People control vs Physical security

Controls & technical basics

A safeguard aimed at staff themselves - screening, training, clear duties and what happens when someone joins or leaves.

Formal

A security control that works through the people in the organisation - background checks, terms of employment and confidentiality, awareness and training, reporting duties and the process when staff join, move or leave - one of the four control themes in ISO 27002.

In plain English

Like a kindergarten that checks a new helper's background, walks her through the daily routines on her first day and takes back her key when she leaves - the safety comes from who is let in and what they know.

In practice

At a pharmacy chain, new staff sign a confidentiality agreement and take a short course on handling customer data in their first week, and their access ends on their last day.

Why it matters

Many attacks and mistakes start with a person, so controls aimed only at machines leave the most common way in wide open.

Physical security

Fundamentals

Protecting buildings, rooms and equipment so that nobody can simply walk in, take, break or plug into them.

Formal

The controls that protect the physical surroundings of information - sites, server rooms, devices and paper - against entry by outsiders, theft, damage and dangers such as fire, water and power loss. ISO 27002 groups them as its physical controls.

In plain English

The best lock on a diary is no help if someone can simply pick up the whole diary and walk off with it.

In practice

At a regional hospital, a visitor follows a porter through a card-locked door, finds an empty meeting room and plugs a small device into a free network socket; a no-following rule and switched-off sockets would have stopped it.

Why it matters

Anyone with hands on a machine can often get around its digital protection, and fire or flooding can end availability as surely as any attack.

Shared connections

Security control Insider threat Organisational control