“I’ll just let myself in…”: A comprehensive guide to physical penetration testing

This comprehensive guide aims to give you an understanding of physical penetration testing, it’s benefits, methodolgy and how to prepare for a physical pen test.

There’s a well-known saying among cybersecurity professionals: physical access is root access. “Root” in this case refers to the default superuser account found on many types of operating systems. The root user has complete control over a computer system, with the power to view any file, change any setting, and create or delete users with impunity.  

Suffice it to say that gaining root access to a computer system is one of the main goals of an attacker, and keeping access to the root user is a primary concern for anyone responsible for the safety of computer systems. 

Cybersecurity companies, teams, and professionals work tirelessly to prevent attackers from gaining access to computer systems by remote means, such as across the internet, to keep the systems and information within those systems safe and secure.  

But what if an attacker could simply bypass those controls by gaining physical access to a computer or network?

What if someone simply walked into your office and walked out with a laptop under their arm? Or plugged a dial-home device directly into your network and went home to continue their attack?

How would you know if your physical security controls were strong enough to defend against that kind of attack? 

This is what a physical penetration test can help you to find out. 

What is a physical penetration test? 

A physical penetration test is a type of security assessment where a penetration testing consultant attempts to breach the physical security measures of an organisation by using the tactics, techniques, and procedures of a real attacker.

As with any other type of penetration test, this can be performed from a variety of simulated attacker perspectives, depending on how much information you assume the attacker knows.  

Generally, the less the pen tester knows about your organisation, the more reflective of real-world scenarios the test will be, with the ultimate goal being to identify any vulnerabilities in the physical security measures in place. This means looking at things such as locks, barriers, access controls, and surveillance systems; gaining unauthorised access to facilities, sensitive areas, or other information that should be restricted. 

Employee security awareness

Depending on the parameters of the test, this can also involve seeing how the people in your organisation respond to the actions of an unauthorised person in your building.

Skilled consultants might employ ‘social engineering’ techniques against your team to gain access to restricted areas, information, or equipment. We’ll look at this in more detail later in the article. 

Physical penetration tests are an excellent way of putting your security controls to the test, both as a regular, business-as-usual, security checkpoint and as a means of ensuring your compliance with information security standards such as ISO 27001.  

Let’s take a deeper look at how physical penetration tests can help your organisation identify security weaknesses and strengthen your physical security overall. 

What are the objectives of a physical penetration test? 

In general, the objectives of a physical penetration test can be quite far-reaching, although, like any other type of security testing, they’re likely to change during the scoping phase of the engagement depending on what your specific goals are. 

Identify vulnerabilities in physical controls

Primarily, a physical penetration test attempts to identify vulnerabilities in the physical security controls that are currently in place. At its most basic, this could include checking things like access control measures, such as locks on doors—do they use key cards or biometrics to control access? Or is it simply a four-digit code that all staff know, or even just a pin and tumbler lock and key?

Multi-digit pins and regular keys would be considered weaker forms of access control, as an attacker could ‘shoulder surf’ and steal an access code while it’s being typed in; additionally, a key-based locking mechanism could be picked.  

CCTV surveillance

Other physical security measures to assess might include CCTV surveillance, which begs the question of whether all the access points to your building are continually monitored.

A consultant might try to identify any blind spots where an attacker could hide, for example. Furthermore, are there any restricted areas within the building that might contain sensitive information where it would be prudent to record people entering and exiting that location? 

Other physical security measures

The types of physical security measures vary depending on the nature of the organisation and the facility itself—a data centre might need to employ additional controls such as bollards that prevent vehicles from approaching too closely to the main building.

Other facilities might need to fence their perimeter to prevent unauthorised access, and a consultant would take these things into account when assessing a location. 

Security locking measures

Physical penetration tests also look at the effectiveness of the security controls in place. Using the previous examples, this might include attempting to bypass any locking mechanisms—picking locks or cloning ID cards, evading CCTV surveillance, scaling fences, and even simply walking into a building through open doors.  

Security personnel monitoring

If there are security personnel on site, then a consultant will attempt to assess their effectiveness in responding to security incidents. They might also look at their patrol patterns, shift change processes, and general awareness of their surroundings in order to identify any potential weaknesses.  

Depending on the parameters of the test, a consultant might intentionally get caught by security personnel to see if they can ‘talk their way out’ of a situation. This might highlight any flaws in the security incident response process. 

Is social engineering used in a physical penetration test? 

It is difficult to talk about social engineering without evoking images of Frank Abagnale dressing as an airline pilot and smooth-talking his way onto the flight deck of a Pan-Am airliner, but that is one of the more dramatic examples of social engineering.  

What is social engineering?

At its core, social engineering is the ability for someone to gain unauthorised access to information or material by tricking, coercing, or otherwise deceiving an authorised person within an organisation.  

There are many types of social engineering attacks; however, they are all focused on getting someone to do something for you. They are typically, but not always, low-tech in their approach, with an attacker often sending emails, making phone calls, and in the case of a physical penetration test, turning up to your location.

If the scope permits, then a consultant will employ social engineering techniques where appropriate to gain further access to restricted areas and materials.  

The reality is that every member of your organisation is responsible for the security of that organisation, and so testing your team members’ responses to social engineering will help to highlight any potential opportunities for improving how your team responds as a whole.

One of the more interesting aspects of these human-based vulnerabilities is that everyone in an organisation is susceptible to them. 

Are your employees ‘cyber-aware’?

One of the biggest challenges for any organisation is ensuring that the people within the organisation are sufficiently trained to recognise and resist attempts by attackers to gain access to restricted systems and information. Unfortunately, every single person within an organisation is a potential security risk. This is why phishing, smishing, and vishing-style attacks are so effective and are used by threat actors so widely.  

Why bother putting together an elaborate chain of vulnerabilities to gain access to someone’s computer account when you can simply call that person pretending to be from the IT department?

Time and time again, we see examples of severe data breaches that might have been prevented—or at least mitigated—if an individual was better prepared to recognise the threat.  

Additionally, the fact that a team member is part of the C-Suite or upper management does not automatically make them less vulnerable to these styles of attack; this makes organisation-wide training and awareness a top security priority. 

What are the stages of a physical penetration test? 

A physical penetration test follows much of the same structure as any other penetration test, with the additional consideration that certain stages of the It’s also important to understand the penetration testing lifecycle, can incorporate other types of penetration tests.  

For example, if the consultant can gain access to the internal network, the actions they perform will closely follow the methodologies used in an internal infrastructure assessment. Generally speaking, the stages can be seen as scoping, reconnaissance, vulnerability analysis, exploitation, post-exploitation and analysis, and reporting. 

Scoping a physical pen test

Scoping defines exactly what will and will not be tested by the consultant. What is penetration testing scoping? At its most basic, a list of addresses will need to be provided, and depending on the nature of the building or office, the scope might explicitly define certain floors or areas that are in scope and certain floors or areas that are not.  

The scoping aspect will also further define the parameters of what the consultant is and is not allowed to do. For example, you may not want social engineering to take place during the assessment.  

You might also want the assessment to take place at particular times, such as outside of office hours. Likewise, you may or may not want the consultant to employ the use of any tools that might disrupt an employee’s Wi-Fi connection, as another example. 

Reconnaissance

The reconnaissance phase is where the consultant starts to gather information about the test targets. This often involves extensive use of open-source intelligence (OSINT) and may include searching for images of the office interior online, looking at team members’ social media profiles, and performing “virtual drive-bys” using tools such as Google Street View.  

This phase, and its importance, cannot be overlooked: the intelligence and information gathered at this stage will help inform the consultant about the nature of the security in place.  

The reconnaissance stage might reveal the types of access control in use, and searching through team members’ social media pages can often reveal information about the office layout and whether ID cards are used, and sometimes what those ID cards look like. Tools like Google Maps and Google Street View can provide information about the size of the test location, as well as identifying how many external doors there are or if there are security fences, for example.  

If necessary, the consultant might even travel to the test site themselves and perform closer, more detailed reconnaissance. All of this information helps the consultant prepare for the next stage of the test. 

Vulnerability analysis 

This phase of the assessment is where the consultant attempts to identify possible and likely vulnerabilities within the physical security systems. They will gather all the information from the previous phase and attempt to create several scenarios to test, with the goal of actively exploiting these vulnerabilities.  

For example, the consultant might try to impersonate an employee. They may have identified what staff identity cards look like and created a replica of one. They might also have determined many details about the layout of the building from images shared on social media and created a map.  

Additionally, they may have identified that the entrance to the building is a large doorway that allows multiple people to pass through simultaneously, meaning they might be able to gain initial access to the building simply by tailgating another team member through the door.  

Using the knowledge they’ve gained during this phase, the consultant would be able to gain entrance to the building and move about unchallenged in their disguise, while they identify other areas for potential exploitation. 

Exploitation

This is the active phase of the assessment where the consultant carries out the pre-planned actions, actively seeking to gain entrance to the building or facility and ultimately access as many restricted and sensitive areas and materials as possible.  

If the scope allows for it, the consultant will also test the security responses of team members within the organisation. For example, they might try to access an employee’s laptop while they are using it or attempt to get someone to divulge sensitive information, such as a username or password.  

The consultant might try to gain access to server rooms and other areas that store sensitive equipment, as well as attempt to obtain network access to see if they can do things like steal credentials. 

Post-Exploitation and Analysis

This phase is mainly concerned with seeing what else is possible once a reliable foothold has been gained within the facility or organisation.

Is it possible to issue extra ID cards?

Is there equipment that can be stolen?

Are there side doors or windows that could be left open so that access can be gained at a later date?

Is it possible to leave a device plugged into the network so that a remote connection can be established?

Can the security team be convinced that the consultant’s actions are legitimate and authorised?

Ultimately, it is about trying to find the extent to which the physical security of the organisation can be exploited. 

Reporting

After the active phase of the engagement, the consultant will produce a penetration testing report, which often takes the form of an engagement narrative. This report will detail the actions and observations from the entire engagement, including the crucial reconnaissance phase, and will contain any photographic evidence gathered during the test.

Due to the dynamic and complex nature of a physical penetration test, the engagement narrative format of the report is designed to help you understand the various interactions that led to the successful exploitation of any particular security measure.

It is not sufficient to simply state that “there was a blind spot in the CCTV coverage” when the consultant may have approached the blind spot, found a side door used by staff to exit the building for breaks, pretended to be returning from a break, and asked a staff member to let them in. In physical penetration tests, context really matters. 

How to Prepare for your Physical Penetration Test 

In the same way that your security partner needs to prepare to perform the physical penetration test, there are also some stages that you, the client, need to perform in order to ensure the engagement proceeds as smoothly as possible. 

Set clear objectives and define the scope

One of the most important aspects of any security test is being clear about what exactly you want to learn from the test. Additionally, the boundaries for what is and is not within the scope of the test must be defined. Clearly defined boundaries for testing limit the risk to both you and your security partner.  

An example of a well-articulated objective could be that you want to test how resistant your team members are to social engineering attacks and assess their awareness of good security practices within the organisation.

You may also wish to test how compliant you are with an information security standard such as ISO 27001.  

Another objective might be to see if an unauthorised person can gain access to a server room or other restricted area. Objectives can be broad; however, in general, the more specific your objectives are, the more valuable the information you will get back from the test will be. 

Equally important, if not more so, as clearly articulated objectives that have well-defined scopes.

A properly defined scope ensures that only the things you want to be tested will be tested. It also ensures that you and your testing partners do not end up in legal hot water; there are horror stories among security professionals about unfortunate testers who found themselves straying outside of the scope and ending up in undesirable situations, including jail cells!  

Other reasons to define your scope clearly become apparent when you are in shared premises. Your organisation might have offices on the first, third, and fourth floors, and you might only want one of these floors to be in scope for testing.

Suffice to say, it would be an uncomfortable discussion if the tester gained entry to an office that neither they nor you had authority to access! 

Establish the rules of engagement

As with defining the scope, it’s important to define the rules around the engagement. You may not wish for the consultant to use certain forms of social engineering, or even to minimise contact with team members altogether. You might not want to allow for the consultant to attempt to gain access to or spoof your wireless networks due to concerns about work interruption.  

Furthermore, you might wish to have the consultant within view of a point of contact during the engagement. Additionally, you might also wish for the engagement to be as accurate a simulation of an attacker as possible—closer to a Red Team test—and allow all and any non-destructive techniques to be used. 

Gain authorisation

This is another crucial point when you’re preparing for a physical penetration test. You need to make sure that you have written permission to test all the buildings, systems and facilities that you’ve defined in the scope. Without written authorisation, the consultant could very easily break multiple laws, and your organisation might also fall afoul of various parts of UK legislation, including laws like the Data Protection Act.  

Depending on the things that are in scope, this might involve getting permission from multiple stakeholders and if you’re in a shared office, for example, you might also need to get permission from the building owner or facilities manager.  

As mentioned at the start of this article, security testing, especially penetration testing, uses the tactics, techniques, and procedures of a threat actor. Doing this without proper authorisation and permission can, in the worst case, break the law. 

Communicate internally

Key people in your organisation should know that a physical penetration test is taking place. Who and how many depends on the scope, rules and objectives of the engagement, but typically someone who holds overall responsibility, or is accountable for the security of the business, should be aware that a test is taking place. This might be the same person who commissioned the test or gave permission for it to go ahead but in any case, this person should be available to contact throughout the testing window. 

In some cases, it might be useful to alert any external security-related contractors, such as third-party Security Operations Centres or any partners that provide security guards or CCTV monitoring. And if your facility is linked to any local authorities, including the police, you must inform them too—you don’t want your consultant getting arrested! 

Plan for Post-test actions

After the engagement, you’ll receive a report detailing the physical security vulnerabilities that were found during the engagement, how they were identified and, where appropriate, how they were exploited. This will leave you with clear areas which need remediating.  

Depending on the weaknesses found, the remediation could be involved and require the efforts of people from multiple departments. It might also involve training team members on the existence of new threats and new security practices.  

Alternatively, new physical security measures might need to be procured and installed, meaning budgets might need to be agreed and approved. It’s best to plan ahead for how you might need to perform complex remediation actions to help manage expectations and avoid surprises. 

How often should you conduct a physical penetration test? 

Whilst this is going to vary from organisation to organisation, and will depend on various factors, including things such as the number of locations that you have, the current physical security measures that you have in place and how quickly your team is expanding or changing.  

Organisations with multiple locations and larger teams naturally have a larger ‘attack surface’, and so would benefit from running more regular testing. If your business has fewer locations and a smaller team that doesn’t change as often, then you might not need as regular a testing schedule.

That being said, as with other types of security testing, it is beneficial to schedule testing annually at the very least, or after any significant changes like moving to a new office. Your security testing partner should be able to help you find a type and frequency that best meets your needs. 

Conclusion – Physical penetration tests can improve your cybersecurity posture

Security is often broken down into discrete areas, which means it’s easy to think of those areas as not overlapping. You might work incredibly hard on improving security in one area, only for it to be compromised by a weakness in a different area; your data can’t be considered safe if an attacker can climb into your server room via an open window.  

Likewise, if an attacker can compromise your CCTV security remotely, the overall security of that building is dramatically reduced. Security is an overlapping spectrum and continuum of discrete practices that need to be aware of where they interact with each other.

If physical access is root access, then physical security is cybersecurity; talk to Evalian today to find out how we can help you improve yours.