# Physical and Logical Security Controls

> Chapter 9 of the Courseiva SERVER-PLUS curriculum — https://courseiva.com//learn/server-plus/physical-and-logical-security-controls

**Official objective:** 2.1 — Implement physical security measures (e.g., locks, biometrics) and logical controls (e.g., firewalls, ACLs).

## Introduction

Physical and logical security controls — the two complementary layers that protect every server environment from unauthorised access and damage. For the CompTIA Server+ SK0-005 exam, understanding how these controls work together is essential because real-world security failures often happen when one layer is weak. You need to know not just what each control does, but why both are necessary to defend against threats ranging from theft to cyber attacks.

## The Museum Security Guard and Inventory System Analogy

A museum security officer stands at the entrance, checking each visitor's ticket and identification before allowing them through the turnstile. This is like a physical security control: a lock or a biometric reader that controls who can walk into the server room. Once inside, another officer monitors the CCTV cameras, watching for anyone trying to touch an exhibit or enter a restricted area — similar to electronic badge logs that record every door swipe. 

Behind the scenes, the museum’s inventory system uses a database that tracks every artefact. Only the chief curator can edit an artefact’s location record; assistants can only view it. That exact permission structure is an Access Control List (ACL) — a logical rule that says ‘who can do what’ with data. If a security guard wants to override a locked display case, they need both the physical key and a logged approval from the curator. In the same way, an IT administrator might need a fingerprint scan (physical) and a password (logical) to unlock a server console.

This combined approach — guards, locks, cameras, and a strict digital permission system — mirrors exactly how physical and logical security controls work together to protect critical assets.

## Core explanation

Security controls are divided into two broad categories: physical and logical. Physical security controls protect the actual hardware — the servers, cables, and networking gear — from being touched, stolen, or damaged. Logical security controls protect the data and software running on those machines by enforcing rules about who can access what, and what they can do once inside. 

Physical security controls include locks, biometric scanners, mantraps, CCTV cameras, security guards, and environmental controls like fire suppression and climate management. A lock can be a traditional key lock, a combination lock, or an electronic card reader. Biometrics use unique physical traits — fingerprints, iris patterns, face recognition — to verify identity. A mantrap is a small room with two interlocking doors; one must close before the other opens, preventing tailgating (someone sneaking in behind an authorised person). CCTV cameras record footage for later review, acting as a detective control.

Logical security controls are implemented in software and firmware. The most common are firewalls and Access Control Lists (ACLs). A firewall is a device (or software) that inspects network traffic and decides whether to allow or block it based on rules. For example, a firewall might block all incoming traffic except web traffic on port 80 and 443. An ACL is a set of rules applied to a router, switch, or file system that specifies which users or systems can access specific resources. 

Other logical controls include:
- Authentication systems (passwords, PINs, smart cards)
- Authorisation systems like Role-Based Access Control (RBAC), where permissions are tied to job roles
- Encryption, which scrambles data so that only someone with the correct key can read it
- Logging and monitoring software that tracks who did what and when

Both types of control follow a layered approach called “defence in depth”. No single control is perfect; if one fails, another catches the problem. For instance, a biometric lock on the server room door (physical) stops an intruder, but if that fails, the firewall (logical) should stop the same person from connecting to the server over the network.

The table below summarises the main differences, but you need to remember that they are not interchangeable — they work together. Physical controls prevent physical access; logical controls prevent digital access. A server without a physical lock can be stolen; a server without a firewall can be hacked remotely.

When studying for SK0-005, focus on recognising examples of each type and knowing which scenarios require which control. The exam will present a situation (e.g., “a data centre wants to prevent unauthorised personnel from entering the server room”) and ask you to choose the appropriate physical control (e.g., mantrap) or logical control (e.g., a firewall rule). You must also understand that biometrics are physical, not logical, even though they involve a digital database of fingerprints.

## Real-world context

Imagine you are an IT professional tasked with securing a new company data centre. The business stores sensitive customer data on a rack of servers. You start with the physical perimeter. You install a fence around the building and badge readers at every exterior door. Inside, you place a mantrap at the entrance to the server room. The mantrap has two doors: one from the hallway and one into the server room. Only one door can open at a time, and you must swipe your badge and scan your fingerprint to proceed. This prevents tailgating.

Around the server room, you mount CCTV cameras that record 24/7. You also install a fire suppression system that uses inert gas instead of water to avoid damaging electronics. On each server you add a physical lock to the front bezel so that even if someone gets into the room, they cannot easily remove a hard drive.

Now you turn to logical controls. You configure a firewall at the network perimeter that blocks all traffic except HTTP, HTTPS, and a specific VPN port. Inside the network, you set up an Access Control List (ACL) on the switch that only allows authorised IT staff IP addresses to connect to the management interface of the servers. You then implement Role-Based Access Control (RBAC) on the operating system itself. Junior administrators can view logs and restart services, but only senior administrators can install software or modify user accounts.

You also enable logging on the firewall and the servers, sending all logs to a central Security Information and Event Management (SIEM) system. This allows you to detect suspicious activity, such as repeated failed login attempts from an unknown IP address.

Finally, you test everything. You ask a colleague to try tailgating into the server room; the mantrap stops them. You try to ping a server from outside the firewall; the ping fails. You assign a helpdesk technician a junior role; they cannot access the admin account. All of these steps — physical and logical — work together to protect the data. An IT professional must regularly review and update both layers: changing locks/access cards when someone leaves, updating firewall rules when new services are deployed, and checking logs for anomalies.

## Exam focus

The SK0-005 exam tests your ability to distinguish between physical and logical security controls and to apply them in real-world scenarios. Expect multiple-choice questions that describe a specific security need and then ask you to choose the correct control type or specific example. Common question formats include:

- Which of the following is an example of a logical security control? (Options: a mantrap, a firewall, a CCTV camera, a biometric reader)
- What is the primary purpose of a mantrap? (Options: to identify users, to prevent tailgating, to log access, to encrypt data)
- A company wants to restrict which users can read a specific file. Which control should be used? (Options: a lock on the file cabinet, an ACL, a firewall rule, a biometric scanner)

Key concepts the exam loves:
- Mantrap: purpose is to prevent tailgating (not just to control entry)
- Biometric readers: they are physical controls because they control physical access, even though they use digital matching
- ACLs: they can be applied to files, folders, or network devices; they are rules that allow or deny access based on user identity or group membership
- Firewalls: they filter traffic based on IP addresses, ports, and protocols; stateful firewalls track connection states whereas stateless ones do not
- Defence in depth: the principle that multiple layers of security (physical + logical) are better than relying on one

Common traps the exam uses:
- Confusing authentication (who you are) with authorisation (what you can do). Biometrics authenticate; ACLs authorise.
- Thinking that a firewall alone is sufficient — the exam will remind you that physical access controls are still needed.
- Misidentifying a smart card as a physical control only; a smart card is physical (the card) but also carries logical credentials (the certificate). The exam may ask you to classify it as both.
- Overlooking environmental controls (fire suppression, climate control) as physical security measures — these are explicitly covered in the exam objective.

Memorise these definitions:
- Deterrent control: discourages someone from trying (e.g., a sign saying “CCTV in use”)
- Preventive control: stops the action (e.g., a lock)
- Detective control: identifies that an incident occurred (e.g., a log)
- Corrective control: fixes the damage (e.g., backup restoration)

You will be asked to categorise controls into these four types for both physical and logical domains.

## Step by step

1. **Identify Assets and Threats** — Determine what needs to be protected (servers, network gear, data) and what the risks are (theft, unauthorised access, environmental damage). This step defines the requirements for both physical and logical controls.
2. **Implement Physical Access Controls** — Install locks on server racks and the server room door, add biometric readers or card swipes, and install mantraps at high-security entrances. Also set up CCTV monitoring and environmental controls (fire suppression, climate control). These directly prevent and detect physical intrusion.
3. **Configure Network Perimeter Security** — Deploy a firewall at the network edge and define rules to allow only necessary traffic (e.g., HTTP, HTTPS, VPN). This logical control blocks unauthorised remote access attempts. Also set up an ACL on the router or switch to restrict management access to trusted IP addresses.
4. **Implement System-Level Access Control** — Create user accounts with strong password policies, implement Role-Based Access Control (RBAC) to grant permissions based on job duties, and set file/folder ACLs to limit who can read, write, or execute files. This ensures users only have the privileges they need.
5. **Enable Monitoring and Logging** — Configure CCTV recording, intrusion detection systems (IDS), and log everything from firewalls, servers, and access controls. Centralise logs for review. This allows detection of security incidents and provides evidence for audits, linking physical and logical events together.

## Comparisons

### Physical Control vs Logical Control

**Physical Control:**
- Protects hardware and the physical environment
- Example: lock, biometric reader, CCTV
- Prevents physical access to assets

**Logical Control:**
- Protects data and software via rules and encryption
- Example: firewall, ACL, password policy
- Prevents digital or network-based access

### Biometric Reader vs Smart Card

**Biometric Reader:**
- Uses unique physical traits (fingerprint, iris) for identification
- Cannot be easily lost or stolen (though can be spoofed)
- Requires no token to carry

**Smart Card:**
- Uses a physical card embedded with a chip or magnetic stripe
- Can be lost, stolen, or duplicated if not protected
- Often combined with a PIN (something you have + something you know)

### Firewall vs Router ACL

**Firewall:**
- Dedicated security device or software with stateful inspection
- Operates at the network perimeter, filtering traffic at layers 3-7
- Can perform deep packet inspection and application filtering

**Router ACL:**
- A rule list configured on a router or switch interface
- Typically stateless, only checks packet headers
- Used for basic allow/deny based on IP, port, and protocol

### Mantrap vs Turnstile

**Mantrap:**
- Small room with two interlocking doors; prevents tailgating
- Requires authentication before both doors can be used
- Traps unauthorised person inside if they try to follow

**Turnstile:**
- A rotating barrier that allows one person at a time
- Does not have a second door; can allow tailgating if not monitored
- Usually faster for high-traffic areas but less secure

### Deterrent Control vs Preventive Control

**Deterrent Control:**
- Discourages an attacker from attempting (e.g., warning sign, camera in plain sight)
- Does not actually stop the attack if the attacker decides to proceed
- Relies on psychological effect

**Preventive Control:**
- Actively blocks the attack (e.g., lock, firewall rule, biometric door)
- Physically or logically prevents access
- Does not depend on the attacker’s perception

## Common misconceptions

- **Misconception:** Biometric systems are infallible because each person’s fingerprint is unique. **Reality:** Biometric systems can have false acceptance (allowing an impostor) and false rejection (denying an authorised person). They are highly accurate but not perfect, and can be spoofed with high-quality replicas. (People often assume that because biometrics are unique, the technology is flawless. In reality, sensor quality, environment, and spoofing attacks all introduce error rates.)
- **Misconception:** A firewall protects against all types of threats including viruses and malware already inside the network. **Reality:** A firewall only filters traffic at the network perimeter. It does not detect or remove malware that enters through other means (e.g., email attachments, USB drives). Additional controls like antivirus software are needed. (Beginners see firewalls as a universal shield. They don’t realise that firewalls operate at the network layer and cannot inspect encrypted traffic or block already-approved connections.)
- **Misconception:** Physical security is unnecessary if you have strong logical controls like firewalls and encryption. **Reality:** Physical security is still essential because an attacker who gains physical access can bypass logical controls — for example, by stealing the hard drive or installing a hardware keylogger. (Newcomers often focus on digital threats and forget that servers sit in rooms that need to be physically locked. This misconception is reinforced by media coverage of hacks, not thefts.)
- **Misconception:** ACLs and firewalls are the same thing — both are lists of rules. **Reality:** While both use rule lists, ACLs are typically applied to individual resources (files, folders, router interfaces) to control access by users or systems. Firewalls are dedicated network security devices (or software) that filter traffic based on IP addresses, ports, and protocols at the network boundary. (The term ‘access control list’ is general, and firewall rules are a type of ACL. But in the exam, they are distinct concepts: ACLs are usually for resource access, firewalls for network traffic filtering.)
- **Misconception:** A mantrap is just another name for a turnstile or a revolving door. **Reality:** A mantrap is a small room with two interlocking doors that only allows one person to pass at a time, preventing tailgating. A turnstile is a physical barrier that allows one person through but does not have a second door to trap unauthorised followers. (Both are used for access control, but the specific mechanism and purpose (tailgating prevention) are key differentiators that the exam tests.)

## Key takeaways

- Physical security controls protect the hardware itself, while logical controls protect the data and software on that hardware.
- Defence in depth means layering multiple physical and logical controls so that if one fails, another still provides protection.
- A mantrap is a specific physical control designed to prevent tailgating, not just to control entry.
- Access Control Lists (ACLs) are rules that specify who can access a resource and what they can do with it, applied to files, folders, or network devices.
- Biometric readers are classified as physical controls because they control physical access, despite using digital matching technology.
- Firewalls filter network traffic based on rules addressing source/destination IP, port, and protocol; they are not effective against threats that are already inside the network.
- Logical controls like RBAC assign permissions based on job roles, simplifying user management and reducing the risk of excessive privileges.

## FAQ

**What’s the difference between a firewall and an Access Control List (ACL)?**

A firewall is a dedicated device or software that filters network traffic based on IP addresses, ports, and protocols. An ACL is a set of rules applied to a resource (like a file, folder, or router interface) to control which users or systems can access it. Firewalls operate at the network boundary; ACLs can be used both at the network level and on individual resources.

**Do I need both a physical lock and a password on a server?**

Yes. A physical lock on the server room door prevents unauthorised people from touching the hardware, while a password (or other logical control) prevents unauthorised users from logging into the operating system. They protect against different threats — theft vs. remote access — so both are needed for defence in depth.

**What is a mantrap and when is it used?**

A mantrap is a small room with two interlocking doors that only allows one person to pass at a time. It is used in high-security areas to prevent tailgating — where an unauthorised person follows an authorised person through a door. The first door must close completely before the second can open, trapping anyone trying to sneak through.

**How do biometric fingerprint readers work as a security control?**

Biometric readers scan a person's fingerprint and compare it to a stored template. If it matches, they grant access. They are a physical security control because they control entry into a physical space. They are considered more secure than keycards because fingerprints are unique and harder to duplicate, though they are not foolproof.

**Is physical security part of the CompTIA Server+ (SK0-005) exam?**

Yes, objective 2.1 specifically says ‘Implement physical security measures (e.g., locks, biometrics) and logical controls (e.g., firewalls, ACLs).’ You must know examples of each and how to apply them in real-world scenarios. Physical security is a significant part of the syllabus.

**Can logical controls replace physical ones entirely?**

No. Logical controls protect data and network access, but they cannot stop someone from physically stealing the server or damaging it with a fire. Physical controls are essential for protecting the hardware itself. A complete security plan always includes both types.

---

Interactive version with quiz and diagrams: https://courseiva.com//learn/server-plus/physical-and-logical-security-controls