What is Physical Penetration Testing?
Physical Penetration Testing is defined as a real-world intrusion attempt to see how attackers might gain physical access to the organization’s infrastructure, systems, or employees. It is also known as Physical Intrusion Testing. It aims to identify, expose, and improve the organization’s physical security and defense weaknesses that malicious hackers can exploit.
Benefits Of Physical Penetration
1. Prevent the organization from infiltrators
They are simulated intrusion attempts by real hackers that can significantly help to evaluate physical security infrastructure. In addition, it helps identify the loopholes so that the organization can remediate them before an attack occurs.
2. Avoid Data breaches and financial damage
Performing them can be a proactive way to strengthen organizational security. They can reduce the chances of data breaches or cyber-attacks as weak physical security may be a starting point for most cyber attacks. Any cyber-attack can hurt the organization’s reputation and incur unanticipated penalties and fines leading to financial damage.
3. Mature the environment
They can be a great way to maintain a competitive advantage against other organizations.
4. Identify the root cause of physical risks
They help an organization evaluate its physical controls and identify any loopholes. But, unfortunately, they pose a risk to organizational security and are the root cause of most cyberattacks.
5. Gain Client confidence
Clients’ confidence is boosted by knowing that the organizations they are working with are more aware than their competitors, reducing the chances of any cyberattacks. Many more clients may want to work with an organization that is more secure than the rest.
Methods Used In Physical Penetration Testing
Mentioned below are some of the various methods adopted by organizations to perform physical penetration testing are:
1. Perform Social Engineering on Employees
Social engineering extracts sensitive information from an organization’s employees by using deceptive tactics they are unaware of. It requires the attacker to possess strong social skills and has been an entry point for most cyberattacks in the past. Attackers may use authority and urgency as a cause to pressure the employees, so they fall into their trap. Attackers exploit the employee’s natural desire to help them, forgetting about their best practices and performing tasks they are not allowed to do. In most cases, the employee is unaware that they have been manipulated to help the attacker.
Mitigation: Hire a professional social engineer to test the employees by using tactics like fake mails, fake phone calls, disguises, and manipulation of security guards using fake IDs. Implementation of security awareness training policies and programs is the most effective defense.
2. Check Meeting Rooms
Often meeting rooms are a great source to collect information. Employees generally leave unlocked laptops, password-written papers, or sensitive documents thereafter meetings end, posing a severe security risk to the organization. In addition, these documents provide attackers with essential business decisions that an organization might be considering.
Mitigation: Organizations should enforce employee policies regarding unattended electronic media and sensitive documents employees leave behind in meeting rooms.
3. Attempt to gain physical access
To do this, attackers use a technique known as tailgating. This is often combined with social engineering techniques to pressure the employees to enter the facility without any interrogation, i.e., bypassing restricted entrances where only authorized personnel are allowed to enter.
Mitigation: Deployment of checkpoints and mantraps should be compulsory to prevent unauthorized access. A dual authentication method should be used where first access is granted through the access cards and second through the biometric scan. The organization can use turnstiles or appoint security guards to discourage tailgating attempts.
4. Dumpster Diving
To perform this, the attacker might look through the employee’s trash can and surroundings to find any source of sensitive information like invoices, paper docs, and bank statements that can penetrate the organization’s security.
Mitigation: All critical documents containing essential or sensitive information must be discarded by either being burnt or put into paper shredders.
5. Check fire and cooling systems
To ensure the physical safety of the servers, it is essential to check an organization’s fire and cooling systems. Overheating or fire in the server room can cause unavailability of servers which may cause the organization huge losses.
Mitigation: The fire and cooling systems should function properly to maintain a safe physical environment for the servers in the organization.
6. Access sensitive information
In order to access sensitive information, malicious attackers usually use telephotography, i.e., clicking pictures through the company’s windows to view sensitive information that may be present on an employee’s computer screen.
Mitigation: Organizations should not have buildings made out of glass windows entirely as they would be susceptible to telephotographic attacks. The windows must be tinted or placed where work desks or systems are not visible.
7. Map the entrances and perimeters
All the possible entrances and unsecured entry points like windows, doors, or emergency exits must be identified and mapped as these are susceptible to attack. Attackers use these unsecured entrances to gain the building’s access and attain a direction to carry out their physical penetration attacks on the organization.
Mitigation: Perform analysis of the building’s surroundings and determine any unsecured roof type, basement access, windows, and doors and get them secured.
8. Lock picking
This is one of the most effective ways to bypass doors and exits, as mechanical locks haven’t evolved much with time. There are courses related to physical penetration testing available, including lock picking tools and techniques.
Mitigation: Use electromagnetic locks to reduce the risk of lock picking and avoid intrusion attempts. Since scanning and duplicating ID cards require extra efforts, organizations prefer electromagnetic locks with PIN authorization access or dual authentication, i.e., card and pin.
9. Test server rooms, wires, and cables
A crucial part of the network, Servers are given the most security consideration. So if an attacker gains access to an organization’s server room, the entire network may be infected. Usually, servers are stored in racks that require a key or pin to gain a server’s physical access.
Nowadays, businesses use cloud environments to host their data and systems stored in data centers. These data centers require various layers of authentication as they are responsible for hosting websites and comprise organizational data.
Mitigation: The organization should either adopt a multi-layer authentication model for their networking equipment or consider working with a 3rd party hosting provider or shift their systems to a data center to ensure security.
10. Intercept EM waves
Organizations often use ElectroMagnetic(EM) waves to transfer their data, which attackers can intercept. Wiretapping bugs can be used to fix the wire, and later frequencies are picked up using a combination of antenna and receiver by the attackers. If the traffic is weakly encrypted, the attacker can take the data offline and perform brute force attacks to obtain the passwords. This leads to the theft of sensitive information, which causes crucial damage to the organization.
Mitigation: Organizations should use advanced encryption algorithms in order to make their communication channels and media secure.
11. Break RFID tags’ encryption
Radio Frequency ID(RFID) tags are used to secure portable resources and are used for identification and information retrieval using RFID tools, but they can be tracked using radio waves.
Mitigation: Encryption can be used to secure an RFID tag, but if the attacker manages to crack the encryption, the tag can be modified and susceptible to attack.
12. Test network jacks
Often organizations are loaded with unused active network jacks, which are mostly overlooked. Still, these can be a potential target for attackers as these network jacks can be exploited by plugging them into a wireless access point and granting them network access.
Mitigation: All the network jacks in the conference rooms, meeting spaces, or lobby areas must be identified and adequately monitored. Network jacks should be inaccessible due to proper network access control, and the organization should focus on preventing rogue device functions within the organization.
13. Shoulder surfing
The attacker would just look over an employee’s shoulder to observe them while typing their credentials to perform this method. Most attackers get usernames, passwords, and sensitive data. The attacker would not hover around an employee’s space or workstation to be evident.
Mitigation: Employees using screen protection on their systems would significantly decrease the attacker’s observational ability and make it difficult for them to comprehend the employee’s typing actions.
Penetration Testing and Ethical Hacking is a course designed to make a fresher understand what penetration testing is. On the other hand, Physical Penetration Testing is a course designed to understand the topics mentioned above and understand Physical Penetration Testing. If someone is curious to understand the standards used for Penetration Testing, then Penetration Testing Execution Standard will be a great start.
REFERENCES
- https://www.google.com/url?sa=i&url=https%3A%2F%2Fwww.cybrary.it%2Fcourse%2Fphysical-penetration-testing%2F&psig=AOvVaw2bvseOYeF9lDjSQogKZnOt&ust=1640027220401000&source=images&cd=vfe&ved=0CAwQjhxqFwoTCPiir-TH8PQCFQAAAAAdAAAAABAD (Image 1)
- https://www.onsecurity.io/our-services/penetration-testing/physical-penetration-testing/
- https://rsmus.com/what-we-do/services/risk-advisory/cybersecurity-data-privacy/security-testing/physical-penetration-testing.html
- https://purplesec.us/physical-penetration-testing/
- https://kirkpatrickprice.com/blog/5-benefits-regular-penetration-tests/
