Rating Physical Risk

The risk assessment lesson rated each vulnerability by its likelihood and severity and recorded the rating. This lesson rates vulnerabilities in a physical space. It explains why physical access matters even where technical controls are sound. Then it sorts physical findings into three tiers, high, moderate, and low, each with its own condition.

The example throughout is one site visit to a branch office of a state motor vehicle agency. Arrivals take a numbered ticket from a printer by the lobby door. Four counter stations serve them, each with a clerk at a computer.

The visit recorded three findings. The machine that prints license cards sits with its blank card stock behind a half-door at the end of the counter. A person on the public side can reach over that half-door. The unlocked cabinet under the ticket printer holds the network switch the printer plugs into, and the switch's spare ports are live. The traffic cones that mark the driving course in the parking lot are stacked against an outside wall, with nothing securing them.

The branch has three technical controls. A counter computer shows nothing until a clerk signs in. The card-issuing software prints a card only after a supervisor approves the record. The staff Wi-Fi, which the counter computers use, admits a device only with its password.

A person leaning over the half-door meets none of these checks. They can lift blank stock from the tray, or take the printer, and nothing asks them to sign in. The sign-in and the approval apply to requests made through the software, and taking a card from a tray makes no request.

The second finding goes around the Wi-Fi password the same way. The check still runs, but a laptop plugged into a spare port in the cabinet joins the same network by cable and is never asked for the password.

The card printer is a sensitive system. It turns an approved record into a license, and its blank stock is the card every license is printed on.

Access to the printer is neither restricted nor controlled. The half-door is latched, so nobody walks through it. But nothing stops a person reaching over it, and no clerk works at that end of the counter.

Since the printer is sensitive and nothing controls who reaches it, the first finding is rated high. The half-door is the usual place to go wrong. It looks like a restriction, but access is restricted only if the wrong person can't reach the printer.

A brochure rack behind the same half-door would be exposed the same way, but brochures aren't sensitive, so it wouldn't rate high.

The cabinet under the ticket printer holds spare rolls of ticket paper and the network switch the printer plugs into. The ticket printer is neither sensitive nor critical. It prints numbers and nothing else, and on a day it jams the clerks call arrivals in order by hand.

The cabinet has no lock, and the switch's spare ports are live on the network the counter computers use. Anyone waiting in the lobby can open the door and plug in a laptop.

Nothing in the cabinet matters on its own, but the spare ports make it a foothold. A laptop plugged into one is on the network the counter computers use, a place from which to go after them. It still meets a clerk's sign-in at each computer, but it got that far from a seat in the lobby. So the second finding is rated moderate.

The cones that mark the driving course are stacked against an outside wall between road tests. Nothing locks or chains them, so anyone passing can carry some off, and that's the vulnerability.

The cones are of low value. They cost little and are easy to replace. The vulnerability is also unlikely to be exploited, which is a separate question about the adversary. The risk assessment lesson named the value of a target as one factor in likelihood: adversaries go after what they see as worth taking. A cone leads into nothing, so there's little reason for an adversary to take one.

The third finding is rated low. It still goes in the visit report, with its tier and the reason for it.

The card printer and the ticket-printer cabinet are both within reach of the public. The printer is sensitive and the cabinet isn't, so one rates high and the other moderate.

The cabinet and the cones are both of low value, and anyone can reach either one. Yet the cabinet's finding rates a tier higher. Taking a cone gains an adversary nothing beyond the cone. Opening the cabinet gains a place on the counter computers' network.