How it works
Cameras, door logs, checkout sheets, tamper-evident seals, and inventory records help investigate what happened after an incident.
Detection controls are strongest when they are reviewed and correlated with user schedules or device records.
Common error
A camera is not a mitigation for every risk. It detects or deters, but it may not prevent access by itself.
Worked example
Correlate records after a tablet is reported missing.
Evidence
14:02 door event: staff badge accepted
14:05 tablet checkout: no entry
14:30 inventory: one tablet absentThe badge event is a lead, not proof that its owner removed the tablet. Preserve door logs, checkout records, and relevant video, check whether an authorized move occurred, and document who handled each record. Correlate timestamps and account for clock differences.
Exercises
2.3.1
What can a door log prove more directly: that a badge was accepted, or that the named person personally entered?
Show solution
It directly records acceptance of a credential. Identity of the actual person may require corroboration because badges can be shared, lost, or misused.
2.3.2
Why are synchronized timestamps useful when comparing door, device, and camera records?
Show solution
They help establish event order and correlate activity. If clocks differ, document and account for the offsets rather than creating a false timeline.