Physical security of IT centres and biometric authentication
In short: Technical controls fail if an attacker can walk in and take a server. Physical security layers protection from the site perimeter to the rack. Biometrics identify people by what they are, and work best combined with a card or PIN.
Why physical security matters
Anyone with physical access can steal disks, plug in a rogue device, reset a router’s password or simply switch equipment off. Physical security is the first layer of defence in depth, and it also protects against fire, flood and power failure.
Protecting an IT centre
- Perimeter: fences, gates, lighting, no signs advertising the server room.
- Entry: ID badges, PIN or biometric locks, visitor logs and escorts, mantraps (two doors that cannot open at once) to stop tailgating.
- Surveillance: CCTV, security guards, intruder alarms and door-open alerts.
- Inside: locked racks and cabinets, disabled unused network ports, console ports secured.
- Environment: air conditioning, temperature and water sensors, gas-based fire suppression, raised floors, UPS and generators.
Authentication factors
Biometric methods
| Method | What it measures | Notes |
|---|---|---|
| Fingerprint | Ridge patterns on a finger | Cheap, common on phones and laptops |
| Face recognition | Facial geometry, often in 3D or infrared | Contactless; affected by lighting and angle |
| Iris or retina scan | Patterns in the iris, or blood vessels at the back of the eye | Very accurate; retina scans are intrusive |
| Hand geometry | Shape and size of hand and fingers | Robust for door access; less unique |
| Voice | Characteristics of a person’s voice | Useful by phone; affected by illness and noise |
| Signature dynamics | Speed, pressure and rhythm of signing | Measures how, not only what, is written |
| Keystroke dynamics | Typing rhythm and timing | Can run continuously in the background |
Accuracy and privacy
- False acceptance rate (FAR): how often an impostor is let in. This is the security risk.
- False rejection rate (FRR): how often a genuine user is refused. This is the usability cost.
- Tightening the system lowers FAR but raises FRR; the point where they are equal is the crossover error rate, and lower is better.
- A biometric cannot be changed like a password if stolen, and biometric data is special-category personal data under UK GDPR, so it must be stored and handled very carefully.
Preventing theft
- Asset tags and an up-to-date inventory; check equipment in and out.
- Cable locks for laptops and desktops in shared areas; locked cupboards for spare devices.
- Full-disk encryption so a stolen device does not mean stolen data.
- Remote locate and wipe for phones and laptops.
- A clear-desk policy and screen locks; secure disposal of old drives.
Real-world example: the propped-open server room
At a further education college, the server room door was regularly propped open because the room overheated in summer. One afternoon a laptop used for network administration disappeared from the desk inside. The laptop's disk was encrypted with BitLocker, so the data was safe, but the incident showed how weak the physical controls were.
The college fixed the cause first by installing proper cooling, so there was no reason to open the door. It then added a badge reader with an access log, a camera covering the doorway, locked racks and a door alarm that sounds if the door stays open for more than a minute. Visitors and contractors now sign in and are escorted. The root problem was a comfort issue that had turned into a security gap.
Practice
Which factor is a hardware token?
What problem does a mantrap solve?
A fingerprint reader often rejects genuine staff. Which rate is too high?
Key takeaways
- Physical access can defeat every technical control.
- Layer physical security: perimeter, entry, surveillance, racks and environment.
- Authentication factors: know, have, are.
- Biometrics include fingerprint, face, iris, hand, voice, signature and typing.
- Balance FAR and FRR; encrypt devices to make theft less damaging.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.