Physical security and removable media

Information security is not only digital. Some of the oldest attacks are physical, and they still work because they exploit politeness and routine rather than technology.

Badges and doors

Access badges exist to make sure only authorised people are inside secure areas. Wear yours where required, do not lend it to anyone, and report a lost badge immediately so it can be deactivated. A lost badge that goes unreported is a working key to the building in unknown hands.

Tailgating

Tailgating is following someone through a secured door without badging in. It feels rude to challenge, which is exactly why it works. The person smiling behind you with full hands may be a colleague, or may be relying on your courtesy to get inside. The expectation is simple: everyone badges through, every time. If someone follows you in without doing so, it is reasonable and expected to ask them to badge, or to direct them to reception. You are not being hostile, you are doing your part of a control that only works if everyone does it.

Visitors

Visitors should be signed in, badged as visitors, and escorted where the policy requires it. If you see someone in a secure area with no badge and no escort, do not ignore it. Politely ask if you can help them, or report it to reception or security. Most of the time it is innocent. The one time it is not, that question matters.

Removable media

USB sticks, external drives, and memory cards are small, easily lost, easily stolen, and a classic way of delivering malware. Typical policy rules, which your organisation's version of this control will reflect:

• Only use organisation-approved and, where required, encrypted media
• Never plug in a USB stick you found or were handed unexpectedly, however intriguing. Hand it to IT
• Do not use removable media to take sensitive data home or move it between organisations without approval
• Return media for secure disposal when no longer needed

The found-USB trick is a genuine attack technique, not folklore. Treat unknown media the way you would treat an unknown pill: the mystery is not worth it.