Testing physical security
Access, the building, and what is reachable on the network afterwards. Within agreed limits, with written authorisation, and without assessing individuals.
The network socket in the meeting room
A physical security test does not end at the door. It asks what someone who is inside reaches: a live network socket in the meeting room, an unattended workstation, a server cabinet without a lock, documents in the waste paper.
So we test access and network together. For many attackers the route through the building is the shorter one, and it goes around every firewall.
Through the door and onto the network
A reader at the door, behind it a meeting room in which a socket is live. Whoever gets past the door is standing in a network that was not meant for guests.
Getting past the door is the easier part. Following someone whose hands are full, a cloned card, a shim under the door, or signing in as an engineer with a work order nobody checks. What is possible on the network afterwards decides how the finding is rated.
What we work with
What gets used is agreed together beforehand. Some clients rule things out, and that is part of the agreement.
Access
Following authorised people through, reading and cloning cards, mechanical bypass of locks and bolts, testing airlocks and emergency exits.
Pretext
An expected engineer, a supplier, a new colleague. The pretext is agreed beforehand, so that nobody ends up in a situation they cannot place.
What comes after
Live sockets, open workstations, server cabinets, documents in the bin and at the printer. And the question of whether the camera system recorded the route.
How a test works
Two to five days on site, depending on the number of locations.
Fix the limits
Objectives, sites, permitted methods, exclusions and abort criteria. Plus the written authorisation our testers carry with them.
Reconnaissance
Publicly available information, observation of entrances and routines, delivery times, shift changes. Without contact with staff.
The attempt
The attempt to get in and to get further. Every step is logged and photographed, as far as agreed.
Write-up
A report with the route, the times and the assessment. What is described is procedures and safeguards, not people.
What is fixed in writing before we come
A physical security test touches property rights, employment law and data protection. So before the first step there is an authorisation setting out who ordered the test, which period applies and which sites are affected. Our testers carry it with them.
The works council belongs at the table before anything starts. We do not evaluate on individuals, and that undertaking is written into the engagement. An emergency contact on your side is reachable during the test, so that a security guard can establish within minutes who is standing in front of them.
Common questions about physical security
Then our testers identify themselves and produce the authorisation. Your emergency contact confirms it by phone. That agreement exists for exactly this, and someone calling the police is a good result.
As few people as possible, so that the response is real. Usually the management, an emergency contact and the works council. Reception and the security service know nothing, because they are what is being tested.
For companies with public footfall, several sites or contractors on the premises, and anywhere the building holds something that should not be reachable from the network: control rooms, laboratories, server rooms.
Certifications and memberships.
Talk to us.
A first conversation usually takes 30 minutes. We look at where you stand and tell you frankly whether we are the right partner.