Physical Security and Cryptography Basics: Controls, Keys and Worked Examples

A locked server room does not protect data copied over a network. Strong encryption does not stop someone stealing an unguarded server. Information security needs both layers: physical controls protect systems, and cryptography protects data and communications.

What physical security and cryptography protect

Start with one model. An asset has value, a threat may exploit a vulnerability, and a control reduces likelihood or impact. Our assets are server S1, backup drive B1, network switch N1, and credentials on S1.

Physical security limits access to S1, B1, and N1, and protects them from theft, fire, water, heat, and power loss. Cryptography protects data meaning and integrity when media or channels cannot be trusted, including application-layer traffic on untrusted networks.

Ask five questions:

• Confidentiality: Who can read it?

• Integrity: Was it altered?

• Availability: Can an authorised user reach it?

• Authentication: Who sent or accessed it?

• Non-repudiation: Can a valid signer credibly deny the signature?

No lock, cipher, or hash supplies every goal. A locked rack cannot prove who created a network message.

Physical security controls from perimeter to recovery

Classify controls by function. A warning sign is deterrent; a named badge plus biometric is preventive; a door sensor, access log, and CCTV are detective; clean-agent suppression is corrective; and an encrypted off-site backup is recovery.

Layer them by location: site perimeter, building entrance, server-room entrance, rack or device, environment, and recovery copy. CCTV is primarily detective, although visibility may also deter. It does not replace a door lock.

Access management combines least privilege with accountability: named badges instead of a shared PIN, escorted visitors, time-bounded access, two-person approval for exceptional entry, and reviewable logs. Add smoke and water sensors, fire suppression, temperature monitoring, cable protection, a short-bridge UPS, and a generator for longer interruption.

A backup beside the server shares its room-level disaster risk. Keep a geographically separate recovery copy.

Worked example: reduce risk in a four-asset server room

Use risk score = likelihood x impact with classroom inputs from 1 to 5. The values illustrate prioritisation; they are not measured business risks or an industry standard.

Now apply specific controls and recalculate:

1. Replace the shared code with a named badge plus biometric, retain an access log, add CCTV, and lock the rack. Likelihood becomes 1 and impact stays 5: 1 x 5 = 5.

2. Add a UPS as a 20-minute bridge, followed by generator hand-off: 1 x 4 = 4.

3. Add smoke and water sensors, suppression, and an encrypted off-site backup: 1 x 3 = 3.

Risk is reduced, not eliminated. The residual values apply only to this classroom model.

Cryptography basics: encryption, hashing and signatures

Plaintext plus an algorithm and key produces ciphertext; authorised decryption recovers plaintext. Symmetric encryption uses one shared secret. Asymmetric cryptography uses a related public and private key pair. Hashing produces a one-way, fixed-length digest. A digital signature is created with a private-key operation and checked with the corresponding public key.

Use the direction test. For confidential data to Bob, use Bob's public key; Bob decrypts with his private key. Verify Alice's signature with Alice's public key. Signing is not simply "encrypting with the private key".

Hashing makes changes visible. SHA-256 gives:

• PAY=2500 -> 7035d50b69485bfd511e2acbb81dea5c68fb747676afdb5c8b6fe792ad73a251

• PAY=2501 -> bd6896a7b8e216d846ad8bda26a8dba4e91d34a161495883d31340c9c1b3072a

One changed character produces a different digest. This indicates tampering, but a bare hash cannot identify the creator. Base64 is reversible encoding, not encryption or secrecy.

Worked example: toy RSA from key generation to recovery

Tiny primes and omitted padding make this trace insecure for deployment. Real RSA uses large keys and an approved padding scheme.

Choose primes p=11 and q=13.

1. Calculate n = pq = 11 x 13 = 143.

2. Calculate phi(n) = (p-1)(q-1) = 10 x 12 = 120.

3. Choose e=7 because gcd(7,120)=1.

4. Choose d=103 because 7 x 103 = 721 = 6 x 120 + 1.

Public key: (e,n)=(7,143). Private key: (d,n)=(103,143).

Encrypt numeric message m=9:

• 9^2 mod 143 = 81

• 9^4 mod 143 = 81^2 mod 143 = 126

• c = 9^7 mod 143 = (126 x 81 x 9) mod 143 = 48

Decrypt by repeated squaring:

• 48^2 mod 143 = 16

• 48^4 mod 143 = 16^2 mod 143 = 113

• 48^8 mod 143 = 113^2 mod 143 = 42

• 48^16 mod 143 = 42^2 mod 143 = 48

• 48^32 mod 143 = 48^2 mod 143 = 16

• 48^64 mod 143 = 16^2 mod 143 = 113

• 48^103 mod 143 = (113 x 16 x 113 x 16 x 48) mod 143 = 9

Since 103 = 64 + 32 + 4 + 2 + 1, the selected powers recover m=9, the original message.

How exams and interviews test these basics

Questions may ask you to classify controls, identify a violated security goal, distinguish encryption from hashing, encoding, or signatures, track key direction, calculate small modular arithmetic, or propose layered server-room controls.

Quick checks: CCTV is detective; badge plus biometric is preventive; off-site backup supports recovery; a changed digest warns about integrity, not attribution.

Treat this as core security material rather than a guaranteed named unit in any one syllabus, and confirm marks and question counts in your exam's official bulletin. For format awareness, read MCQ, MSQ or NAT? GATE Question Types Explained, then check the current rules on the official site. KnowledgeGate has over 30 questions on this topic in its practice bank when you are ready to practise.

Common traps, the short version and the next step

• "A cipher keeps the service available." It protects confidentiality, not power or uptime. Add availability controls.

• "A hash is reversible encryption." It is a one-way digest. Use encryption for authorised recovery.

• "Base64 hides the message." Anyone can decode it. It is encoding, not secrecy.

• "One public key handles both directions." Encrypt for Bob with Bob's public key; verify Alice with Alice's public key.

• "A camera replaces a lock." It records or alerts. Add preventive access control.

• "The nearby backup covers disaster." It shares the site risk. Keep a separate copy.

The short version: protect the place; identify the asset, threat, and vulnerability chain; layer preventive, detective, and recovery controls; choose primitives by security goal; test with a worked scenario. Redraw both diagrams, then reproduce 20, 12, 10 to 5, 4, 3 and 9 -> 48 -> 9 without looking.

For a structured preparation route, use GATE Guidance by Sanchit Sir alongside the wider GATE category. For interview-focused revision of network security and other core-CS subjects, use CS Fundamentals for Placements by Sanchit Sir. The guidance course supports wider GATE planning; the placements course focuses core-CS interview revision.