Unauthorised Access: Physical Penetration Testing For IT Security Teams

Unauthorised Access......Page 5
Contents......Page 9
Preface......Page 13
Acknowledgements......Page 17
Foreword......Page 19
1 The Basics of Physical Penetration Testing......Page 23
Security Testing in the Real World......Page 24
Legal and Procedural Issues......Page 26
Know the Enemy......Page 30
Engaging a Penetration Testing Team......Page 31
Summary......Page 32
2 Planning Your Physical Penetration Tests......Page 33
Building the Operating Team......Page 34
Project Planning and Workflow......Page 37
Codes, Call Signs and Communication......Page 48
Summary......Page 50
3 Executing Tests......Page 51
Common Paradigms for Conducting Tests......Page 52
Conducting Site Exploration......Page 53
Example Tactical Approaches......Page 56
Mechanisms of Physical Security......Page 58
Summary......Page 72
4 An Introduction to Social Engineering Techniques......Page 73
Introduction to Guerilla Psychology......Page 75
Tactical Approaches to Social Engineering......Page 83
Summary......Page 88
5 Lock Picking......Page 89
Lock Picking as a Hobby......Page 90
Introduction to Lock Picking......Page 94
Advanced Techniques......Page 102
Attacking Other Mechanisms......Page 104
Summary......Page 108
6 Information Gathering......Page 111
Dumpster Diving......Page 112
Shoulder Surfing......Page 121
Collecting Photographic Intelligence......Page 124
Finding Information From Public Sources and the Internet......Page 129
Electronic Surveillance......Page 137
Covert Surveillance......Page 139
Summary......Page 141
7 Hacking Wireless Equipment......Page 143
Photography and Surveillance Equipment......Page 179
Wireless Networking Concepts......Page 144
Introduction to Wireless Cryptography......Page 147
Cracking Encryption......Page 153
Attacking a Wireless Client......Page 166
Mounting a Bluetooth Attack......Page 172
Summary......Page 175
The ‘‘Get of Jail Free’’ Card......Page 177
Computer Equipment......Page 181
Wireless Equipment......Page 182
Global Positioning Systems......Page 187
Lock Picking Tools......Page 189
Forensics Equipment......Page 191
Communications Equipment......Page 192
Scanners......Page 193
Summary......Page 197
SCADA Raiders......Page 199
Night Vision......Page 209
Unauthorized Access......Page 219
Summary......Page 226
10 Introducing Security Policy Concepts......Page 229
Physical Security......Page 230
Protectively Marked or Classified GDI Material......Page 235
Protective Markings in the Corporate World......Page 238
Communications Security......Page 240
Staff Background Checks......Page 243
Data Destruction......Page 245
Data Encryption......Page 246
Outsourcing Risks......Page 247
Incident Response Policies......Page 248
Summary......Page 250
11 Counter Intelligence......Page 251
Understanding the Sources of Information Exposure......Page 252
Social Engineering Attacks......Page 257
Protecting Against Electronic Monitoring......Page 261
Securing Refuse......Page 262
Protecting Against Tailgating and Shoulder Surfing......Page 263
Performing Penetration Testing......Page 264
Baseline Physical Security......Page 267
Summary......Page 269
Computer Misuse Act......Page 271
Human Rights Act......Page 273
Regulation of Investigatory Powers Act......Page 274
Data Protection Act......Page 275
Computer Fraud and Abuse Act......Page 277
Electronic Communications Privacy Act......Page 278
SOX and HIPAA......Page 279
European Network and Information Security Agency......Page 283
Data Protection Directive......Page 285
Appendix D: Security Clearances......Page 287
Levels of Clearance in the United Kingdom......Page 288
Levels of Clearance in the United States......Page 290
Certified Information Systems Security Professional......Page 293
Communication–Electronics Security Group CHECK......Page 294
Global Information Assurance Certification......Page 296
INFOSEC Assessment and Evaluation......Page 297
Index......Page 299