Unauthorised Access: Physical Penetration Testing For IT Security Teams

3.1. Common Paradigms for Conducting Tests

Broadly speaking, there are three approaches to physical penetration testing. An overview of each is given in the following sections. When planning a test it is useful to draft a test plan after your preliminary research. This process maximizes the creative process and helps you discover the most viable plan of attack.

3.1.1. Traits of the Overt Tester

The overt tester makes no attempt to disguise his presence. This is not to say that he will announce his intentions, but he makes little attempt to evade security controls or guards and will work 'within the system' as much as possible. When testing overtly, you rely on social engineering and flaws in human security as much as possible. A camera operator would be unlikely to notice anything suspicious about a tester as his intention is to become a part of his environment.

As an example, an overt tester would walk into reception, give false credentials, and be issued a legitimate badge. After border security is breached you become part of the system and have nothing to fear from it. Usually such testing requires a higher degree of initial planning and setup to put the tester in a position of trust.

The following is an example of an overt test:

1. Research staff names and functions.

2. Determine who is on vacation.

3. Turn up for a sales meeting with a middle manager you know to be absent.

4. Sign in at reception, get a badge and 'call your contact' before reception has a chance to. You'll be right up. ...