Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

When a company asks to test physical/infrastructure security, what are some techniques one could use to test employees?

This could include good excuses to gain access to some hardware/software.

share|improve this question
    
not an answer, but watch Sharon Conheady's DeepSec 2010 talk on social engineering: youtube.com/watch?v=KoEGyXewLmY - she details a lot of techniques she and others use. –  Rory Alsop Aug 16 '12 at 7:36
add comment

1 Answer

up vote 6 down vote accepted

The art of social engineering is all built around trust, so first you need to plan out how you can gain the trust of the target. This is different in every organisation, so unfortunately no-one can really tell you what you should do, but knowing some war stories may help inspire you. I recommend the book 'The Art Of Deception' by Kevin Mitnick as a brilliant source of war stories.

Some common social engineering tactics I personally like are:

  • Dropping USB sticks infront of the lobby to try and entice an employee to use them internally.
  • Creating fake parking tickets, and sticking them on an employees windows with a URL to 'view further information regarding the offence'.
  • Just asking - you will be amazed how many times just asking the right person for information will work.

Regarding physical security, again it is difficult to know what will work best without first having information on the target, sometimes it's possible to just walk right up to the rack and start plugging in cables, other times it takes more planning to explain why you need access to a server room.

One thing that you should be doing when planning your physical security test is researching the environment, do you know anyone in the company? Are you likely to be identified by anyone as a penetration tester? Is there a security desk between you and the server room? How many employees work in the building? Are you likely to be spotted should you sit down next to an employee that you have never met? These kinds of questions should be considered before walking into the building.

Lastly, always be confident in what you are doing, there is nothing more of a giveaway than someone who is stumbling over their words when being questioned about what it is they are doing. Remember that you only get 1 shot at this, so being able to think on your feet will be a huge benefit.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.