Physical and Environmental Attacks: Power, Cooling, RF, and Tampering

Most security discussion assumes the attacker arrives over the network. Physical and environmental attacks do not. They target the conditions a system needs in order to run — electricity, temperature, radio spectrum, physical integrity — and they almost always aim at the availability leg of the CIA triad rather than at confidentiality.

Power attacks

Cutting power stops everything, and the ways to do it range from pulling a breaker to cutting a feeder outside the building. More subtle versions do damage rather than causing an outage: deliberately induced surges, brownouts that stress power supplies, or repeated cycling that shortens hardware life and corrupts filesystems.

The defenses are layered and familiar. Uninterruptible power supplies carry the load through short interruptions and, more importantly, provide the window in which generators start. Generators handle extended outages, with a fuel contract that has actually been tested. Redundant utility feeds from separate substations protect against a single upstream failure.

Inside the rack, dual power feeds from independent circuits protect against a single distribution failure, and remote monitoring makes anomalies visible before they become outages — the operational case for managed PDUs. Remember the rule that each feed must carry the full load alone, or redundancy exists only on paper.

Environmental attacks

Heat is the practical one. Equipment in a sealed room without cooling reaches thermal shutdown in minutes to tens of minutes, and an attacker who disables the cooling plant does not need to touch a single server. Blocking airflow, propping open a door that breaks hot and cold aisle containment, or simply raising a thermostat can be enough.

Humidity matters in both directions: too low and static discharge damages components, too high and condensation and corrosion do. Water is the other classic — a sprinkler discharge or a plumbing failure above a server room ends the conversation.

Controls here are environmental monitoring with alerting on temperature and humidity thresholds, redundant cooling, leak detection under raised floors, and fire suppression appropriate to electronics rather than water where the budget allows. Monitoring is the cheap part and the part most often missing; the first sign of a cooling failure should be an alert, not a shutdown.

RF and signal attacks

Jamming floods a frequency with noise so legitimate transmissions cannot be received. Wireless networks, cordless alarm sensors, cellular backup links, and radio-controlled door systems are all susceptible, and the equipment to do it is cheap.

Deauthentication attacks achieve a similar effect against older Wi-Fi by forging management frames that disconnect clients, which is also the setup for forcing a client onto a rogue access point. Protected management frames, required in WPA3, close that specific hole.

GPS jamming and spoofing affect systems that depend on satellite timing, which includes more infrastructure than people expect — time synchronization for logging and authentication among it. Detection relies on monitoring for the interference pattern: an unexplained collapse in signal quality across a site is the signature, which is why baseline RSSI readings are worth having before you need them.

The durable defense against jamming is not to fight it but to avoid depending on a single medium. Wired paths for anything critical, and alarm systems that treat loss of signal as an alarm condition rather than as silence.

Tampering and physical access

Hardware tampering covers installing a keylogger, adding a rogue wireless device to an internal network, cloning a badge, or simply removing a drive. Physical access also defeats operating system access controls entirely, since a machine booted from external media applies no one else's permissions — the mechanism described under offline boot environments, and the reason full disk encryption is the control that matters for data at rest.

Layer the defenses. Perimeter and entry controls including access control vestibules to stop tailgating, locked racks and chassis, port blockers and disabled unused switch ports, tamper-evident seals so interference is at least detectable, and camera coverage with retention that outlasts the time it takes to notice.

Risk framing

These attacks are overwhelmingly availability attacks, and they are also indistinguishable at first from accidents. A cooling failure looks the same whether it was sabotage or a failed compressor, which is why the response is the same — redundancy, monitoring, and a tested recovery plan — and why the investigation happens afterward.

That overlap with natural and accidental failure is why business continuity and disaster recovery planning covers deliberate physical attack as a matter of course rather than as a separate exercise.

Exam angles

Recognize power, cooling, humidity, water, jamming, and tampering as physical and environmental threats primarily affecting availability. Know UPS for short gaps and generators for extended outages, redundant feeds and cooling for single-point failures, and environmental monitoring as the detective control. Identify jamming as a denial-of-service attack on the wireless layer, and physical access as the condition under which encryption rather than access control protects data.