While companies worldwide continue to focus on incorporating security controls to safeguard computer systems from hackers, physical security should never be dismissed as a lesser problem. Many security breaches occur when attackers take advantage of one or more physical security deficiencies. Physical security penetration testing is one approach that organizations can use to improve their security controls.
Disgruntled ex-employees, crime rings and other nefarious entities employ sophisticated attack techniques and methods to exploit these deficiencies when attempting to gain unauthorized access to a company’s assets and facilities. Once they have breached a trusted environment, attackers may steal hard assets, intellectual property or otherwise cause serious disruptions to a company.
Physical security of a facility is particularly open to multiple misconceptions that could be devastating. For example, installing surveillance equipment around a secured site but failing to monitor the feed, or implementing security devices that are easily and quickly avoided by adept social engineers. An unmonitored camera is not a control. It is a record of what has already happened. It is astonishing that many companies are, for the most part, unaware of blatant flaws in their physical security approach until a disaster happens.
But how can a company predict which physical controls are inadequate or missing altogether before the worst happens?
All Facilities are Vulnerable to Physical Security Breaches
Businesses of all sizes may have state-of-the-art security devices, armed guards and strong security policies established, but none of that makes a difference when bad actors use verbal deception or piggyback/tailgating techniques to access a facility. Once they have infiltrated unauthorized areas, intruders are free to do actions that could seriously disrupt business operations, ruin a company’s reputation, commit industrial espionage or harm individuals working at the facility. In some cases, business owners may not realize they have been compromised by intruders until days or weeks later. By then, so much damage has been done the business may suffer enough financial damage or notoriety that it does not survive the attack. A few companies may not even inform the proper authorities after learning their physical security devices have been penetrated because they fear backlash from stockholders or employees.
Physical Security Penetration Testing – Why a Red Team is Essential to Your Company’s Overall Security
Physical penetration testing provides real-world exploratory trials of how effective a company’s physical security methods are with protecting equipment, data, and personnel. After discussing your methods with a security consultant, your site will be inspected by professionals who carefully evaluate and note vulnerabilities open to exploitation by attackers.
Primary objectives of physical penetration tests include assessing the ability of current physical security controls to prevent penetration by bad actors and actually testing these controls to determine their efficacy. Physical penetration testers, known as a Red Team, are highly trained, experienced individuals who know how to infiltrate secure environments employing techniques accomplished attackers use. Using their experience to target a company’s most critical security issues, Red Team members act and think like intruders by tailgating employees, attempting to enter secure facilities by talking to employees, circumventing alarms or disabling cameras. Other methods may be used to gain access depending on the type of security measures a facility uses.
Red Teams are trained to elude detection from one or more of the following security devices:
- CCTVs (closed circuit television cameras)
- Keypad entry locks
- Wireless intercoms/video intercoms
- Motion sensors
- Single or double deadbolts
- Door and window locks
- Steel security doors
- Remote entry gates
Physical Security Penetration Testing and the Red Team
Physical security penetration Red Teams go beyond the standard exploitation tools used by most companies. Instead of relying on tool-based approaches, a Red Team develops unique attack situations combining manual and automated procedures. In addition, Red Teams can scale a testing program to fit a company’s security needs and budget.
Although advanced persistent threat (APT) is a term commonly used for cyber attacks, it also describes intruders gaining access to a supposedly secure facility and remaining undetected for extended periods. Physical security penetration testing helps guard against APTs known to target financial, manufacturing and national defense industries containing sensitive military plans, intellectual property or top-secret data valuable to intruders hired by other companies to perform stealth work.
Acting as a highly cohesive squad of experienced physical security testing experts, Red Teams develop and conduct their exercises using evidence-based TTPs (Tactics, Techniques, and Procedures) mimicking today’s seasoned attackers.
Physical security penetration testing performed by a skilled Red Team rigorously tests an organization’s existing security methods. Red Teams also determine:
- Whether alarms, CCTV, locked doors and other access prevention devices can be circumvented. How easy is it for an intruder to piggyback an employee who inputs a door code to gain access to a building?
- How long an intruder can wander around a facility before they are detected or before anyone questions who they are, what they are doing and how they entered the facility
- Whether security policies are adhered to after the facility has closed for the day. In any physical security system, the weakest aspects almost always involve the human element
- Whether calls to a company’s front desk or other guest point screen callers who may be pretending to be an employee or contractor. How easy is it for someone to show up with a package, claim they are delivering something important and be allowed into sensitive areas of a facility?
During physical security penetration testing conducted by a Red Team, employees do not know testing is underway. Necessary for the Red Team to gauge real-life responses to an attempted unauthorized infiltration by an intruder, this exercise mimics classic behaviors used by proficient attackers. Organizations that already test their cybersecurity would also benefit from using a Red Team to discover weaknesses that exist outside their computer networks. Many information security breaches start with a physical security gap, which is one reason we treat physical security, information security, and business continuity as one connected problem.
Physical security penetration testing exercises could continue for several days or several weeks, depending on the size of the company and whether the Red Team keeps uncovering additional gaps. Some organizations test more than once a year. Security consultant teams also collaborate using chained, multi-vector attacks, multiple actors, exploiting all known attack paths and using nearly any means to accomplish their mission: finding the gaps before a real attacker does.
What happens after the test matters as much as the test. Findings should feed your security operations, your post orders and training, and your crisis plans. If you run a global security operations center (GSOC), the test is also a test of how fast your operators notice and escalate.
Podcast Episode on Red Teaming
In addition to this article, you may find Episode #57 of our Managing Uncertainty Podcast to be a valuable listen. In this episode, I discuss the concepts of Physical Security Penetration Testing and share some specific examples from my experience.
One of them: at a healthcare client’s headquarters, a shared loading dock led to a back hallway where the mailroom door was propped open. A tester in a plain brown “delivery” outfit walked in at 8:30 in the morning and ended up outside the executive suite without anyone stopping him. The same team got through a data center door with a screwdriver. What finally ended the test was one guard supervisor who insisted on escorting the testers to verify their access. Process exists on paper until someone follows it.
Keep Going
A few ways to go deeper if this was useful.
- Read more. Resilience, crisis management, and security writing at Bryghtpath Insights, or the structured Ultimate Guide to Crisis Management.
- Connect security to response. Our GSOC consulting helps you design the strategy, procedures, and staffing that turn detection into action.
- Get a maturity score. Our Resiliency Diagnosis® is a standards-based review that produces a maturity score and a prioritized roadmap.
- Talk to us. Set up a call to think through your security and resilience program with us.
