ISLAMABAD – A cyberattack does not always begin with a suspicious email or a compromised password. Sometimes the first step can be as simple as an unauthorized person walking through a secure door.
Pakistan’s National Cyber Emergency Response Team and the National Telecommunication Corporation are highlighting this often overlooked threat during Cybersecurity Awareness Month 2026.
The organizations are urging personnel to strengthen physical security in cybersecurity and remain alert to everyday workplace risks that could expose sensitive information and critical systems.
The guidance focuses on basic precautions such as protecting identification badges preventing unauthorized entry locking computer screens maintaining clean desks and avoiding unknown USB devices.
Why Physical Security Matters in Cybersecurity
Cybersecurity is often associated with hackers malware phishing and stolen passwords. However digital systems also depend on physical infrastructure. Computers servers networking equipment and other technology are located inside offices data centres and other facilities.
As a result physical access can become another route towards sensitive information. An intruder who enters a restricted area may gain access to an unattended computer or confidential documents.
Similarly an unknown device connected to a workplace system could introduce a security risk. For this reason physical security in cybersecurity has become an important part of protecting information systems. Pakistan’s revised Pakistan Information Security Framework 2026 also includes physical security among its core control areas.
Shared Badges Can Create an Access Problem
National CERT and NTC are advising personnel to keep identification badges visible and secure. Employees should not share their badges with colleagues or other individuals. They should also avoid leaving credentials unattended.
A badge is more than an identification card when it is used to control access to restricted facilities. If another person gains access to it the organization may lose an important layer of accountability.
Therefore each employee should use only their own authorized credentials.
What Is Tailgating
Another risk highlighted by the campaign is tailgating. This occurs when an unauthorized person follows an authorized employee through a secured entrance without using their own credentials. The situation can appear harmless.
Someone may simply hold a door open for another person or assume that the individual belongs inside the building. Yet that small action can undermine an access control system. Employees should therefore avoid allowing unknown individuals to follow them into restricted areas.
Visitors should also follow the organization’s established verification procedures.
An Unlocked Screen Can Expose Sensitive Information
Physical security does not stop at the building entrance. An unattended computer can also become a security weakness. Employees should lock their screens whenever they leave their workstations.
This simple habit can prevent unauthorized people from viewing information through an active account. The risk becomes greater in workplaces where employees handle confidential records customer information internal communications or sensitive government data.
Consequently screen locking should become an automatic workplace habit.
Clean Desks Can Help Protect Information
The campaign also highlights the importance of keeping sensitive material away from public view. Documents notes passwords and other confidential information should not be left unattended on desks.
A clean desk policy can reduce the chance of sensitive information being viewed copied photographed or removed by someone without permission. Moreover it can limit the amount of information available to an intruder who manages to enter a restricted area.
This is another reason physical security in cybersecurity depends heavily on everyday employee behaviour
Unknown USB Devices Can Become a Security Risk
National CERT and NTC have also warned against connecting unknown USB devices and other unfamiliar equipment to workplace systems. An unidentified device may create a security risk when connected to a computer. Employees should therefore avoid using unknown USB drives or other removable media on organizational systems.
Instead suspicious devices should be handed over to the relevant IT or security team. The same principle applies to other unfamiliar hardware. When employees are unsure about a device they should verify it before connecting it to a workplace computer.
Every Door Can Become a Security Checkpoint
The broader message is that cybersecurity does not exist only inside software. A secure network can still be exposed if an unauthorized person gains physical access to the equipment supporting it. That is why organizations need multiple layers of protection like:
- Access badges can control entry
- Security personnel can verify visitors
- Cameras can support monitoring
- Locked workstations can protect active accounts
- Clean desk policies can protect information
- Device controls can reduce the risk from removable media
Together these measures strengthen physical security in cybersecurity
Pakistan Is Strengthening Its Cybersecurity Framework
The focus on physical security comes as Pakistan continues to strengthen its national approach to information security.
The Pakistan Information Security Framework 2026 includes dedicated controls for physical security along with governance asset and risk management security training identity and access management data protection incident response and critical information infrastructure protection.
National CERT has also launched its Cybersecurity Handbook 2026 to 2027 for public sector organizations.
The handbook provides practical guidance covering areas such as data and asset protection access and network security vulnerability management incident response business continuity and security awareness.
National CERT also conducted specialized cybersecurity training for NTC officers earlier this year as part of efforts to strengthen cyber resilience.
These initiatives show a wider shift towards treating cybersecurity as an organization wide responsibility.
Human Behaviour Remains Important
Technology can provide strong protection but employees still play a critical role. A sophisticated security system can be weakened by a simple human mistake such as:
- Someone may hold a secure door open for a stranger
- Another employee may leave a computer unlocked
- Someone else may connect an unknown USB drive without checking its origin
Each action can create unnecessary exposure, therefore cybersecurity awareness needs to extend beyond technical teams.
Every employee who handles organizational systems has a role in protecting them.
What Employees Should Do
Organizations can reduce physical security risks through a few basic habits
- Keep identification badges secure
- Never share access credentials
- Do not allow unknown people to enter restricted areas
- Challenge or report suspicious visitors according to workplace procedures
- Lock computer screens when leaving a workstation
- Keep confidential documents out of public view
- Avoid connecting unknown USB devices
- Report suspicious activity to the relevant security team
- Follow visitor and access control procedures
- Secure sensitive equipment when it is not being used
These steps are simple but they can provide an important additional layer of protection
Cybersecurity Does Not Stop at the Screen
The biggest lesson from the National CERT and NTC campaign is straightforward. Protecting digital infrastructure requires attention to the physical world as well.
A locked door matters
A secure identification badge matters
An unattended computer matters
A document left on a desk matters
Even an unknown USB device can matter
For organizations protecting sensitive systems the smallest workplace habits can become part of a much larger security strategy.
Physical security in cybersecurity is therefore not an optional extra
It is part of the first line of defence. As Pakistan expands its digital infrastructure and moves more public and private services online the importance of protecting both physical facilities and digital systems will only grow. The safest approach is simple,
Stay aware
Stay secure
Think before granting access
And never assume that a small security lapse cannot become a much bigger problem
Key Points:
- National CERT and NTC are promoting stronger physical security in cybersecurity
- Employees are being urged to protect identification badges
- Tailgating can allow unauthorized individuals into restricted areas
- Workers should lock computer screens when leaving their desks
- Sensitive documents and passwords should not be left exposed
- Unknown USB devices should not be connected to workplace systems
- Pakistan’s Information Security Framework 2026 includes dedicated physical security controls
- National CERT’s Cybersecurity Handbook 2026 to 2027 provides practical guidance for public sector organizations
- Strong cybersecurity requires both technical safeguards and responsible employee behaviour
Read More:
For more such exclusive articles, follow Upfront .
