We’re Tracking the Future of Security

Category: Physical Security

  • Perimeter Intrusion Zone Segmentation and Handover Testing

    Perimeter Intrusion Zone Segmentation and Handover Testing

    Perimeter sensors detect activity along a physical boundary, but operators respond to zones. If zones are too long, the alarm location is vague and verification takes longer. If they are too short, the system can generate excessive events and complex maintenance. Segmentation should balance localization, site geography, sensor behavior and response capability.

    Design zones around operational landmarks

    Use fence corners, gates, roads, buildings and numbered posts as stable references. A zone name should tell an operator where to look and tell a responder where to go. Avoid labels that exist only in an installer drawing or controller database without a visible field reference.

    Consider terrain, vegetation, drainage, lighting and public access. One continuous sensor cable may cross areas with different nuisance conditions. Logical zones can separate those environments, but the design must preserve enough overlap to avoid gaps at boundaries.

    Define the handover between technologies

    An intrusion alarm may cue a fixed camera, move a PTZ camera, display a map and create an incident in a command platform. Test the complete handover rather than validating each device separately. The selected view should show the correct zone with useful pre-event and post-event footage.

    Where adjacent sensors overlap, document which system has primary responsibility and how simultaneous alarms are presented. Duplicate events should support confidence without overwhelming the operator. If one technology is unavailable, the degraded workflow should remain clear.

    Walk-test boundaries and approach paths

    Use controlled targets to cross each zone at representative points, speeds and directions. Include corners, changes in fence construction, gates and locations near electronics or junction boxes. Test along the boundary as well as across it because some sensing technologies respond differently to parallel movement.

    Pay particular attention to the last part of one zone and the first part of the next. Record whether both detect, neither detects or the platform assigns the event to an unexpected location. A clean central-zone test does not prove boundary coverage.

    Validate response information and maintenance

    The operator display should include the zone name, map position, camera view, priority and response instruction. Field responders need the same naming convention. Confirm radio procedures and access routes, especially where a long perimeter makes travel time significant.

    Maintain a baseline of sensitivity, alarm location, environmental conditions and test results. Repeat boundary tests after fence repair, vegetation work, sensor replacement, software changes or recurring nuisance alarms. Perimeter segmentation is part of broader Physical Security design: the technical alarm becomes useful only when localization, verification and response remain connected.

    Store the accepted zone map with controller configuration, camera presets and response instructions. Maintenance teams should record temporary bypasses and confirm their removal. A periodic end-to-end exercise can verify that field detection, network delivery, command-platform display and response dispatch still use the same zone identity.

    Reference sources

  • Door-Held-Open Alarm Tuning for Access Control Systems

    Door-Held-Open Alarm Tuning for Access Control Systems

    A door-held-open alarm is useful only when its timer reflects how the opening is actually used. A delay that is too short produces nuisance alarms and operator fatigue. A delay that is too long gives an unsecured opening time to remain unnoticed. Tuning should begin with the protected function, traffic pattern and physical behavior of each door.

    Separate held-open from forced-open conditions

    The system should distinguish a valid access transaction followed by a door that remains open from a door opening without an accepted transaction. Those conditions require different timers and responses. Confirm that the door-position contact, request-to-exit input, lock status and credential event are correctly associated with the same opening.

    Mechanical behavior matters. A slow closer, wind pressure, accessibility requirements or delivery traffic can extend normal opening time. Test from fully closed through release, passage and relatching. A contact that changes state before the latch is secure may report the door as closed while the opening can still be pulled open.

    Set timers from measured operations

    Observe representative users and activities rather than selecting one site-wide value by convenience. Public entrances, staff doors, loading areas and secure equipment rooms have different patterns. Establish a normal range, then add a justified margin that still exposes abnormal behavior.

    Document approved exceptions such as scheduled deliveries or supervised events. An exception should have a start, end, owner and audit trail. Permanently disabling the alarm to manage recurring nuisance activity removes a control without resolving the reason for the alarm.

    Design meaningful escalation

    The first notification should identify the door, state, elapsed time and related access event. Operators need a clear instruction: review video, call a local contact, dispatch staff or escalate immediately. High-risk doors may require faster action or a second independent confirmation.

    Test acknowledgement and repeat-alarm behavior. If acknowledging an alarm suppresses all later warnings while the door remains open, the condition can disappear from attention. The platform should retain the original event, operator action, escalation and restoration time for later review.

    Verify failure and maintenance scenarios

    Simulate a failed contact, obstructed closer, invalid request-to-exit signal and communications loss under controlled conditions. Confirm that a wiring fault is not interpreted as a normal closed state. Supervised communication between readers and controllers can improve fault visibility, but commissioning must prove the expected behavior.

    Review nuisance-alarm rates by door and cause. Repeated held-open alarms may reveal a process problem, unsuitable hardware or poor scheduling rather than a need for a longer timer. Door alarm tuning is part of ongoing Access Control & Identity assurance and should be revisited after hardware, traffic or operating-hour changes.

    Keep the approved timer, exception list and response instruction under change control. When operators request a longer delay, review the underlying alarm history before approving it. The evidence should show whether the issue came from user behavior, door hardware, contact alignment, controller logic or an unrealistic original assumption.

    Reference sources

  • Access Credential Revocation and Offboarding for Physical Security Systems

    Access Credential Revocation and Offboarding for Physical Security Systems

    Offboarding is complete only when a departing person’s physical and digital access paths have been identified, revoked and verified. A returned badge does not prove that mobile credentials, biometric enrollments, vehicle permissions, visitor-system accounts or remote administration rights have been removed. The process must follow the identity across every connected security system.

    Build an authoritative trigger

    Revocation should begin from a trusted personnel or contract event with an effective time and accountable owner. Human resources, procurement, facilities and security may hold different parts of the record, so the workflow needs one authoritative trigger and a method for urgent terminations. Role changes and extended leave also require review even when the person remains employed.

    The request should identify the person, organization, sponsor, credential types, sites and systems in scope. Avoid using names alone; duplicate names and formatting differences can lead to missed records. Preserve identifiers that allow operators to find the same identity in the access-control system, visitor platform and mobile-credential service.

    Revoke the credential and the entitlement

    Disable active badges and mobile credentials, but also remove the access levels, groups and schedules that granted permission. Otherwise a replacement credential may inherit rights that should have ended. Biometric templates and identity documents should be handled according to retention and legal requirements rather than left indefinitely in an active population.

    Collect physical badges where practical and record those that were not returned. Vehicle tags, keys, tokens and temporary passes need their own disposition. Contractors may have access through a shared employer relationship, so terminating one assignment should not accidentally remove or preserve access for unrelated personnel.

    Verify across integrations and offline devices

    Integrated systems may not update simultaneously. Confirm that revocation reached downstream controllers, wireless locks, elevators, parking systems and third-party services. Offline locks and cached mobile credentials deserve particular attention because a central status change may not take effect until synchronization.

    Test high-risk cases by reviewing the credential status and recent transactions. Do not create a real unauthorized entry attempt unless the procedure is controlled. The verification record should show who performed each action, when it completed and which exceptions remain open.

    Measure timeliness and completeness

    Track the interval from the effective termination time to confirmed revocation. Separate routine delays from urgent failures, and investigate credentials that remain active beyond policy. Periodic reconciliation between personnel records and active access identities can identify orphaned accounts, expired contractors and duplicated credentials.

    Access offboarding is a lifecycle control within Access Control & Identity, not a one-time badge task. Clear ownership, complete inventories and evidence-based closure reduce the window in which former access can be misused.

    Include service identities and scheduled accounts assigned to the departing person. Shared administrative credentials should be rotated through a controlled process when exposure cannot be ruled out, while audit evidence is preserved.

    Reference sources

  • Thermal Camera Acceptance Testing: Baselines, Calibration and Environmental Checks

    Thermal Camera Acceptance Testing: Baselines, Calibration and Environmental Checks

    Thermal cameras can reveal people, vehicles and heat patterns when visible-light imagery is limited, but acceptance cannot be based on a daytime image alone. Performance changes with distance, weather, background temperature, mounting stability and the analytics configured around the sensor. A useful acceptance test establishes a repeatable baseline for the actual scene and mission.

    Start with the required detection task

    Define whether the camera must support detection, recognition of a target class, alarm verification or temperature-related observation. These are different tasks and require different test evidence. Record the target size, route, speed and parts of the scene where an alarm is required. Avoid translating a general product range into a site guarantee without field validation.

    Confirm mounting height, angle, horizon, focus, field of view and obstructions. Check that the intended target occupies enough pixels across the relevant path and that the image remains usable at the edges. Vegetation, fencing, reflective surfaces and warm machinery can create scene-specific limitations.

    Capture environmental baselines

    Thermal contrast can decline when a target and background approach the same apparent temperature. Test at more than one time of day where practical, especially near sunrise or sunset and during expected seasonal conditions. Record air temperature, precipitation, wind, surface conditions and any active heaters or exhausts.

    A baseline should include representative images and alarm results, not just configuration screenshots. If the camera supports automatic gain or scene-based processing, record the settings and observe how rapid scene changes affect the image. The purpose is to create a reference that maintenance teams can compare with later performance.

    Validate analytics and handoff behavior

    Walk or drive controlled targets through required zones, boundaries and approach angles. Include expected speeds and partial occlusion. Measure whether alarms occur in the intended location, whether the event is delivered to the video platform and whether operators receive useful pre-event and post-event footage.

    False-alarm testing should use realistic non-target activity such as moving vegetation, animals, hot equipment, reflections and weather. A short quiet test is not enough for scenes that vary across a day. Record nuisance events by cause so thresholds can be adjusted without hiding genuine targets.

    Close acceptance with maintainable evidence

    Document firmware, time synchronization, network settings, analytics versions, zone coordinates and user permissions. Verify recording, export and event timestamps across the complete path. If another camera is cued for visual confirmation, test the handoff under the same scenarios.

    Define triggers for retesting: camera movement, vegetation growth, construction, firmware changes or repeated nuisance alarms. Thermal acceptance is part of ongoing Video Surveillance & Imaging assurance. A signed baseline makes performance drift visible and prevents later troubleshooting from relying on memory.

    Assign a responsible owner for the baseline and store it with approved drawings and maintenance records. Operators should know how to report suspected coverage loss and which evidence must be captured before settings are changed.

    Reference sources

  • Security Alarm Escalation Matrices: Priorities, Contacts and Timeouts

    Security Alarm Escalation Matrices: Priorities, Contacts and Timeouts

    An alarm escalation matrix converts a technical event into an agreed sequence of operational decisions. It identifies which alarms require immediate action, who must be contacted, how long each person or team has to respond and what happens when the first path fails. Without that structure, operators improvise under pressure and similar incidents receive inconsistent treatment.

    Define priorities from consequence and urgency

    Priority should reflect the consequence of delay, not simply the device type. A door-held alarm at a low-risk store room may be routine, while the same signal at a pharmaceutical cage or data-hall entrance may require immediate dispatch. Build priorities from location, asset, operating mode, corroborating signals and the response that is realistically available.

    Keep the number of priority levels manageable. Each level needs a plain-language definition and an expected action. If two levels produce the same operator response, the distinction may not provide operational value. Document exceptions such as maintenance windows, known construction activity and temporary risk controls.

    Map contacts, ownership and timeouts

    For every priority, list the primary contact, alternate contact and final authority. Include communication methods, hours of coverage and the information the operator must provide. A named individual alone is fragile; use roles or duty functions where possible and maintain a controlled roster behind the matrix.

    Timeouts should be measurable. Define when the clock starts, what counts as acknowledgement and when the next step activates. An unanswered telephone call is different from an acknowledged incident with no follow-up. The matrix should state whether escalation transfers ownership or merely adds another participant.

    Connect verification to escalation

    Alarm verification can change the required path. Video, audio, access events and adjacent sensors may raise or lower confidence, but verification should not create an indefinite pause. Set a maximum verification interval and specify conditions that permit immediate escalation, such as a duress signal or multiple independent detections.

    The workflow should preserve the original event, verification evidence, operator decisions, notifications and acknowledgement times. Those records support investigation and reveal whether delays came from technology, unclear procedures or unavailable responders.

    Test the matrix as an operational system

    Tabletop exercises can reveal missing numbers and unclear authority, but live tests are needed to measure actual notification and acknowledgement behavior. Use representative scenarios across normal hours, nights and holidays. Confirm that the monitoring platform displays the same priority labels and instructions used in the approved document.

    Review the matrix after organizational changes, incidents and major system modifications. Track overdue acknowledgements, repeated contact failures and unnecessary escalations. The goal is not to eliminate judgment; it is to give operators a reliable baseline for using judgment consistently.

    Escalation design belongs with broader Command & Control governance. A concise, tested matrix can reduce hesitation while ensuring that serious alarms reach people who have both the authority and information to act.

    Reference sources

  • Boston Dynamics Positions Mobile Robots for Enterprise Security

    Boston Dynamics Positions Mobile Robots for Enterprise Security

    Boston Dynamics is presenting mobile robots as tools for enterprise inspection and security operations, extending sensor coverage into locations that may be repetitive, remote or hazardous for personnel. International Security Journal examined the shift on 21 September.

    From patrol visibility to repeatable inspection

    A mobile robot can carry cameras, thermal sensors or environmental instruments along a defined route. The security value is not simply movement: the platform must collect consistent observations, transmit them reliably and flag deviations that a human operator can assess. Repeatable inspection can be useful around industrial assets, utility spaces and large campuses.

    Robots do not remove the need for a response team. Stairs, doors, crowds, weather and communications gaps can limit coverage, while an ambiguous alert still requires judgment. Operators also need rules for privacy, recording and interaction with employees or visitors.

    Integration and governance

    Before deployment, organizations should map safe routes, define no-go areas, test loss-of-communications behavior and secure the robot’s credentials. Video and telemetry should enter the existing command workflow rather than create a separate unmonitored console. Mobile robots can strengthen industrial safety and monitoring when their role, limitations and escalation process are explicit.

    Sources

  • Physical Security Risk Assessments: Threat, Vulnerability and Consequence Analysis

    Physical Security Risk Assessments: Threat, Vulnerability and Consequence Analysis

    Security budgets are finite, and not every threat deserves the same investment. A physical security risk assessment is the structured process of identifying what could go wrong at a facility, how likely each scenario is, and how much damage it would cause, so that security spending targets the risks that matter most rather than whatever equipment a vendor is currently promoting. Done well, it produces a prioritized list of gaps tied to actual consequences; done poorly, it produces a generic checklist that could apply to any building anywhere.

    Threat Identification

    The first step catalogs what a facility actually needs to defend against, which varies enormously by site: a data center worries about unauthorized physical access to server racks and insider threats, a retail location worries about theft and workplace violence, a chemical plant worries about sabotage with public-safety consequences. Threat identification draws on crime statistics for the area, the facility’s own incident history, industry-specific threat intelligence, and simply asking staff what near-misses or concerns they have already observed on site.

    Vulnerability Analysis

    Once threats are identified, vulnerability analysis asks how exposed the facility actually is to each one — walking the perimeter, testing access points, and reviewing whether existing controls (fencing, lighting, cameras, access control, guarding) would actually detect or delay a given scenario, as opposed to simply being present. A door with a card reader is not a control if it is routinely propped open; a camera pointed at a loading dock is not a control if no one monitors the feed or reviews it after an incident.

    Consequence and Criticality

    Not every asset in a facility matters equally, so assessments rank assets and areas by criticality: what happens if this specific space, system, or piece of equipment is compromised? A server room outage might halt operations company-wide, while a supply closet breach is a minor loss. This criticality ranking, combined with threat likelihood and vulnerability, is what lets an assessment produce an actual risk score rather than a flat list of undifferentiated findings.

    The CARVER-Style Prioritization Model

    Higher-consequence facilities often use structured scoring frameworks, descended from the military CARVER method (Criticality, Accessibility, Recoverability, Vulnerability, Effect, Recognizability), to rank assets and scenarios on a consistent numeric scale rather than relying on a single assessor’s subjective judgment. These frameworks force the assessment team to score each factor separately before combining them, which helps surface disagreements about, for example, how accessible a target really is, rather than letting one loud opinion in the room set the final priority.

    From Assessment to Action

    An assessment that sits in a binder changes nothing. The output that matters is a prioritized remediation plan mapping each significant gap to a specific fix, an owner, a cost estimate, and a timeline, with the highest-consequence, highest-likelihood gaps addressed first. Because threats and the facility itself both change over time, most security programs treat the risk assessment as a recurring process, typically annual or after any major incident or facility change, rather than a one-time report.

    Reference sources

  • Key Control and Electronic Key Management Systems Explained

    Key Control and Electronic Key Management Systems Explained

    Every access-controlled building still has mechanical keys somewhere: master keys for maintenance staff, override keys for electronic locks during a power failure, keys to server cabinets, vehicles, or cash boxes that were never converted to card access. Key control is the discipline of tracking who holds which key, when, and why — and electronic key management systems exist because a sign-out clipboard in a supervisor’s office does not scale, and does not produce an audit trail anyone can trust.

    From Lockboxes to Electronic Cabinets

    A basic key control program starts with a locked cabinet and a manual log, but electronic key management cabinets replace that with individually locked key slots, or in higher-security versions, keys physically tethered to an electronic fob that only releases when a valid credential is presented. Each key or fob has a unique identifier the system tracks, so the cabinet knows not just that a key was removed, but which specific key, by whom, and whether it was returned to the correct slot.

    Access Rules and Scheduling

    Electronic systems let administrators define exactly which users can access which keys, and when: a contractor might be authorized to remove a specific key only during scheduled work hours, while a facilities manager retains broader access at any time. Some systems require a second authorized user to approve release of high-value or master keys, and most will trigger an alert if a key is not returned within a defined window, turning a vague policy (“please return keys promptly”) into an enforced and logged rule.

    Integration With Access Control and Asset Management

    Because key cabinets are themselves electronic devices, they increasingly integrate with the same access-control platform managing card readers and door hardware, so a single credential works at both the front door and the key cabinet, and a single audit log covers both. Some cabinets extend beyond keys to manage other high-value or sensitive items — radios, weapons, narcotics box keys in healthcare settings, or fleet vehicle fobs — using the same locker-and-credential model.

    Mechanical Master Keying

    Underneath any electronic layer, most buildings still rely on a mechanical master-key system, where individual keys open specific doors and progressively higher master keys open larger groups of doors. Designing and maintaining that hierarchy is its own discipline: a lost sub-master key can force rekeying an entire wing of a building, which is one of the strongest practical arguments for moving high-consequence keys into an electronic cabinet with a full audit trail rather than leaving them in general circulation.

    Reference sources

  • Physical Penetration Testing: How Red Teams Assess Physical Security Programs

    Physical Penetration Testing: How Red Teams Assess Physical Security Programs

    A facility can pass every compliance checklist — badges issued, cameras installed, doors alarmed — and still be vulnerable to someone who simply holds a door for a stranger carrying boxes. Physical penetration testing exists to find that gap before an adversary does, by hiring a team to actively attempt unauthorized entry, credential theft, or data exfiltration using the same techniques a real intruder would use, rather than reviewing policies and equipment lists from a desk.

    Scoping and Rules of Engagement

    Every physical penetration test starts with a written scope defining exactly what testers are authorized to attempt, which buildings and hours are in play, and critically, what to do if a tester is confronted or detained — typically a “get out of jail free” letter signed by an authorized executive that testers carry and can present to security or police. Rules of engagement also specify hard limits: most engagements exclude anything that could cause real property damage, injury, or trigger an actual emergency response, distinguishing a controlled assessment from genuine criminal activity.

    Social Engineering and Tailgating

    The most commonly successful technique in physical penetration tests is not defeating a lock but exploiting human courtesy: tailgating through a badge-controlled door behind an employee, posing as a vendor or delivery driver, or simply projecting enough confidence and a plausible cover story that staff assume someone else already verified the visitor. These tests measure whether a facility’s access-control technology is actually being used as designed, since a mantrap or turnstile provides no protection if employees routinely hold the door for anyone walking behind them.

    Lock Bypass and Physical Defeat

    Where technology is tested directly, common techniques include lock picking and bumping on mechanical locks, shimming or manipulating electronic strike hardware, and testing whether door sensors and alarms actually trigger and are actually monitored rather than just installed. Testers also probe less obvious entry points: loading docks, roof access, shared stairwells in multi-tenant buildings, and ceiling tiles or under-floor spaces that can bypass a badge-controlled door entirely.

    Reconnaissance Before the Test

    Serious engagements begin with open-source reconnaissance well before anyone sets foot on site: employee badge photos posted on social media, building floor plans in public permit filings, shift-change patterns visible from a parking lot, and vendor or contractor uniforms that can be replicated. This phase mirrors the reconnaissance a genuine threat actor would conduct and often reveals more exploitable information than the physical test itself.

    Reporting and Remediation

    A physical penetration test is only useful if its findings translate into fixed gaps rather than a list of embarrassing anecdotes. Effective reports document each successful and failed attempt with timestamps and evidence, map findings to the specific control that failed (a policy, a piece of technology, or a training gap), and prioritize remediation by how easily the same technique could be repeated by someone with less skill or access than the test team had.

    Reference sources

  • Elevator and Vertical Transportation Security Technology

    Elevator and Vertical Transportation Security Technology

    In most multi-story buildings, the elevator is the fastest way to move between floors — which makes it both a convenience and a security gap. A lobby with a card reader at the front door does little good if anyone who reaches the elevator bank can ride to any floor once inside. Vertical transportation security addresses that gap through a combination of access control integration, fire-service overrides, and monitoring that has to work even when the building’s normal operating logic is suspended during an emergency.

    Destination Dispatch and Floor Restriction

    The most common access-control integration restricts which floors a rider can select, either by requiring a credential at a lobby turnstile before the elevator call is even registered, or by requiring a card or mobile credential to be presented inside the cab before a floor button will respond. Destination-dispatch systems take this further: a rider enters their destination floor at a lobby kiosk rather than inside the cab, and the system assigns them to a specific car and groups passengers heading to similar floors, which both improves traffic efficiency and gives the access-control system a clean record of who requested which floor before they ever board.

    Firefighter’s Service and Fire Recall

    Every access restriction built into an elevator has to yield to fire-service requirements. Under Phase I recall, activating a fire alarm sends all elevators in the affected bank to a designated landing, typically the ground floor, where they park with doors open until firefighters take manual Phase II control using a key switch inside the cab. This recall function overrides any access-control floor restriction in place during normal operation, and life-safety codes require it to work independent of the building’s access-control system in case that system has failed or lost power.

    Shaft and Machine Room Monitoring

    Beyond passenger-facing controls, elevator machine rooms and shaft access points are themselves targets for tampering, since disabling or manipulating elevator controls can create both a safety hazard and a way to bypass floor restrictions elsewhere in the building. Machine room doors are typically included in the building’s access-control and alarm system like any other restricted space, and some buildings add door-position sensors on shaft access doors at each floor to detect unauthorized entry into the shaft itself.

    Cameras in the Cab

    Camera coverage inside elevator cabs presents a narrower field of view and more variable lighting than open building spaces, which has driven demand for cameras designed specifically for cab mounting — typically compact, ceiling- or corner-mounted units with wide-angle lenses and onboard storage or wireless transmission, since cars moving between floors can briefly lose connectivity to a wired network. Video from cab cameras is used both for incident investigation and, increasingly, for analytics that can flag events like a fall or an altercation in the confined space of a moving car.

    Emergency Communication

    Elevator emergency phones remain a code requirement in most jurisdictions, but the technology behind them has moved from a simple two-way phone line to two-way voice communication systems tied into the building’s broader emergency communication and monitoring platform, often with automatic location identification so a monitoring center knows which car and which building a call originates from without the trapped passenger needing to describe their location.

    Reference sources