Unauthorised Access: Physical Penetration Testing For IT Security Teams

3.3. Example Tactical Approaches

These are specific approaches that I've found to be very effective in most circumstances. Self-confidence is a powerful factor in any testing situation and absolutely necessary to your success. It's a cliché but if you believe in yourself and your chosen persona, others will too.

3.3.1. Tailgating to Gain Entry

Tailgating is an attack that you can use in any environment that makes use of proximity door controls. In principle, the concept is simple enough but in practice, it requires a little forethought for successful execution. You (or an intruder) are unable to open proximity door locks without an activated token. To overcome this, you wait until a legitimate pass holder opens the door and then slip through behind them. It is important to do this in a way that does not draw suspicion.

A classic approach is to 'talk' on your mobile phone near the door and conclude the call just as someone passes you in the hallway and opens it. Then you follow them. Give the impression that you've just gone out to take or receive a phone call, which you've now concluded and are returning inside. Don't make eye contact if possible and seem preoccupied, frustrated or generally annoyed. These are natural emotions in most corporate environments and your mark will know better than to challenge you, although most of the time he won't even notice you.

This completes the con. Be careful though. Although this is a great technique for breaching border security – particularly ...