Neil Gibb walks us through a typical day undercover as a physical cyber security specialist and shares Valuable advice for defending against physical threat actors.
Over recent years, I’ve witnessed a shift in cyber-attack techniques from technical, online-based attacks to targeting an organisation’s physical premises, thus bypassing the defences configured to protect against a typical cyber-attack.
A physical assessment is related to penetration testing and often plays a role in red teaming assessments, testing how your organisation would cope if targeted by a highly skilled physical threat actor. In our blog –
Neil explained some of the common tactics a skilled threat actor may use to gain access to your organisation's physical premises. For example:
This service is in high demand by financial organisations, however with other sectors slowly catching on to its worth. While the lessons learned can be hard to swallow, reading a list of security issues listed in a report doesn't come close to the pain of a real-world breach.
Pre COVID a finance organisation commissioned Integrity360 to conduct a physical cyber security assessment. The organisation was very mature in its cyber security journey and wanted to test how they would stand up against a physical cyber security assessment. For obvious reasons, I must maintain our client’s confidentially, but they’re a high-street name. The stages of the exercise were:
The company was hosting an event for potential clients at their HQ. By means of a false email address, LinkedIn account and company, I was able to secure an invitation.
Dressed to impress, (I left the hoody at home for this phase of the assessment) I attended the event, held in a restricted area of the building sectioned off from sensitive business areas. Security guards were posted at every entry point, checking employee’s identification, guarding against unauthorised access.
Targeting one security guard in particular, I waited and watched and as suspected he became distracted with another matter. Taking this opportunity I removed my jacket and switched my visitor’s lanyard for a fake staff ID pass, copied from pictures taken during the reconnaissance phase of the assessment. I proceeded to tailgate my way through controlled entrances. Someone even politely held a door open for me.
During the course of the exercise I was able to make my way throughout the entirety of the building, planting rogue devices to the network, gathering evidence of documentation lying on unattended desks, some of which was of the highest sensitivity.
Had I been a bad guy, I would have enjoyed rich pickings. Confidential information was lying on unattended desks. Workstations were left logged on as people fetched coffee. Using a USB stick, I was able to copy details and download files in seconds. I kept my mobile phone to my ear the entire time, having now assumed the persona of a member of IT busy sorting out a problem with a colleague.
At no point did anyone challenge me. Mission accomplished with a lengthy report for the client to consider.
I want to be clear the point of these assessments is not to catch anyone out. Had I been caught by security or questioned by an employee, the objectives of the exercise would have been achieved: namely, I would be able to tell the organisation about the effectiveness of their security.
Like many financial institutions, considerable effort and expense had gone into the security of the client’s building. In this case, RFID controlled barriers at all entrances, security guards and CCTV. Most of their internal doors lock automatically on closing and open with ID cards.
In common with most organisations, the flaw in the target’s defences wasn’t because of failings in their physical security architecture or technical controls. Instead, it came down to employees who are untrained, complacent or don’t care.
Human vulnerability is a significant problem across all industries. It requires a continuous approach and regular remediation to stay ahead of criminals, who are only too ready to profit from the smallest gaps in your security posture.
The hard truth is that this scenario, had it been a real-world attack, could have been catastrophic for the company. The potential losses: reputational, financial (through theft or fines by the regulator), operational downtime, breach of customer trust. It’s also easily avoided, which is why I’d like to wrap up on a positive note.
Companies are typically caught out by basic things. A robust staff training programme will eliminate many of your risks. Regular physical cyber security assessments will help you to measure your progress and ensure you stay on track.