8.7. Physical and Personnel Security Operations
💡 First Principle: Physical security is the oldest security discipline and remains the foundation of all other security — a sophisticated logical security architecture is bypassed entirely if an attacker can walk up to a server and plug in a USB drive, or if a thief can walk out with a laptop containing sensitive data. Physical access to systems is game over for most logical controls.
Domain 7 tests operational physical security: maintaining and monitoring physical controls, not just designing them (which was Domain 3). The focus is on operational practices — guard patrols, badge access reviews, camera system management, and responses to physical security incidents.
Why this matters: Physical security operations questions often appear as scenario questions about what to do WHEN physical security is compromised: tailgating detected, visitor badge misuse observed, unauthorized person in a server room. The correct response sequence typically follows the same principle as logical incidents: contain first, investigate, report.
⚠️ Common Misconception: "Least privilege and need-to-know are the same concept." Least privilege governs access rights — users receive only the minimum permissions required for their job function. Need-to-know governs information access — even with appropriate clearance, users access information only when required for a specific task. A system administrator may have root access (least privilege for their role) but should not browse HR salary files (no need-to-know).
