The Problem with Standard Storage Security
If you have a motorcycle, tools, gear, or inventory in a storage unit, your current security is a padlock and a gate code. The commercial security industry has nothing between that and a $2,000 installation plus $80/month monitoring contract. This stack is what goes in that gap — four independent layers, under $300 in hardware, sourced same-day from retail, deployed in under 24 hours.
This case study documents a complete physical asset security stack designed, sourced, and deployed in under 24 hours using same-day retail. That timeline applies to the base tier. The architecture runs on four independent layers with no single point of failure — each layer operates autonomously. Defeating one does not defeat the stack.
The advanced tier — Raspberry Pi 5, Debian 12, Frigate NVR, Wazuh SIEM, WireGuard backhaul — is a separate engagement with a longer build timeline. See the Advanced Tier section below.
Controls Matched to Actual Likelihood
Overspending on low-probability vectors wastes budget and creates false confidence. Controls are matched to threat likelihood — not worst-case theater.
| Threat Vector | Likelihood | Primary Mitigation |
|---|---|---|
| High-value vehicle theft | HIGH | GPS tracker on independent LTE + motion-alert camera |
| Opportunistic unit break-in | MEDIUM | Door-facing camera + cloud-stored motion event clips |
| Power interruption to facility | LOW | Dual chained UPS — 7-hour sustained runtime |
| Hotspot or WiFi failure | LOW | GPS operates on own LTE — fully independent |
| Camera tampering or destruction | LOW | GPS continues tracking independently of camera stack |
| Insurance claim with no evidence | MEDIUM | 24/7 cloud-backed video + continuous GPS location history |
| RF-based GPS defeat | VERY LOW | Requires active scanning equipment outside opportunistic profile — see Known Limitations |
Hardware List — Same-Day Retail
| Component | Model | Source | Cost | Role |
|---|---|---|---|---|
| GPS Tracker | LandAirSea 54 | Walmart delivery | $35 | Vehicle location on independent LTE |
| Cellular Hotspot | AT&T GoLink 5G | Walmart delivery | $59 | Dedicated WiFi for cameras — no facility network |
| Prepaid SIM | AT&T Prepaid SIM Kit | Walmart delivery | $5 | Hotspot data |
| Security Camera ×2 | Arlo Essential Pan/Tilt 1080p | Walmart delivery | $40 ea. | 360° auto-tracking, cloud storage, motion alerts |
| UPS Backup ×2 | APC Back-UPS 450VA BN450M | Walmart curbside | $56 ea. | Power resilience — chained for 7hr runtime |
Four Independent Layers — No Single Point of Failure
The key design principle: the GPS tracker operates on its own LTE SIM, completely independent of the WiFi hotspot and cameras. Destroying the cameras does not defeat tracking. Cutting facility power does not defeat cameras. Disabling the hotspot does not defeat GPS. There is no single action that defeats the full stack.
Raspberry Pi 5 · Debian 12 · Frigate · Wazuh
The base stack relies on cloud-hosted video storage — creating dependency on camera manufacturer infrastructure and subscription status. For higher-assurance deployments, a local NVR layer eliminates both dependencies and adds SIEM-style alerting and compound event correlation.
Hardware Platform
Raspberry Pi 5 (16GB RAM) running Debian 12 Bookworm arm64 — minimal server install, no desktop environment, no Raspberry Pi OS. Debian was chosen deliberately: clean apt ecosystem, full systemd service management, no Pi-specific cruft. Production-grade base for a headless security appliance. NVMe HAT for OS partition, USB 3.0 SSD for Frigate recording storage on a separate partition — recording I/O cannot affect OS stability.
OS & System Architecture
Application Stack
Backhaul Server — SIEM
ZimaBoard 832 or equivalent x86 low-power always-on machine at a trusted fixed address — home lab or VPS. Runs: Wazuh Manager + Elasticsearch + Kibana (Wazuh stack), WireGuard peer endpoint, optional Frigate clip archive mount via rsync. Wazuh correlation rules fire on compound events — person detection combined with GPS position change within the same 60-second window elevates alert severity above either event alone. All events timestamped, retained, and exportable to support a claim.
Advanced Tier Hardware Cost
Total combined deployment — base + advanced: ~$730 one-time + ~$60/month. Less than a single month of a commercial monitored security system with more control, more visibility, and more evidence-grade output.
Evidence Generation Built In from Day One
Without this stack, an insurance claim is your word against the adjuster's lowball. With it, the claim arrives pre-documented: GPS breadcrumb showing the asset leaving the property, timestamped camera clip of unit entry, hardware receipts proving the stack was deployed before the loss. The adjuster has nothing to push back on. That's what this section documents.
| Evidence Type | Source | Insurance Value |
|---|---|---|
| Real-time GPS location history | LandAirSea 54 via LTE | Proves asset location at exact time of loss |
| Timestamped entry/exit video | Arlo cloud + local NVR (advanced) | Documents who accessed unit and when |
| Motion event clips + alert log | Arlo app + SIEM export (advanced) | Establishes exact incident timeline |
| Hardware purchase receipts | Retail order history | Proves security measures were in place at time of loss |
| SIEM forensic event log | Wazuh / Graylog (advanced tier) | Forensic-grade timestamped record of all events |
What This Stack Does Not Defend Against
This architecture is designed for the opportunistic threat profile. It is not designed to defeat a technically sophisticated, targeted adversary with unlimited preparation time.
| Limitation | Detail | Mitigation |
|---|---|---|
| RF Countermeasures | Active RF scanning equipment can detect GPS LTE transmission. Requires specialized hardware outside the opportunistic profile. | Concealed magnetic mount in location requiring disassembly to access. Deployment location not documented publicly. |
| Faraday Shielding | Faraday shielding defeats a tracker only after it's been located. On a concealed mount inside a vehicle or large asset, location requires RF scanning equipment or destructive disassembly — neither of which opportunistic thieves carry. By the time anyone is sweeping a stolen asset, the breadcrumb data has already established its path off the property. | Concealed mount is the mitigation. Finding the tracker is the hard part. |
| Camera Blind Spots | Two cameras provide wide coverage but not guaranteed full-unit coverage depending on layout. | Pan/tilt auto-tracking compensates. Unit layout assessed at deployment. |
| Cloud Dependency (Base Tier) | Arlo cloud storage requires active subscription and connectivity for retrieval. | Advanced tier local NVR eliminates this dependency entirely. |
Barr Cyber Can Deploy This for You
From the Budget Build to a Full SIEM Stack — Scoped, Deployed, Documented
Barr Cyber LLC designs, sources, and deploys physical asset security stacks as a contracted service. Every component in this case study — and every tier above it — can be implemented for you, verified end-to-end, and handed over with full documentation and app access. No proprietary ecosystem lock-in. No ongoing dependency on Barr Cyber unless you want it.
713-882-0902 · warren@barr-cyber.com · barr-cyber.com
Download Complete Documentation
The full case study includes the complete threat model, bill of materials, defense-in-depth architecture, advanced tier stack specification, insurance evidence framework, and known limitations — print-ready.
Storing Something Worth Protecting?
Self-storage, construction equipment, remote property, marine assets — the framework scales. Barr Cyber scopes, designs, and deploys to your threat model. Hardware at cost. You pay for the logic.