Physical Security
Why does Physical Security Matter?
When doing a PenTest we must take into account physical security. We want to make sure all the assets are secure and protected.
Assets include data, facilities/physical area, employees/personal and hardware.
Keep in mind that an inside attack is more likely than an outside attack. This is often overlooked.
While doing recon you should check out the buildings security. It might be easy to gain access to locations that you'd like to investigate in the future. If you do go on prem make sure you have a story. You don't want to get stopped and questioned and have your cover blown!
Physical Security Rings
The rings approach to physiucal security defines different levels of security zones within an organization. Each ring is a unique security zone where increase level of access is required.
Perimeter Ring: Outter most ring. This focuses on securing the perimeter of the building/property. Think of gates, fences, cameras.
Building Ring: This focuses on securing the building itself. Think of ID cards, alarms, biometrics, authentication, locks.
Interior Ring: This focuses on securing specific areas of the building. The idea is to separate areas based on the required level of access. Think of ID Cards, access control systems, locks, security cages.
Data Center/Servers Ring: This focuses on securing the critical infrastructure. Think of ID Cards, access control systems, locks, security cages.
Secure Room Ring: The highest level of security is required. Access should be tightly control and limited to only those who are authorized. Think of armed guards, biometrics, two factor authentication.
Data
We want to make sure we are securing our data as physical access makes the lives of an attacker easier.
Thing to think about to secure data:
Password Policies
Screensavers/locked screens
Banners on devices display upon login detailing who can access it
Computer Systems should be secured
Do not allow unknown people in building
Question people who are unidentified
Harden the OS/disable USB
Physical Area
This aligns to the first ring. What can we do to secure the physical area?
Fences
A fence 3-4 foot high could deter casual trespassers.
A fence 6-7 foot high could deter many others are not easy to climb.u
A fence 8+ ft with a top guard could deter a determind intruder.
Gates
A gate can provide teh ability to control who is entering and leaving a property/location.
Mantrap
Has two doors where only one door can be opened at a time.
Locks
Make sure locks are installed correctly!
If using locks be aware of lock picking tools, bump keys or locks that use combinations.
Walls
Make sure the walls are secure. Drywall is easy to break.
Ceilings
Also, make sure the ceilings are secure. Drop tiles are easy to climb through.
Windows
Windows are easy to break (though, in a pentest you should not do physical damange, but not everyone will play as nice). There are methods that can be used to secure windows and make them harder to break.
Bollards
Bollards can prevent cars from accessing entryways or ramming the building.
Cameras
Cameras are a great way to monitor a large amount of space and the data can even be saved for later viewing.
Just make sure they are installed correctly!
Overview
This is just an overview of various phsyical security mechanisms that can be put in place or that you can recommend a company/business to implement in order to secure their physical environment. Others that were not covered are fire suppression, positive pressure and even types of locks.