An edge site is, by definition, a place where nobody works. That is the point — and the problem. The cabinet sits behind a strip mall, on a rooftop, in a rural lot next to a grain elevator, quietly doing work that a dozen other systems depend on. Nobody thinks about it until a door is pried open or a sensor stops reporting. Physical security at these sites is not about stopping a determined crew with a truck and a grinder. It is about making casual intrusion loud, slow, and traceable, so that the cheap attack costs more than it returns.

Start With a Threat Model, Not a Shopping List

Before you buy a single sensor, answer three questions per site. Who has a legitimate reason to be here — a contractor, a delivery driver, a tenant with roof access? What is worth taking — copper ground bars, SFP modules, a UPS, an entire rack? And what happens if the site goes dark for a weekend?

Most real incidents are opportunistic: a door left unlatched, a cabinet standing open, someone chasing scrap metal. Rate each site low, medium, or high on that basis and let the rating drive the spend. A rural hut carrying one radio link is not the same asset as a cabinet feeding a clinic's imaging system. Write the rating down. If you cannot say what you are defending against, every vendor quote will look reasonable.

Access Control: Make Every Entry Intentional

The goal is not to keep everyone out. It is to ensure that when the door opens, something records who opened it and why.

• One credential per person. Shared PINs and shared keys destroy accountability. If three people know the same code, you have no idea who visited at 2 a.m.
• Two factors where it matters. A card or fob plus a mechanical key is a reasonable default for medium-risk sites. Use a managed lockbox for the key, with a sign-out log.
• Cover every opening, not just the front door. Roof hatches, cable entry ports, and removable panels are entries too.
• Deprovision the same day. When a technician leaves the company or the contract ends, their credential should stop working before their badge hits the desk drawer.
• Remove the invitation. No site branding, no "telecom" signage on the fence, no glass door that lets a passerby see a rack and a UPS.

The 12 Controls

1. Credentialed entry. A unique badge, fob, or PIN per person, with a logged record of every open.
2. Mechanical lock with a controlled key, stored in a tracked lockbox rather than on someone's truck keyring.
3. Door and hatch contacts wired to an alarm panel — not just a local buzzer nobody hears.
4. Vibration or tilt sensors on the enclosure and cabinet doors to catch drilling, prying, and panel removal.
5. Interior camera with local storage (NVR or SD card), plus event-based upload so footage exists even if the link dies.
6. Motion-activated lighting at the entry and along the approach path. Light is cheap and it changes behaviour.
7. Tamper-evident seals on spare ports, patch panels, and cable trays, so you can tell whether a cover was lifted.
8. Environmental sensors for temperature, humidity, water ingress, and smoke. Physical security includes keeping the equipment alive.
9. Independent power and network reporting, so an alarm can leave the site when the primary circuit cannot.
10. Asset tagging on optics, power supplies, and removable modules, with serials recorded in your inventory.
11. A clean perimeter: intact fence, bollards where vehicles can reach the cabinet, trimmed vegetation, no stacked pallets or ladders left nearby.
12. A documented escalation path and a phone number that a responder will actually answer at 3 a.m.

Monitoring and Tamper Detection

An alert that cannot leave the site is a light on a wall. Run the alarm panel on cellular or a second path, and test the failover quarterly — an untested backup is an assumption, not a control. Make sure the panel distinguishes between "door opened with a valid credential" and "door opened," and that a forced entry or a door held open past a few minutes escalates to a human rather than an inbox.

Camera placement matters more than camera count. Aim at the door and the approach, not at an interior wall. If there is a driveway, a plate-height view is worth the extra effort. Event-based upload keeps metered links affordable; continuous streaming over a cellular connection gets expensive fast and is rarely reviewed.

Watch for the alert that everyone learns to ignore — the door-left-ajar notification that gets muted after the third false alarm. That is exactly how a site ends up standing open from Friday afternoon to Monday morning. Fix the sensor alignment, or change the escalation, but do not let a real signal become background noise.

Maintenance Is Part of Security

A camera with a smeared lens, a flat battery in a door sensor, a keypad with one worn key — these are the details an intruder notices. Fold physical security into the same routine as HVAC filters and battery tests. On a quarterly visit: test each credential, confirm every sensor reports to the panel, replace seals you have broken, clear the brush back from the fence, and reconcile the lockbox inventory against the access list. If a technician opens the site and does not close a work order against it, find out why.

What to Do in the First 48 Hours

Pick your three highest-risk sites this week. Install the cheap wins first — door contacts, motion lighting, tamper seals, and a lockbox — and confirm that at least one alert route reaches a person who knows what to do with it. Then document it. If you operate in a regulated environment, or handle data covered by a contractual or regulatory standard, check with your compliance or security counsel about the specific physical safeguards you are required to maintain; general practice and a written obligation are not the same thing.

And if an intrusion does happen, preserve before you repair. Photograph everything, pull the access controller logs before they roll over, and check the seals on panels you did not expect anyone to touch. The response after an incident usually tells you more about your site's weaknesses than any risk assessment will.

Photo: Brett Sayles / Pexels