Physical Security

Why does Physical Security Matter?

When doing a PenTest we must take into account physical security. We want to make sure all the assets are secure and protected. 


Assets include data, facilities/physical area, employees/personal and hardware.


Keep in mind that an inside attack is more likely than an outside attack. This is often overlooked. 


While doing recon you should check out the buildings security. It might be easy to gain access to locations that you'd like to investigate in the future. If you do go on prem make sure you have a story. You don't want to get stopped and questioned and have your cover blown!   

Physical Security Rings

The rings approach to physiucal security defines different levels of security zones within an organization. Each ring is a unique security zone where increase level of access is required. 


Perimeter Ring: Outter most ring. This focuses on securing the perimeter of the building/property. Think of gates, fences, cameras. 


Building Ring: This focuses on securing the building itself. Think of ID cards, alarms, biometrics, authentication, locks. 


Interior Ring: This focuses on securing specific areas of the building. The idea is to separate areas based on the required level of access. Think of ID Cards, access control systems, locks, security cages.


Data Center/Servers Ring: This focuses on securing the critical infrastructure. Think of ID Cards, access control systems, locks, security cages.


Secure Room Ring: The highest level of security is required. Access should be tightly control and limited to only those who are authorized. Think of armed guards, biometrics, two factor authentication.

Data

We want to make sure we are securing our data as physical access makes the lives of an attacker easier.


Thing to think about to secure data:


Physical Area

This aligns to the first ring. What can we do to secure the physical area?

Fences

A fence 3-4 foot high could deter casual trespassers.

A fence 6-7 foot high could deter many others are not easy to climb.u

A fence 8+ ft with a top guard could deter a determind intruder. 

Gates

A gate can provide teh ability to control who is entering and leaving a property/location.

Mantrap

Has two doors where only one door can be opened at a time. 

Locks

Make sure locks are installed correctly! 

If using locks be aware of lock picking tools, bump keys or locks that use combinations.

Walls

Make sure the walls are secure. Drywall is easy to break.

Ceilings

Also, make sure the ceilings are secure. Drop tiles are easy to climb through.

Windows

Windows are easy to break (though, in a pentest you should not do physical damange, but not everyone will play as nice).  There are methods that can be used to secure windows and make them harder to break.

Bollards

Bollards can prevent cars from accessing entryways or ramming the building. 

Cameras

Cameras are a great way to monitor a large amount of space and the data can even be saved for later viewing.

Just make sure they are installed correctly!

Overview

This is just an overview of various phsyical security mechanisms that can be put in place or that you can recommend a company/business to implement in order to secure their physical environment.  Others that were not covered are fire suppression, positive pressure and even types of locks.