Physical Penetration Testing

Benefits of Performing a RedTeam Physical Penetration Test

While many businesses do an excellent job of protecting their network and applications against the threat of a virtual cyber attack, many organizations don't consider the risk associated with a possible physical attack on their locations.  Physical threats that could be simulated include bypassing door locks, stealing devices, or using social engineering to convince an employee to let them inside a server room.  

According to the National Center for Education Statistics, without strong physical security, no cybersecurity professionals can claim to provide true information security or effective security controls. RedTeam Security's physical penetration test experts know exactly how bad actors gain physical access to sensitive, secured areas. They use this experience to provide recommendations to improve access controls and, therefore, overall security posture.

You will realize two main benefits from Red Team's Physical Penetration Testing Services:

• Expose weak physical barriers: RedTeam Security's security assessment will expose physical security vulnerabilities like gaps in fences, doors that are hung improperly, and procedures that are not followed.
• Understand the risks: As part of the vulnerability assessment, RedTeam Security will perform simulated attacks against physical barriers, which will provide an idea of the kind of damage that any security weaknesses leave your business exposed to. When companies know the degree of damage they could face, they can prioritize remediation actions.

RedTeam Security will provide remediation suggestions that will improve an organization's overall security program. A RedTeam Security Physical Penetration Test will expand your security awareness program to include testing the procedures, alarm and access systems, and physical barriers that protect the sensitive information located at your physical location.

RedTeam Security's Physical Penetration Test Solution

RedTeam Security's physical pen testing solution uncovers real-world vulnerabilities in the physical barriers and the systems that support them, meant to protect employees, sensitive information, and expensive hardware. Physical pen test specialists create simulated attacks that mimic the actions that criminals might take to gain unauthorized access to sensitive equipment, data centers, or sensitive information. Some of the tested barriers might include doors and locks, fences, intrusion alarms, or even security guards and other employees. A RedTeam ethical hacker may leverage social engineering techniques to convince well-intentioned employees to provide them building access that they should not have. They might even gain access to a meeting room and pick up credentials, access badges, or information left unattended.

RedTeam Security teams know precisely how criminals might gain access to both computer systems and buildings. A security consultant may rely upon any or all these methods to gain access to the specified locations during a physical penetration test and to identify damage that could be done once that access is gained.  A security consultant will take photos of:

• Bypass Doors - If the building uses an electronic key or combination lock, RedTeam Security may clone a badge, leverage widely available master keys, or may use special tools on improperly hung doors to gain access.  If doors or windows are left propped open or are unlocked, those may be leveraged as an easy method to gain access.

• Bypass Physical Barriers - If a location has fencing, gates, or other physical barriers, RedTeam Security may climb the fence, leverage gaps in the fencing, or bypass gate controls using publicly available techniques.  

• Identify Ways to Steal Information - Once RedTeam Security has gained access to a location, the penetration tester will observe ways to obtain confidential or sensitive information.  This could include identifying unattended computers with active sessions, abandoned access cards, computer screens with confidential data facing common areas, or sensitive information in the trash.
  
  Note:  RedTeam Security does not remove equipment; they will take a photo as evidence of damage that could be done.  

• Network Jacks in Public Areas - The security engineer may attempt to connect to the company network by connecting their device through network jacks in community areas (i.e., conference rooms, break rooms) to identify opportunities to harm.

• Gain Access to Sensitive Areas - The RedTeam Security physical security expert may attempt to gain access to sensitive areas of a building, including server rooms, executive offices, or other identified locations.  If a bad actor gained access to this room, they could easily disable the machines. They might also use unattended peripherals to steal data or introduce a virus.

• Check the Trash - The penetration tester may look into the types of materials that employees discard and whether the company has a shredding policy and available shredders. If this kind of information makes it to a dumpster, criminals will find it easy to steal.

• Social Engineering - Social engineering techniques could be leveraged to gain access to a location by tailgating or leveraging a pretext to mislead employees and convince them to allow access to the building or sensitive information or locations within the building.

Deliverables

A RedTeam Security Physical Physical Penetration Test Report provides detailed, actionable information to help improve physical security controls and the overall security posture of an organization. The report will include:

• Information learned during the Information Gathering and Reconnaissance phases of the project.
• Detailed steps, methods, and pretexts used during the execution of the physical penetration testing engagement
• Identification of successful and unsuccessful actions
• Evidence of security risks or mitigations observed during the engagement
• Recommendation for how to reduce risks going forward

This information will provide a roadmap for the next steps to reduce risk.

Get a Free Physical Penetration Testing Consultation From RedTeam Security

While businesses have focused upon securing networks, apps, and computers against online attacks, 42 percent of security professionals say that they're very concerned about physical threats that could range from an attacker kicking in a door to simply convincing a credentialed employee to let them in. The most robust online security systems will not protect businesses against these kinds of physical or hybrid attacks.

As just one example, a study found at least 74,000 data breaches involved simply stealing a laptop or other device from an employee, contractor, or other stakeholders. Of course, the companies lost more than laptops or phones; they also lost data and credentials.

For another example, criminals have left infected USB drives in parking lots for unsuspecting employees to retrieve and insert in-network slots. This happened at a secure U.S. Army base in the Middle East. The virus spread through both unsecured and secured systems in multiple countries.

Physical penetration testing provides your organization with a chance to uncover and remediate any physical security vulnerabilities. Get started by scheduling an appointment to discuss concerns with a RedTeam Security consultant online or calling 612-234-7848. RedTeam Security can also provide security teams to provide network, application, and online social engineering attacks.