Life Safety First: Mantraps, Anti-Passback, Duress Codes, and the Physical Security Layer CISSP Won't Let You Skip

Mantraps, anti-passback, and the tailgating problem

A badge reader authenticates a badge. It does nothing about the person who walks in behind the badge holder, which is why tailgating (following an authorized person through a door) is the physical attack the exam names most. Two controls exist specifically to defeat it.

A mantrap is a vestibule with two doors where the second will not open until the first has closed. One person authenticates, one person enters, and the space is too small for a second. It is the answer for a data center entrance or any boundary where "one badge, one person" has to be guaranteed.

Anti-passback is the logical version: the badge system refuses to admit a badge that is already recorded as inside, and refuses to let a badge exit that never entered. It stops a cardholder passing their badge back through the fence to a friend, and it flags the tailgater who has no entry record when they try to badge out. The exam pairs the two: a mantrap physically enforces one-person entry, anti-passback logically enforces one-badge consistency.

Visitor management completes the set: identity verified at reception, a visibly different badge, an escort in controlled zones, a log of entry and exit, and the badge collected on the way out. A scenario about a contractor found alone in a server room three days after their project ended is a visitor management failure, and it is the physical twin of an orphaned account.

Life safety comes first

Objective 7.15 exists to make one principle unmissable: human life takes precedence over every other security objective. A door that fails locked in a fire is a lethal control. An exit that requires a badge to leave is a lethal control. A mantrap that cannot be opened from inside during an evacuation is a lethal control.

The exam applies the principle through the fail-safe versus fail-secure distinction. A fail-safe door unlocks when power is lost, so people can get out. A fail-secure door locks when power is lost, so intruders cannot get in. A perimeter door people must be able to escape through fails safe, always. A door into a vault nobody is inside can fail secure. When a question offers a control that improves security at the cost of trapping people, the answer is the other one, and if the stem describes a building with emergency exits that lock on alarm, it is describing a code violation, not a security posture.

The same objective covers emergency management: evacuation plans, assembly points, accounting for everyone, and the training that makes staff act correctly without being told. Security's role during an emergency is to help people leave, then to secure what was left behind, in that order.

Duress, travel, and the human attack surface

The rest of 7.15 is about people in situations security cannot physically control.

• Duress codes let a person signal that they are acting under threat. A guard station has a word that means "send help" while sounding routine; an alarm system accepts a second code that disarms it and silently alerts. The exam's scenario is an employee forced to open a door or disable an alarm, and the answer is a duress mechanism that looks like compliance.
• Travel risk covers staff carrying devices and knowledge into places where both may be taken. Clean loaner devices with only what the trip needs, no expectation of privacy at borders or in hotel rooms, VPN for everything, and a briefing that assumes the room is monitored. A scenario about an executive's laptop being inspected at a border wants a clean device, not stronger encryption on the usual one.
• Insider threat is the reason personnel controls exist at all: screening at hire, separation of duties, least privilege, monitoring for the behavioral indicators, and a termination process that removes access before the conversation happens, not after.
• Social media exposure is reconnaissance the organization publishes about itself: badge photos, office layouts, travel schedules, the names of the people who approve payments. The control is awareness and a policy about what gets posted, and the exam frames it as a supply of raw material to social engineers.
• MFA fatigue, or push bombing, sits here because it is a human control failure: an attacker with a stolen password triggers prompts until the user approves one to make them stop. Number matching, limits on prompts, and training that says "a prompt you did not cause is an attack" are the counters.

Four stems, decoded

1. A data center wants to guarantee that only one person enters per authentication. A mantrap. Anti-passback complements it but cannot by itself stop two people walking through one open door.
2. During a power failure, the building's badge-controlled exits stayed locked and staff were unable to leave. Fail-secure applied to an egress door. Egress must fail safe; the design is a life-safety violation.
3. A night guard is forced by an intruder to disarm the alarm system. The guard enters the duress code: the system disarms and silently alerts. If no duress code exists, the missing control is the answer.
4. An analyst notices that an employee's social media shows their badge, the office floor plan and next week's travel. Reconnaissance material for social engineering and physical intrusion. Awareness training and a posting policy, not a technical control.

Physical security and personnel safety are objectives 7.14 and 7.15 of CISSP Domain 7, Security Operations, 13% of the exam and the widest domain on the test. They are the physical counterpart to the logical access controls that the same domain assumes, and they set the constraints a facility's recovery plan has to respect. Work all 59 topics across fifteen objectives with our CISSP Domain 7 study guide.

#CISSP #ISC2 #PhysicalSecurity #PersonnelSafety #SecurityOperations #AccessControl #Mantrap #LifeSafety #InfoSec #CyberSecurity