Physical Attack Indicators
Signs of physical security breaches including brute force entry (forcing locks, breaking barriers), RFID cloning (copying access cards), and environmental attacks (power, HVAC, fire suppression manipulation).
Understanding Physical Attack Indicators
Physical security breaches can bypass even the strongest digital controls. Attackers who gain physical access can steal equipment, install hardware implants, or access systems directly. Recognizing physical attack indicators helps detect breaches before significant damage occurs.
Key physical attack categories: • Brute force entry — Forcing physical barriers (locks, doors, fences) • RFID/Badge cloning — Copying access credentials • Environmental attacks — Manipulating power, cooling, fire systems • Social engineering entry — Tailgating, impersonation
Physical security is the foundation—all other security depends on it.
Why This Matters for the Exam
Physical attack indicators are tested on SY0-701 as they represent often-overlooked security concerns. Questions may describe scenarios where physical indicators reveal compromise.
Understanding physical security helps with defense planning—no amount of encryption protects a stolen hard drive. Physical access often means complete access.
The exam tests recognition of indicators and appropriate physical security controls.
Deep Dive
Brute Force Entry
Physical attacks that force entry through barriers.
Brute Force Methods:
| Method | Description | Indicators |
|---|---|---|
| Forced doors | Breaking, kicking, prying | Damage to frame, lock, hinges |
| Lock picking | Manipulating lock mechanism | Scratches around keyhole |
| Lock bumping | Using bump key | Marks on lock face |
| Cutting | Bolt cutters, saws | Cut fencing, chains, padlocks |
| Breaking | Smashing windows, walls | Glass shards, hole in barrier |
Brute Force Indicators:
- •Visible damage to entry points
- •Alarm system triggered or disabled
- •Door sensors reporting open when should be closed
- •Security camera footage of forced entry
- •Tool marks on locks or frames
- •Broken glass or barriers
Detection Controls:
- •Door/window sensors
- •Glass break detectors
- •Motion sensors
- •Video surveillance
- •Security patrols
- •Intrusion detection systems
RFID Cloning
Copying RFID access credentials to create duplicate access cards.
How RFID Cloning Works:
- 1.Attacker obtains RFID reader (easily purchased)
- 2.Gets close to victim's badge (pocket, purse)
- 3.Reader captures card data wirelessly
- 4.Data written to blank card
- 5.Clone used to access facilities
RFID Cloning Indicators:
- •Unknown card reads at odd hours
- •Same badge used at geographically impossible locations
- •Badge access without corresponding video of cardholder
- •Multiple "failed reads" before successful entry
- •Reports of being near suspicious individuals
RFID Vulnerabilities:
| Frequency | Range | Vulnerability |
|---|---|---|
| Low (125 kHz) | 10cm | Easily cloned, no encryption |
| High (13.56 MHz) | 5cm | Better security, still clonable |
| UHF (860-960 MHz) | 10m | Long-range reading possible |
RFID Protection:
- •Multi-factor authentication (PIN + card)
- •Shielded card holders (Faraday sleeves)
- •Short-range readers only
- •Encrypted credentials
- •Anomaly detection on access logs
- •Regular credential audits
Environmental Attacks
Attacks targeting infrastructure systems to disrupt or damage.
Power Attacks:
| Attack | Method | Impact |
|---|---|---|
| Power cut | Cutting power lines | System shutdown |
| Surge | Introducing power spike | Equipment damage |
| Brownout | Reducing voltage | System instability |
| EMI/EMP | Electromagnetic interference | Data corruption, failure |
Power Attack Indicators:
- •Unexpected power fluctuations
- •UPS alerts and activations
- •Cut or damaged power cables
- •Evidence of tampering at power sources
HVAC Attacks:
- •Disabling cooling to cause overheating
- •Introducing contaminants through HVAC
- •Manipulating temperature for equipment damage
- •Indicators: temperature alarms, unusual HVAC behavior
Fire Suppression Attacks:
- •Triggering fire suppression (water damage)
- •Disabling suppression before arson
- •Indicators: false fire alarms, suppression system tampering
Other Physical Attack Indicators
Tailgating/Piggybacking:
- •Following authorized person through secure door
- •Indicators: Multiple people entering on single badge read, video showing tailgating
Lock Tampering:
- •Marks around lock mechanism
- •Lock not functioning properly
- •Foreign material in keyway
Equipment Tampering:
- •Seals broken on equipment
- •Unknown devices connected
- •Cables rerouted or added
- •Unexpected hardware modifications
Surveillance Compromise:
- •Cameras repositioned or covered
- •Gaps in footage
- •Cameras disabled or vandalized
Document/Media Theft:
- •Missing equipment, devices, or documents
- •Empty secure containers
- •Disturbed document storage areas
How CompTIA Tests This
Example Analysis
Scenario: Security review reveals: Door 7 access log shows an employee badged in at 2:47 AM, but video shows no one entering. The same employee's badge was used at headquarters (50 miles away) at 2:52 AM. Badge access logs show three failed reads before the successful 2:47 AM entry.
Analysis - RFID Cloning Attack:
Indicators Present: • Access without corresponding video (clone user, not original) • Geographically impossible access (50 miles in 5 minutes) • Failed reads before success (testing cloned card) • Unusual access time (2:47 AM)
Attack Reconstruction: 1. Attacker cloned employee's RFID badge 2. Tested clone (three failed reads = calibration) 3. Gained entry at 2:47 AM with cloned badge 4. Real employee's badge used normally at 2:52 AM elsewhere 5. Geographic impossibility exposes the clone
Response: 1. Review video for suspicious persons before 2:47 AM 2. Disable compromised badge immediately 3. Issue new credential to employee 4. Audit all access with that badge 5. Check for stolen data or planted devices 6. Consider upgrading to multi-factor access
Key insight: Badge access without video correlation and impossible geography are classic RFID cloning indicators. Always correlate access logs with video.
Key Terms to Know
Common Mistakes to Avoid
Exam Tips
Memory Trick
"BRET" - Physical Attack Categories
- •Brute force entry (physical force)
- •RFID cloning (badge copying)
- •Environmental (power, HVAC, fire)
- •Tailgating (social engineering entry)
- •RFID Cloning Detection: "GVF"
- •Geographic impossibility (two places at once)
- •Video mismatch (badge in, no person on camera)
- •Failed reads before success (testing clone)
- •Environmental Attack Targets: "PHF"
- •Power (cut, surge, EMP)
- •HVAC (cooling, contamination)
- •Fire suppression (trigger or disable)
Brute Force Evidence: "If it's Broken, Bent, or Beaten" = Brute force indicator
Physical Security Layers: Fence → Door → Lock → Badge → PIN Multiple layers = Defense in depth
Test Your Knowledge
Q1.Security cameras show no one entering a secured area, but access logs indicate a valid badge was used at 3:00 AM. What attack does this most likely indicate?
Q2.A security guard notices scratches and tool marks around a door lock, though the lock still functions. What type of attack should be investigated?
Q3.What is the BEST control to prevent RFID badge cloning from enabling unauthorized access?
Want more practice with instant AI feedback?
Practice with AIContinue Learning
Ready to test your knowledge?
Practice questions on physical attack indicators and other Objective 2.4 concepts.