Detection Controls and Placement

The lesson on choosing physical controls picked controls for one site, most of them to keep an adversary out. This lesson covers four controls that detect one who gets in, and where each belongs in one building. How staff use a recording or an alarm afterward is left for the lesson on using detection evidence.

The building is the regional auction house in the table below.

A camera makes a visual record of what happens in its view. Every feed at the auction house goes to a monitor at the lobby counter and to a recorder in a locked cabinet in the manager's office. Someone watching the monitor can see an intrusion while it happens. The recording serves a later investigation, such as one into a watch missing before its sale.

A camera records but can't act. A security guard watches an area and can act once something suspicious is seen. A visitor who slips behind the registration counter on sale day can be recorded, but only a guard can stop them.

A motion sensor picks up motion in the space it covers and raises an alarm. The vault's sensor is armed at lock-up and sends its alarm to security.

Employees detect intruders too. The clerks, intake staff, and handlers know one another, so they often notice a stranger in the back corridor first and alert security.

A camera goes where it could capture an adversary at work, and where that record would help. Points of ingress and egress come first, since everyone entering or leaving passes one. Here those are the main entrance and the loading dock.

Pointed steeply down at the threshold, the entrance camera records the tops of heads. Angled toward people as they approach and come through the door, the same camera records each face.

The dock is empty most evenings, so a camera within reach there could be covered or broken unseen. It goes under the roof edge, in a metal housing.

One camera at the dock end of the back corridor covers both the vault entrance and the records office door. An adversary there at night would be at one of those two locks, and the recording shows which.

A motion sensor is informative only where activity is unexpected. The vault after lock-up qualifies: its three staff have left, and nobody should be inside until morning.

The showroom gets no sensor, because people are expected there, by day and most evenings too. Even armed only after closing, a sensor there would go off most evenings for the staff working late. People would learn to disregard it, including the alarm an adversary sets off.

Every entry into a space with sensitive information or systems gets a lock. Here that means the vault and the records office, including the office's second door behind the registration counter.

The vault, the most sensitive space, also gets an access control vestibule at its entry. This is a small room that holds one person, and its inner door opens only after the outer one closes. During intake the vault entrance opens dozens of times a day. Each opening invites piggybacking or tailgating, the attacks from the lesson on physical attacks. The vestibule lets nobody through with an intake staffer, invited or not.

A guard either holds a post or walks a route, and on preview days and sale day the auction house uses one of each. On those days every bidder enters by the main entrance and registers in the lobby. The lobby funnels the day's traffic past one point, so a stationary guard is posted there.

Outside, the other kind fits. On preview days and sale day the parking lot fills and empties all day, and the dock door and ground-floor windows face it. A second guard walks the lot and around the outside walls. An adversary waiting in the crowd for a chance at the dock door can't tell when the guard will next come around the corner. Whatever the adversary tries there has to be finished before then.

Follow an adversary who comes in through the dock at night. The dock camera records them arriving, and the corridor camera records them at the vault entrance. The lock and the vestibule hold them there, and if they get through, the vault's sensor raises the alarm. Up to the vault door the adversary is never off camera, and inside the vault the sensor's alarm sends security to the live feeds and the recording.