Server-room lock was nothing but a crock

A reader story about a company pursuing ISO 27001 certification that installed a two-factor keypad lock on their server room, only to discover during a pre-audit drill that entering more than 10-11 digits without swiping a card caused the lock to open. The team concealed the flaw from the auditor by only demonstrating the normal four-digit flow, and the vendor never fixed the bug. The tale illustrates how physical security weaknesses can undermine all cybersecurity efforts.