Lock down your 'piss corridor'

I got to visit a big, expensive datacenter once; Pinkerton guards who were actually on the ball and caught me taking pictures, RFID access cards and logged door openings and all the trimmings. That was the front door.

Then we went round the back door, which was opened directly from the DC floor. Propped open with a rock. One of the site admins was donating a bunch of hardware: we hauled like 3 carts out that door over the course of a couple hours and filled up my pickup truck. Security never noticed; we'd anticipated some fuss but it never materialized. If I'd had a bigger truck and more hands we coulda had our pick of anything in the building.

This illustrates the janitor principle. The person with the most physical access is not the security guard, but the janitor.

If you don't consider the janitor in your physical access planning, you are leaving lots of vulnerabilities.

"i pee" access