facility, you can use these recordings as evidence.

In addition, some monitoring devices such as license plate recognition cameras offer an automatic notification feature, which provides you with instant alerts for physical security threats such as intrusion detection. Advanced video cameras and management software often have real-time monitoring, allowing you to see in-action breaches as they unfold. This can give you an idea of how to mitigate them as quickly as possible.

Physical security systems testing

Access control and monitoring are preventative physical security measures — you’ll only know their quality once an actual event occurs. But of course, you don’t want to wait for that to happen without knowing how secure your facility is. So, testing is needed as a physical security best practice. This physical security component checks how well your organization identifies, responds to and contains a security threat. 

Testing requires educating your employees, often through training and written communication. Cameras and technologies can do a lot, but your business will be better protected if your employees are knowledgeable about your company’s security measures and what to do in the event of a physical security threat. This particularly applies to natural disasters such as fire and earthquakes, but is equally important in identifying physical security risks such as tailgating or suspicious activity. 

Importance of testing for physical security

Testing allows business owners or security personnel to understand how well their security system works and which areas to improve. If you conduct mock physical security breaches, you can also see how well your employees perform in various scenarios. This also gives you an idea of how your security measures are performing and if there are other vulnerabilities you need to protect. 

At the same time, educating your employees about physical security policies and protocols can make them feel safer at work. If employees are made aware of the systems in place to detect criminal activity, this can also help to deter any physical threat activity, such as fraudulent behavior or employee theft.

Examples of physical security implementation

Perimeter security

This is one of the most common physical security examples we see today. Perimeter security is straightforward. It involves creating physical barriers that protect your facility from intruders. This includes fences, gates, barbed wire and security guards. This type of physical security is also your first line of defense to deter intruders from getting into your facility.

Environmental elements

The layout and landscaping on your property can help control the flow of traffic on the premises, and deter unwanted activity. For example, high hedges around the perimeter, motion-activated lighting and maintained walking paths make it easier to spot anyone who looks suspicious lurking around the building exterior.

Secure credentials for authorized individuals

Requiring every authorized individual to have access credentials is among the top security best practices to implement in your building. There are many types of systems, and each can be used depending on the threat level or importance of an area, including:

• Key cards / ID badges
• Key fob door entry system
• Biometric readers
• Keypad locks
• Mobile-based credentials

These physical security devices ensure that each user can easily access the building when needed. They also give businesses better insight into daily traffic, failed access attempts and potential physical security threats.

Restricted access areas

This physical security example shows how measures can be implemented for restricted areas, such as a server room or area with expensive equipment. Areas like this can only be accessed by a small subset of the staff, which requires additional access credentials, such as MFA, unique PINs or biometric credentials. If anything goes missing or is damaged in the room, it narrows down who can be held accountable.

Additional monitoring security components, such as surveillance like panoramic security cameras or a staffed guard, can further deter unauthorized activity in restricted spaces.

Logs and audit trails

Another way to secure a facility is through detailed logging. Instead of just limiting access, this physical security method keeps a record of which credentials are used, as well as where and when the activity occurred. This doesn’t only deter unauthorized users, but also allows you to create a forensic-friendly data environment essential for physical security management and maintenance.

For example, records of multiple failed login attempts or attempted access using a lost card would be easier to spot with detailed activity logs. If there’s a security breach, you can quickly identify weaknesses in your system through audit trails.

Monitoring systems

Most organizations have surveillance in place to protect a facility. This allows them to detect intruders right away that may have bypassed other security measures, like perimeter security. Some systems can also detect natural disasters and issue warnings if they do. These systems can include motion detectors, security cameras and fire alarms. In some situations, having these devices record activities is enough. However, other facilities require a surveillance system to be actively managed by a guard or personnel.

Sensor technology

Sensor technology is the use of devices to detect changes in an environment. Commonly used to detect motion, sound, light, smoke, pressure and temperature, sensors can alert operators to a potential security threat. For example, a break-in could trigger a motion sensor, fighting would be picked up by the noise sensor and vaping would set off the smoke sensor.

By implementing sensor technology into your physical security strategy, you can establish a comprehensive plan that helps your security team increase situational awareness to detect, analyze and respond to safety and security threats. With integrated access control or video security, teams can receive instant alerts to the first signs of a potential threat. This enables them to use security cameras to observe the unfolding event for more information and initiate responses, such as a lockdown, that can help safeguard people, secure premises and protect assets. 

Staff members

Of course, you need someone to enforce your physical security measures, and that’s where your employees come in. There are some staff members or security personnel that are explicitly hired to implement your security plan, while others are only encouraged to take an active role when an emergency happens.

For instance, your security guards and receptionists can act as gatekeepers, only giving access to those who are authorized. Patrols, on the other hand, can monitor a section of your facility at certain hours of the day. But staff members shouldn’t be the only physical security measures you should implement. This example of physical security should be supplemented with other technologies and components to ensure that you cover every ground you need to protect.

Common threats to physical security

In the digital era we live in, the number of threats is alarmingly increasing, with many now originating from cyberspace. From data breaches to hacking, the focus of many organizations has shifted, with greater focus on security solutions for physical security that also protect digital provisions.

With this in mind, let’s take a look at common threats to physical security. These threats can be targeted not only at the assets on your premises but also at your digital and human resources. Physical security threats can be natural or man-made, so it’s vital that your strategy addresses both vulnerabilities. Threats can also be categorized based on the place of origin of the attacks:

Internal threats

This type of physical security threat comes from within your organization. Internal physical security risks are more challenging to contain than external threats as they are tougher to predict. They can be accidental or malicious in nature. Examples of such risks include:

• Employees committing theft or causing property damage
• Careless staff members leaving restricted areas open
• Mistakes made by your security team
• Faulty infrastructure or hazardous work conditions

In fact, internal theft from employees is estimated to top $50 billion each year for U.S. businesses. Therefore, you need to have security measures in place to keep internal members from being tempted to act maliciously. This can include RFID-enabled access devices and video security systems to protect critical areas of your facility.

Internal threats can also come from non-human sources such as fires due to faulty wiring, mishandled equipment, and more. Because these types of threats are harder to predict, it’s best to identify any areas of your facility that are more exposed to this type of danger and take proactive steps to mitigate this physical security risk. A proper emergency preparedness and response plan is also a critical physical security measure for these types of scenarios.

External threats

As its name implies, this type of threat originates from outside your organization. This can include attacks from outside parties with malicious intent and natural disasters. External physical security threats can also include:

• Forced entry or break-ins
• Vandalism and property damage
• Unauthorized entry for persons outside your staff or approved visitor list

In the United States alone, theft from commercial properties accounted for more than 37 percent of all burglary crimes in 2019, according to data from the FBI. Most of the time, this type of crime is perpetrated by external actors. However, internal actors can also participate in such events, sometimes unknowingly by letting a tailgater into a building or leaving a door propped open by accident.

Natural threats

These physical security threats constitute damage caused by natural causes like floods, earthquakes, lightning strikes and other unpredictable natural disasters. In this situation, the physical security risk lies in the fact that such an event can cause extreme damage to your assets and endanger employees.

More than the loss of hardware, the loss of years and years of critical business data and investment, as well as injuries to your employees can have a severe blow to your business operation. This is why it is crucial that physical security strategies include proper training and communication for emergency procedures across every industry and property type.

Emerging threats

In recent years, a series of emerging threats have paralyzed businesses and organizations and significantly affected their finances, customers and employees. Having been unknown or with few known occurrences in the past, these threats have now drawn the attention of businesses of all sizes. These emerging threats include:

• Cybersecurity attacks that bring operations to a standstill.
• Increased prevalence of vaping, particularly among students at school.
• The spread of infectious diseases can severely impact people’s health.
• Increase in violent behavior and acts of aggression.

To help address these threats and better protect people, property and places, organizations must follow up-to-date best practices for combating physical and cybersecurity threats. Failure to plan and implement new strategies and technology to mitigate risk related to these emerging threats can leave a business’s vulnerabilities open to attack. 

Why cyber and physical security convergence matters

For digital infrastructure, cybersecurity undoubtedly plays an integral part in its safe operation. However, data systems can still be breached via a physical security threat. This is one reason many businesses today are turning toward cyber and physical security convergence for more proactive protection. This type of security strategy safeguards essential business data, critical and confidential information, as well as hardware, personnel and other tangible structures. 

With more devices connected to internal networks than ever before, approaching cybersecurity with physical security measures in mind helps create a well-rounded strategy that covers your business from multiple angles, and removes redundancies across your security teams.

Physical security best practices

So, what physical security measures should you have in place to keep your facility secure? What components of physical security should you give more attention to?

There is no one size fits all physical security solution here. Every organization has different needs, but there are common measures that — when adjusted to fit your situation — can help protect your organization from physical attacks. So, what is a good practice for physical security?

Investing in security personnel

One of the best deterrents against possible attacks is visible security, and this is what investing in security personnel can guarantee. For example, you can hire extra security guards or change the existing patrol routes to cover more ground. Consider manning important entrances and exits, which can help ensure that no unauthorized entries or exits happen.

On top of that, having security personnel can give your employees peace of mind and dissuade those with malicious intent from working against your business. However, having security guards doesn’t automatically guarantee protection and safety.

You also need to ensure that your security team understands your organizational requirements and is trained in the physical security measures your business is implementing. They should also have state-of-the-art equipment that they carry on their duty that can help deter and delay intruders. They should also know how to respond appropriately in different security situations.

Using monitoring systems

Security guards can be effective in deterring and delaying intruders, but they can only detect threats within their proximity. This is where monitoring systems come into play. This type of physical security system can help you know what’s happening in various areas of your facilities at the same time while preventing potential dangers. However, not all monitoring solutions are right for every property, and many factors contribute to their effectiveness.

Security cameras should be strategically placed in locations that can offer maximum visibility over your premises. These recordings can act as evidence when a breach occurs, and camera systems equipped with AI surveillance analytics can enhance visibility and help security teams know where to focus in critical moments.

An automated alert system can notify the right person immediately in case of unauthorized access or suspicious movements in a particular, secure area of your facility. This allows immediate response to threats to help lessen any damage. You can also employ advanced security cameras that allow you to zoom in on a particular person or object to closely monitor their suspicious activity.

Sensors can also help provide better situational awareness. Some examples of the physical security component include smoke sensors, temperature sensors, water or leak sensors and occupancy counting devices.

Some systems also allow security team leaders to check the location of their guards through GPS. This also allows quick response and delegation when an incident occurs, as leaders know who to call within the location of the incident.

Limiting facility access

Do you know the number one enemy of security? Accessibility. Easy access to your facility is a clarion call to malicious actors who wish to compromise your assets. One effective way to stop this from happening is by restricting access to your facility. So how can you control access to your location?

The answer depends on what you want to protect and the risks you can afford. In areas that need less security, a guard can suffice. Some situations may call for identification tags and security checks when entering and leaving the building. A commercial intercom system can also assist in protecting a property by vetting and tracking guests to your building and keep deliveries secure. However, in areas where maximum physical security should be implemented, more advanced access control like biometric readers and coded locks should be in place.

Educating your employees

Even if you have the most advanced security systems and trained guards in place, none of them matter if your employees are not aware of your physical security protocols and the duties they play in them. Does your staff know what to do in case there’s a physical intrusion in your facility? Do they know where to go if natural disasters occur?

To guarantee that your employees are prepared, make sure that they are well-trained to handle physical security threats. When they know the standard operating procedure, they can contribute to protecting your assets, and can maybe even save lives in the process. At the same time, educating them can give them peace of mind that they are protected when breaches and emergencies occur.

Implementing sensors

Implementing smart sensors like the HALO Smart Sensor into your physical security strategies can deliver greater situational awareness for your security team. This enables your team to receive instant sensor alerts to security incidents, leading to faster analysis and responses to help extinguish the threat.

If you do not include sensor technology in your physical security plan, you are at a significant disadvantage in detecting potential security threats that could hamper safety, especially those that cannot be detected by video or audio recording. So, what type of sensors should you include in your physical security systems?

Vape and smoke sensors: These sensors detect vape and smoke from cigarettes or fires and alert security operators upon detection. Vape detectors are useful in observing privacy-concern areas, such as washrooms and changing rooms, as video and audio recording is not permitted there.

Temperature and humidity sensors: Significant temperature and humidity fluctuations can negatively affect the health of people and assets. This type of sensor is useful in environments where temperature and humidity need to be closely controlled and kept within acceptable ranges, such as walk-in freezers, storage rooms and office spaces. 

Air quality sensors: Maintaining a safe, healthy environment requires clean air. These sensors analyze the air quality within an environment and can detect when the quality dips below a healthy level. This could indicate the presence of particulate matter or dangerous gases, such as carbon monoxide, which can be harmful to your health.

Motion and noise sensors: In the event of a break-in, trespassing or physical or verbal abuse, motion and noise sensors can detect the movement of people and pick up sounds related to aggression. Upon detection, these sensors can send an immediate alert to security teams so action can be taken to apprehend the intruder or separate individuals involved in a fight. This can be an especially useful tool for preventing violence in the workplace and other environments like schools.

Final thoughts on physical security plans, systems and solutions

Every business is unique, and so are its physical security requirements. Again, there is no one-size-fits-all approach that can protect all aspects of your business, so it’s critical to ensure that your physical security plan is tailor-fit to your organization and facility. Understanding what physical security is, as well as what robust physical security standards are, is a good start. 

As physical and digital worlds continuously overlap, you need a trusted partner that helps you navigate both. Conduct a thorough physical security risk assessment, and consult with a professional to get the most out of your physical security systems and technology.