An auditor finds a stolen city badge can be paired with passwords written on sticky notes at workstations. What lesson about combined physical and logical controls applies?
Select an answer to reveal the explanation.
Short Explanation
A badge in a thief’s pocket plus a password on a sticky note is a two-piece skeleton key. Physical and logical controls only work when both stay clean—guard the badge and stop writing secrets on monitors. Night locks alone, “messy handwriting,” or quieter SIEM alerts do not fix layered failure.
Full Explanation
Physical and logical access controls are complementary; attackers frequently combine a stolen credential factor from one layer with a weak or exposed factor from the other. Organizations must enforce badge handling, rapid revocation, password secrecy, and MFA so a single compromise does not unlock systems. Treating badges as a full substitute for authentication, accepting visible passwords, or downgrading detection of lost credentials undermines the combined control model. Effective IAM hygiene addresses both facility and system identity continuously.