Physical security is the combination of people, processes and technology that protects people, buildings, equipment and data from physical threats such as unauthorized entry, theft, vandalism and tampering. For most organizations the technology side means three systems: video surveillance, door access control and intrusion alarms, increasingly managed from the cloud and running on the same network as everything else. For IT buyers, it is also the layer that keeps someone from walking out with a server or plugging into a network closet.
At a glance
- The core systems are cameras and recorders, door access control (readers, credentials, controllers, locks), intrusion alarms with monitoring, and visitor management.
- Modern systems are network devices, so cabling, PoE, network segmentation and patching are IT concerns.
- Each system can run on-premises or as a cloud service; some providers sell subscription or managed offers under the label physical security as a service.
- Processes matter as much as hardware: access reviews, prompt badge removal, alarm response and video retention.
- Life-safety codes, privacy law and biometric rules vary by jurisdiction and shape what you can deploy.
What problem it solves
Physical access defeats many digital controls. A stolen laptop, an unlocked network closet or a former contractor whose badge still works can turn into a data breach or an outage as easily as a phishing email. At the same time, organizations need to keep staff and visitors safe, protect inventory and equipment, and answer auditors, insurers and customers who ask who can enter sensitive areas and how they know.
Many organizations have grown physical security site by site: a different camera recorder in each closet, a badge server nobody patches, an alarm company on a copper phone line, and a paper visitor book. A physical security program, and the systems that support it, gives one view of who can enter where, what happened, and who responds.
How it works
Video surveillance. IP cameras record to a network video recorder (NVR), to storage on the camera, or to the cloud through video surveillance as a service (VSaaS). Older analog cameras record to a digital video recorder (DVR). Video analytics detect people, vehicles and events and make footage searchable; license plate recognition (LPR) reads plates at gates and parking.
Door access control. An access control system uses card readers at doors, credentials such as proximity cards, smart cards or mobile credentials, and controllers that unlock doors for authorized people. Cloud-managed versions are sold as access control as a service (ACaaS).
Alarms and visitors. Intrusion alarm and monitoring detects break-ins and gets a monitoring center to respond. A visitor management system registers and badges guests and contractors. Occupancy monitoring shows how spaces are used.
Subscription and managed offers. Physical security as a service (PSaaS) is a provider label, not a standard, for selling one or more of these, sometimes with monitoring, hardware or maintenance, as a subscription or managed service.
Network and infrastructure. Cameras, readers and controllers ride on structured cabling and are often powered by Power over Ethernet (PoE). They are Internet of Things (IoT) devices with a history of weak default security, so network segmentation and other IoT security practices apply.
When it matters for buyers
- When opening a new office. Cabling, PoE budgets, network segments and door hardware are cheapest to plan before fit-out.
- When a system fails or reaches end of life. A dead recorder or unsupported badge server is a natural point to standardize and consider cloud options.
- When offboarding is unreliable. Tying badges to the same joiner and leaver process as network accounts closes a common gap.
- When copper lines are retired. Alarm panels and door phones on copper need new communication paths.
- When auditors, insurers or customers ask. Access logs, video retention and alarm monitoring often come up in security questionnaires.
Questions to ask vendors
- Which parts do you provide (cameras, door access, alarms, visitors, monitoring), and which come from partners?
- Cloud, on-premises or hybrid: where is video stored and what happens during an internet outage?
- Which cameras, readers and credentials do you support, and can we reuse what we have?
- How do your devices get firmware updates, and how should they be segmented on our network?
- Who is responsible for code compliance at the door and for permits?
- How do you support our privacy, retention and biometric obligations in each location?
- What does it cost per camera, door and site over the life of the hardware?
How it differs from cybersecurity
Cybersecurity protects systems and data from attacks over networks; physical security protects people, places and equipment from threats in the real world. The two overlap more each year: physical security devices are network-connected and need cyber protection, and physical access can bypass digital controls. Many organizations send door and alarm events to their security information and event management (SIEM) tools or security operations center (SOC) so physical and digital signals are reviewed together. For help with cameras and doors, see our video surveillance and door access controls overviews.
Problems this helps with
- Former employees' badges still open doors
- Cameras that weren't recording when we needed the footage
- Different security systems and vendors at every site
- Auditors asking who can get into the server room
