CND (312-38) Network Defense Simulation

Network defense extends beyond logical boundaries into the physical realm. This simulation teaches you how to align physical security controls with network defense-in-depth strategies to protect critical infrastructure from unauthorized physical access.

1 Network Scenario

You are reviewing the security posture of an organization's primary datacenter. The logical controls—including next-generation firewalls (NGFW), IDSs, and strict VLAN segmentation—are robust. However, during a recent internal Red Team assessment, an unauthorized individual bypassed the physical perimeter by simply walking closely behind an authorized network engineer. The CISO has demanded an immediate physical security upgrade to protect the core network equipment.

Logical Defense

Network Access Control (NAC) via 802.1X

MFA required for all administrative panels

Physical Defense

RFID Badge Readers at all doors

CCTV covering primary entrance

2 Traffic & Logs

Sample syslog from the Physical Access Control System (PACS) server:

14:22 [DOOR_01_EXT] AUTH_SUCCESS: RFID Badge Read - User ID: JSmith
14:23 [DOOR_01_EXT] STATE_CHANGE: Door Unlocked & Opened
14:25 [CAM_04_ENTRANCE] SENSOR_TRIGGER: Motion Detected - 2 individuals passed
14:32 [DOOR_01_EXT] STATE_CHANGE: Door Closed & Locked
14:35 ALERT [PACS-RULE-12] Possible Piggybacking Attempt - Multiple bodies detected on single authentication event
                

Note: The alert highlights a disconnect between the logical authentication (one badge read) and the physical reality (two people entering).

3 Question

Justine has been tasked by her supervisor to ensure that the company's physical security is on the same level as their logical security measures. She installs video cameras at all entrances and exits and installs badge access points for all doors. The last item she wants to install is a method to prevent unauthorized people piggybacking employees. What should she install to prevent piggybacking?

A. Justine needs to install a biometrics station at each entrance.

B. She should install a mantrap.

C. She should install a Thompson Trapdoor.

D. Justine will need to install a revolving security door.

4 Expert Analysis

1. What is happening in the network

The Physical Access Control System (PACS) logs reveal a successful tailgating or piggybacking event. An authorized user swiped their badge, opening the door, and an unauthorized second individual followed them inside before the door could close. Logical security (firewalls, NAC) is irrelevant if an attacker can physically access a console in the datacenter.

2. Identify attack or behavior

This is a physical social engineering attack. Attackers exploit human courtesy (holding the door open) or simple distraction to bypass multi-million dollar logical defenses. Physical intrusion can lead to rogue device placement (like a Raspberry Pi or keylogger) directly on the internal network.

3. Why the correct answer is correct

A mantrap is specifically designed to stop piggybacking. It consists of a small space with two interlocking doors. The first door must close and lock behind the user before the second door will open. Often paired with weight sensors or infrared beams, it ensures only one verified person passes through at a time.

Why others are wrong

Biometrics: Proves identity, but doesn't physically stop someone from walking in behind the authenticated user.
Thompson Trapdoor: This is a fictional term used as a distractor in the exam.
Revolving security door: While high-end security revolving doors exist (acting as mantraps), standard revolving doors do not enforce single-occupancy and are incorrect in standard CND terminology.

Defensive Action

Enforce strict physical perimeter controls. Integrate the PACS with network monitoring so that physical breaches trigger a lockdown of nearby logical assets. Install mantraps or full-height security turnstiles at critical facility boundaries.

MINI LESSON: Defense in Depth (Layer 1)

The Physical Layer: Security begins at the physical layer. If physical access is compromised, logical controls (like encryption at rest or strong passwords) can often be bypassed via hardware manipulation or local console access.
Piggybacking vs. Tailgating: Tailgating is following someone in without their knowledge. Piggybacking usually implies consent (someone holding the door). Mantraps defeat both.
Detection vs Prevention: Cameras (CCTV) are a detective control. A mantrap is a preventative control. You need both for robust defense.

Explore more CND simulations

Proceed to Practice Tests