Physical Penetration Testing

Home > Physical Penetration Testing

Physical security breaches are frequently undervalued. Companies understandably want to protect their digital data by strengthening the security of their digital assets, such as web applications and infrastructure. While this is critical, one should never dismiss the possibility of a physical attack that could completely circumvent digital security mechanisms. An attacker could physically enter the building and steal equipment such as laptops, infect machines with malware, or even plant a rogue machine on the network from which they could remotely access the internal network for further attacks.

Cybergate performs Physical Penetration Testing in accordance with ISO27001:2013 Annex A.11.1. It is intended to assess the effectiveness of your company’s current physical security controls and to identify weak access points that could be exploited by intruders or rogue employees. Doors, locks, emergency exits, sensors, security gates, and loading areas are just a few examples.

Our physical assessments are performed by trained security officials in order to:

  • Expose the level of real-world risks
  • Expose the weaknesses in the Office Infrastructures and Buildings
  • Protect against External & Environmental Threats
  • Work in Secure Areas
  • Provide actionable recommendations to mitigate the identified flaws in a safe and controlled manner.

Get in touch now to secure the physical perimeter of your organisation.

physical penetration testing cybergate your cyber security partner

  FAQs

Why do I need a physical pen test?

A physical penetration test ensures that your office and its physical assets are safe from theft by malicious actors. These assets and the data contained within them are critical to your organization and, in the wrong hands, can be used to disrupt it. Furthermore, competitors would have an unfair advantage with this data at their disposal.

What are the typical costs of such a pentest?

The cost of a penetration test is directly proportional to the amount of effort and time required to assess the physical resilience of the area(s) in scope.

When would I need such a pen test?

As a rule of thumb, when there is a cyber-related risk, a security assessment is required to address it. A physical penetration test is highly recommended if your office contains sensitive data-holding equipment, such as laptops, computers and servers, or even sensitive documents.

 

When dealing with their data, clients frequently request a physical pentest to ensure its security. Furthermore, cyber security regulations such as PCI DSS, ISO 27001, and SOC2 place a premium on physical security.

Should Physical Pen Tests be part of the organisation-wide cyber security strategy?

A cyber security strategy should address all cyber-related risks and avenues that may jeopardize data security, including physical security. What good are firewalls and other digital security products if an attacker can simply walk into an office and connect to the internal network or steal sensitive documents containing the information?

How often should you conduct physical pentesting?

As a rule of thumb, a physical pentest should be performed in the following situations:

  • Just before the company begins to use the office space;
  • Following significant changes to the office space, such as the construction of a new physical extension or the installation of new physical security equipment; and
  • At least once a year to ensure that new personnel, both regular employees and security guards, are alert.

Is the Access Control Policy reviewed as part of the exercise?

Without a doubt. An Access Control Policy specifies what is required and expected of employees, as well as what is acceptable and unacceptable. A deviation from good security practice here can result in stakeholders (e.g. contractors, employees, suppliers, partners) failing to follow best practice procedures, putting the physical security of the entire company at risk.

What are the most common issues encountered during these tests?

The following are the top issues based on our extensive experience conducting these assessments:

  • Employees’ lack of awareness of cyber-security issues;
  • Even when CCTV and cameras are installed, there is a lack of real-time monitoring and surveillance; and
  • Doors to sensitive areas that are kept unlocked.

What are the main steps in a physical pen-test and how long does it take?

The length of a physical penetration test engagement is determined by the number of sites included in the scope and their size. The following are the main steps in this assessment:

  • Building Plan and Access Control Policy Review
  • Passive Reconnaissance and Open Source Intelligence
  • Surroundings Review – Active Reconnaissance and Observations
  • Planning of Attack Paths
  • Exploitation:
    • External to Internal
    • Internal to Secure and Sensitive Areas

Are the following covered in a physical pen-test? - Servers, Network Points, C-level offices and Archives

They most certainly are. The ultimate goal of this type of test is to gain unauthorized access to sensitive information. This can include paper documents lying around the office or internal servers that can only be accessed by connecting to the internal network.

Are physical penetration testing and physical intrusion testing the same?

Yes, these terms can be used interchangeably.

Related Blog Posts

  • 8 tips to ensure your website is secure. Websites can range from simple content driven brochure sites to fully-fledged e-shops with multiple integrations and interfaces, namely with back-office systems and payment gateways....

    12 July, 2021

  • Penetration testing is not a one-time effort but an integral part of any organisation’s Cyber security strategy. Both internal systems and the external environment constantly change and evolve thus penetration testing needs to be carried out periodically to identify any holes and vulnerabilities cyber criminals can possibly exploit....

    25 May, 2021

  • Penetration testing of websites, web applications, Android and iOS mobile apps, APIs and more - an important part of any organisation's cyber security strategy....

    06 April, 2021