4.7. Physical Security Design
💡 First Principle: Physical security is the foundation that all logical security rests on. An attacker with physical access to a server can bypass every authentication mechanism, extract encryption keys from RAM, and walk out with the hardware. Physical controls exist to prevent unauthorized physical access to assets, people, and the facilities that contain them.
Physical security is applied in concentric rings — each ring provides a layer of protection. Defeating the outer ring does not grant access to the inner ring. This is defense in depth applied to the physical world, and the CISSP tests it as exactly that.
Why this matters: Physical security questions on the CISSP often appear in scenarios about data center design, facility selection, and emergency response. The exam tests whether you think about physical threats with the same rigor as logical ones — and whether you understand that physical access often renders logical controls irrelevant.
⚠️ Common Misconception: "Physical security is an IT concern because it protects IT equipment." Physical security is a separate security discipline that intersects IT. Physical security personnel (facilities, physical security officers, guards) are often organizationally separate from the IT security team. The CISSP tests integration of physical and logical security — the CISO is responsible for both, and they must be coordinated.
