Physical assessment

When it applies

The engagement authorizes on-site testing (cleared via social-eng-methodology) with a defined objective — reach a floor/room, plug into the network, or drop test media — to measure physical access controls and staff response. Physical work has the highest real-world risk (police, injury, genuine alarm), so the guardrails are non-negotiable.

Why it works

Physical security leans on people extending courtesy (holding a door), trusting a uniform or a confident manner, and following habit over procedure. A tester with a plausible pretext and a hi-vis vest often walks past controls that are technically sound — the finding is the procedural/behavioral gap, captured with minimum intrusion.

Method

1. Carry authorization. A signed get-out-of-jail letter on you at all times, plus a live emergency contact (client-side) reachable to confirm the test instantly to security or police. No letter → no entry.
2. Objective and stop-line, agreed in writing. Reach the target and prove it (a photo of a defined marker, a benign network beacon) — then stop. No damage, no real data theft, no accessing others' belongings.
3. Recon the site (public, non-intrusive): entry points, badge readers, delivery/smoking doors, shift changes, dress code — enough for a credible pretext.
4. Choose the least-intrusive technique for the objective:
   • Tailgating / pretext entry — follow a group or present as delivery/contractor/new-hire to test door and reception controls.
   • Badge/RFID exposure check — assess whether badges are clonable at a realistic distance and whether readers accept a cloned/observed credential (demonstrate the exposure; don't build a persistent illicit credential).
   • Media drop — leave tracked, benign test USBs/QR flyers to measure plug-in/scan rate; the payload only phones home a token, it does nothing to the host.
5. Prove and withdraw. Capture the agreed proof at the stop-line and leave; do not push further "because it's working".
6. Debrief and restore. Recover any dropped media where feasible, disable beacons, and report.

Gotchas

• Present the letter the instant you're challenged — never bluff past a security guard or police; disclose and let the emergency contact confirm.
• Two-person rule for higher-risk entries where the RoE allows, for safety and witnessing.
• Benign media only — a test USB beacons a token; it must not deploy real malware or alter the host. The metric is "someone plugged it in".
• Respect people and property — no searching desks/bags, no coercion, no entering genuinely restricted safety areas beyond scope.
• Reversible and clean — leave the site as found; account for every dropped item.

Verify success

The agreed proof-of-access (marker photo or benign beacon) or a media-drop plug-in metric, obtained at the stop-line with authorization carried, nothing damaged or taken, and all test artifacts accounted for — feeding a physical-controls report and remediation.

References

MITRE ATT&CK T1091 (Replication Through Removable Media), T1200 (Hardware Additions), T1566.004; standard physical-pentest RoE and safety practice.