109Risk Management
• I must conrm the level of protection that is afforded those assets and if that
level of protection changes with time or other factors.
• I must be able to pass through the perimeter controls, typically comprising
a fence and a guard post, perhaps with some closed circuit video equipment.
• I must be able to get into the building, hopefully without alerting anyone.
• I must be able to get past the receptionist (perhaps using social engineering).
• I must be able to gain access to the restricted area in such a way that
Iremain undetected for 15 minutes, which I estimate is required to launch
the attack.
• I must be able to turn on one of the workstations.
• I must be able to use my cracking tools on the workstation to ...