When security measures are split into technical, human and physical ones, identify which count as physical measures (物理的対策).
Tell apart measures that control access to a room by their role: watching, locking, or authenticating and logging.
Explain how the two ways of stopping tailgating (共連れ), where someone follows an authenticated person in, differ: one stops it with records, the other with the design of the doors.
Distinguish workplace measures from disaster preparedness by whether they protect desks, screens, equipment or data.
A surveillance camerafilms and records entrances and important areas to keep watch on people's movements.
Simply knowing a camera is there makes people think twice, which gives it a deterrent effect. The footage also serves as an audit trail (証跡) for tracing what happened after an incident. Recordings are kept for a set retention period, and cameras are placed so that no blind spots remain.
Exam points
ExamRooms holding important information are watched by staff or cameras, covering not just who comes and goes but also the work done inside.
Mix-upA surveillance camera is a tool for watching and recording; actually keeping people out is the job of locks and authentication.
Lock management means keeping rooms and storage locked so that only authorized people holding the key can open them.
Beyond locking up, it records who borrowed a key and when, when it came back, and how many spare keys exist. Measures like this that protect places and things are called physical measures (物理的対策). They are distinct from human measures (人的対策), which work on people through contracts and training, and technical measures (技術的対策), which protect through authentication, encryption and the like.
AnalogyIt is like never handing your front-door key to anyone outside the family and knowing exactly who holds the spares.
How to remember"Lock" is the act of locking; "management" is tracking where the keys go. Only both halves together make up the measure.
Exam points
ExamIn the three-way split, locking an area and logging key loans are physical measures. A confidentiality agreement is a human measure, while digital signatures and firewalls are examples of technical measures.
ExamA typical incident caused by missing physical measures is an outsider getting into the equipment room and walking off with information. Virus infections and operating errors fall under other kinds of measures.
Entry/exit managementauthenticates anyone trying to enter a room, lets in only those permitted, and logs their comings and goings.
Verify identity
Check permission
Unlock and let in
Log entry and exit
Both admitted and refused attempts are logged, and exits are logged the same way.
4 / 4
Identity is checked with an IC card, a PIN, biometrics and so on, and the decision is logged together with who came in or out and when. It is often combined with zoning (ゾーニング), which divides the premises into areas by how sensitive their information is, so that each area admits a different set of people. On the other hand, tailgating (共連れ), where someone slips in behind an authenticated person without authenticating, is hard to stop with authentication at the door alone.
AnalogyIt resembles hotel key cards. Each card opens only certain rooms, and unlike an ordinary key, the system knows which card opened the door.
How to rememberThe Japanese name contains both 入 (enter) and 退 (leave). Only by logging exits as well can you tell who is in the room right now.
Exam points
ExamA system that logs only entries cannot tell how long anyone stayed or how many people are inside. It can still admit people by permission and log refused attempts.
ExamIn critical areas, the basics are being able to trace entries and exits person by person (individual IDs and logs) and never letting anyone work there unsupervised.
ExamDividing areas by sensitivity is called zoning, and managing entry and exit by giving IC cards each area's permissions is an example of a physical measure.
Anti-passbackrecords the status of each ID as "inside" or "outside" and refuses any entry or exit that does not match that status.
Recorded status
Trying to enter
Trying to leave
Outside
Allowed
Refused
Inside
Refused
Allowed
It relies on recording whether each ID is inside, so it is built into an entry/exit management system. If someone passes the card they just used to the person behind them, that ID is already recorded as inside, so the second person cannot get in. Anyone who entered without using a card is refused on the way out and gets caught.
AnalogyIt is like automatic ticket gates at a train station: a transit card with no entry record is stopped at the exit, and a card that is already inside cannot be used to enter again.
How to rememberPassback is the trick of handing a used card back to the next person, and the "anti" in the name forbids it.
Exam points
ExamAn ID with no entry record is refused at the exit, so someone who tailgated in cannot leave with their own card. It cannot stop someone entering with a borrowed card whose owner is recorded as outside.
ExamAnti-passback is a typical mechanism against tailgating. Callback (コールバック) and single sign-on (シングルサインオン) are mechanisms for communications or user authentication and have nothing to do with people entering rooms.
Mix-upIt is not the same as an IDS (intrusion detection system), which spots and reports suspicious network traffic; anti-passback deals with people going in and out.
An interlock uses two doors at an entrance with a small room between them (an anteroom, 前室) so that one door cannot open until the other has closed.
Enter by the outer door
Outer door closes
Count people (if equipped)
Inner door opens
The outer door reopens only after that person has gone through the inner door, so the next person must authenticate before entering.
4 / 4
Linking the doors alone cannot stop two people from entering the anteroom together, so it is combined with designs such as a one-person anteroom or a weight sensor that counts occupants. Some setups also require a second authentication at the inner door to double-check who is entering.
AnalogyIt works like a canal lock: the near gate closes before the far gate opens, so both are never open at once.
How to rememberInter (mutual) + lock. Picture the two doors locking each other.
Exam points
ExamOne way to physically stop tailgating at the entrance is a one-person cylindrical gate whose doors open only in turn (a circle gate, サークル型ゲート).
Anti-passback vs. Interlock
Aspect
Anti-passback
Interlock
Key differenceHow it stops people
The recorded in/out status of each ID
Two linked doors (combined with a one-person anteroom)
When it catches tailgating
After entry, when the person tries to leave with their own card
Right at the entrance, as they try to pass
What it cannot stop
Entry with a card borrowed from someone recorded as outside
Two people entering together an anteroom that cannot count heads
Clear desk is the practice of leaving no papers or storage media on the desk when you step away or go home.
Documents and USB drives not in use go into a locked drawer or cabinet. Papers left out on a desk can be read or taken by anyone walking past.
AnalogyIt is the same as not leaving your wallet or notebook on the table when you get up from a library seat.
How to rememberClear (nothing on it) + desk. The name simply describes the tidied desk.
Exam points
ExamNot leaving documents with information spread on the desk when you step away is an example of clear desk. Locking the screen when you leave is a separate practice (the next term).
ExamKeeping important documents and storage media in a locked cabinet except when in use is another workplace practice that prevents leaks.
Clear screen is the practice of locking the screen whenever you step away so that others cannot see what is displayed.
An unlocked device can not only be viewed but also operated by someone else with the owner's permissions. Setting the screen to lock automatically after a period of inactivity covers the times you forget.
AnalogyIt is like a cashier closing and locking the till before leaving the register. Left open, anyone passing by could look inside and help themselves.
How to rememberDesk is about paper, screen is about the display. Both say "clear", but they tidy different places.
Exam points
ExamLeaving a PC unlocked and ready to use throughout the working day opens the door to leaks.
A security cablefastens a laptop or other device to a desk with a wire and lock to keep it from being carried off.
It is also called a security wire (セキュリティワイヤ), and many laptops have a small slot for plugging it in. Tied to a desk or pillar, it keeps the whole device from being taken the moment you look away.
AnalogyIt is the same idea as chaining a bicycle to a post with a cable lock.
How to rememberA cable is a line that ties things together. What it holds in place is not information but the device itself.
Exam points
ExamIt prevents the device itself from being carried off, which is a different target from protecting on-screen information or preparing for power loss and disasters.
ExamFixing a device to a desk or storing it in a locked cabinet prevents theft, but login passwords and screen locks do not stop the theft itself.
Remote backup keeps a copy of the data at a place geographically distant from the main site.
A copy kept in the same building can be lost along with the original in a fire or earthquake. With a copy at a distant site, you can restore the data and resume operations after the disaster. Against ransomware (ランサムウェア), which encrypts files so they cannot be used, however, a copy synced over the network may be encrypted too no matter how far away it is, so disconnection matters more than distance.
AnalogyIf you keep precious photos not only at home but also with a relative who lives far away, you can get them back even if your house burns down.
How to remember"Remote" is about distance. Distance protects against disasters; disconnection protects against ransomware.
Exam points
ExamPreparing a standby system at a distant location so that service can continue after a disaster is an example of a physical measure.
ExamThe countermeasure that limits ransomware damage is backup, with copies kept where an infected PC cannot reach them over the network. Putting them far away is not enough.
Physical measures protect places and things from intrusion, theft and disasters; locking areas, entry/exit management, fastening equipment and keeping copies far away are examples.
Entry/exit management lets through only people cleared by authentication and logs their movements. Without logging exits as well, you cannot tell how long people stayed or how many are inside.
Tailgating is countered by anti-passback, which refuses exit based on the recorded status, and by an interlock, which uses two linked doors (combined with a one-person anteroom) to keep a second person out.
When stepping away, protect information with clear desk, which puts papers away, and clear screen, which locks the display. Theft of whole devices is handled by fastening them down or locking them away.
Remote backup keeps a copy somewhere that will not be hit by the same disaster as the main site, so the data can be recovered afterward.