Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

When pentesting a network, should a pentester consider physical access to devices (e.g. allow use of a USB stick)? Or is this out of scope?

share|improve this question
add comment

3 Answers

up vote 4 down vote accepted

Since Pentesting is a broad term, it covers a lot of fields, web applications, source code review, network penetration testing...

Physical penetration testing is one branch which can also belong to the pentesters tasks. This can go from checking what type of protection the client uses to secure his data, to actual physical pentesting (trying to break into clients premises and see what confidential info you would be able to steal). I've also done data center reviews (which can be seen more as audit sometimes as it involves checking up by asking question rather than actually testing (you're not going to start an actual fire to see if the fire detection works obviously))

share|improve this answer
add comment

Although some companies specialize in physical penetration testing, many IT penetration testing companies include physical testing in their services. This is because breaching a physical brier would allow the pentester access to a more privileged environment. A physical security company might test the strength of your locks and security guards but they don't test how physical access can can translate into IT risk.

Some companies have emerged helping IT pentesters to move into the physical space. An example is this line of products http://pwnieexpress.com/products/pwnplug-elite. A pentester can walk into a company as a guest and plug the pwnie express in their internal network, then access it remotely via WIFI or GSM.

So physical pentesting depends on whether the company providing pentesting can offer this service and whether the party requesting the pentest agrees on "physical" being in the scope of the pentest.

share|improve this answer
add comment

As a pentester you're likely to have access to sensitive information for your clients (e.g. details of security vulnerabilities), so your customers would expect you to take good care of that information and keep it secure.

In this example I'd say that pentesters should keep all data encrypted whenever it's on a mobile device (e.g. laptop, tablet, USB key), as there's always the risk that it'll be lost or stolen.

On top of the security considerations the contract between the customer and the pentest company is likely to specify requirements for data security, also depending on whether the data contains personally identifiable information, then there may be data protection legislation to consider.

So all in all that would be a yes :)

share|improve this answer
3  
If I am reading the question right, this doesn't exactly answer it. I think the asker is asking if physical security is part of a penetration testing job, which is covered by @Lucas's answer. –  Terry Chia Jan 1 '13 at 13:19
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.