What is a Physical Security Penetration Test?
Verrimus perform physical penetration tests, also referred to as PS pen tests or Red Team security assessments, regularly for our clients.
A physical penetration test assesses the risk to your organisation of an attacker physically entering your premises. This security assessment service is an assessment of the physical security controls of the client organisation. When we refer to physical security controls, these are things like;
- locks,
- fences,
- alarms,
- cameras,
- access systems such as retinal scans, card access, fingerprint scans,
- security personnel,
- patrols,
- alarm responses
A physical penetration test operator will attempt to gain access to a client’s property, by circumventing all the controls to restrict access that an organisation may have in place.
Why Do Organisations Want a Physical Penetration Test?
We work with our clients during the planning and prep stages of a physical penetration test to establish what the scope of the assessment must include. Clients may want to know some of the following information;
- How difficult was it for the penetration operator to gain access?
- What information or what areas did the penetration operator manage to access?
- What could a hostile person manage to do in the time they gained access?
- Will the employees challenge a stranger on the premises?
- Did any of our access control systems fail/work well?
Some organisations are pro-active and request a physical pen test prior to any incidents of concern taking place. This allows them to assess their current access controls and where necessary adapt and improve them. Sadly, some clients approach us to conduct a physical pen test, after they have had a concerning issue take place.
Who Requests A Physical Penetration Test?
We’ve had clients from many different industry sectors procure our physical pen test services. Here are some of our clients’ varied industry sectors;
- Financial organisations (banks, investment organisations)
- Energy sector (oil and gas)
- Healthcare settings
- Education settings
- UHNW individuals
- Pharmaceutical testing facilities
There are benefits to be gained to any organisation, from commissioning a physical penetration assessment.
How is a Physical Penetration Test Performed?
There are many and varied techniques utilised by Verrimus operators to conduct a full physical pen test, such as;
- Tailgating
- Covert method of entry techniques
- RFID cloning
- Social engineering
- Theft of access cards/keys
- Gaining legitimate access and then using concealment techniques
The combination of different techniques selected will be based on the client brief and the situation/site.
How Frequently Should Physical Pen Tests Be Performed?
As with all security services, how often a client would like a physical pen test to be performed is based on their organisational risk appetite.
We would recommend that an organisation have a PS pen test performed, specifically after any changes to their access control systems and procedures. If they have made changes to security personnel, had a large turnover of employees, had reports of lost/stolen access cards, have secured new client contracts or are currently going through a procurement process where access controls have been highlighted as very important.
Any Verrimus Physical Penetration Test is always designed in accordance with the client’s risk appetite.
If you’d like to know more about how we perform these types of security assessment, or would like a no obligation quote, please get in touch.
