Physical Security & Access Control

Glossary

Anti-passback

Access-control logic that tracks which zone each credential currently occupies and refuses to readmit a credential to a zone it is already recorded as inside. It flags cloned badges and prevents a credential from being passed back to admit a second person.

Chain of custody

A documented, unbroken record of every person who handled a piece of hardware from receipt through storage, staging, and installation, and again through decommissioning and disposal. It ensures equipment is never unattended or unaccountable while it is vulnerable to tampering.

Defense in depth

A design approach that assumes any single security layer can fail and stacks multiple independent layers so that a breach of one is contained by the next. In a data center the layers escalate inward, each demanding stronger identity proof and admitting fewer people.

Delay budget

The cumulative time a layered perimeter forces an intruder to spend, measured against the time it takes a response force to arrive. Detection must fire early enough that the remaining delay after the first reliable alarm exceeds the response time.

Least privilege

The rule that each person is granted access only to the boundaries, zones, and hours their role genuinely requires, and no more. It limits the damage any single compromised, misused, or coerced credential can do.

Mantrap (access-control vestibule)

An enclosed space between two interlocked doors where only one door opens at a time and each requires authentication. Often paired with occupancy sensing, it permits one authenticated person through at a time to defeat tailgating and piggybacking.

Multi-factor authentication

Verifying identity with two or more independent factor types: something you have such as a badge, something you know such as a PIN, and something you are such as a fingerprint. Combining different types ensures that stealing one factor is not enough to gain entry.

Security convergence

The unification of physical and cyber security into a single program with shared monitoring, correlated events, joint incident response, and one accountable owner. It closes the blind seam between the domains that attackers exploit by crossing from physical to digital and back.