This article was originally published on not your CISO on Medium. Read the full post →
Things are back to normal, and everyone is returning to their offices. Some are ecstatic about free food, coffee, and office gossip. Others are dragging their feet. And most security teams are somewhere in between — quietly aware that two years of remote-first work has created some habits that don’t translate well to shared physical spaces.
The physical security controls that existed before March 2020 need to be re-evaluated. Tailgating. Shoulder surfing. Clear desk policy. Secure disposal. These aren’t new problems — but they are problems that got deprioritised when everyone was working from home, and they’re back.
Three principles to keep in mind: least privilege, need-to-know, and separation of duties. They apply to physical access just as much as they do to system permissions.