2KKUU7ita

84
Part II: Putting Ethical Hacking in Motion
Pinpointing Physical Vulnerabilities
in Your Office
Many potential physical security exploits seem unlikely, but they can occur
to organizations that don’t take physical security seriously. The bad guys
can exploit many physical security vulnerabilities, including weaknesses in a
building’s infrastructure, office layout, computer-room access, and design. In
addition to these factors, consider the facility’s proximity to local emergency
assistance (police, fire, and ambulance) and the area’s crime statistics (burglary,
breaking and entering, and so on) so you can better understand what
you’re up against.
Look for the vulnerabilities discussed in the following sections when assessing
your organization’s physical security. This won’t take a lot of technical
savvy or expensive equipment. Depending on the size of your facilities,
these tests shouldn’t take much time either. The bottom line is to determine
whether the physical security controls are adequate given what’s at stake.
Above all, be practical and use common sense.
Building infrastructure
Doors, windows, and walls are critical components of a building — especially
for a computer room or an area where confidential information is stored.
Attack points
Hackers can exploit a handful of building infrastructure vulnerabilities.
Consider the following commonly overlooked attack points:
✓ Are doors propped open? If so, why?
✓ Can gaps at the bottom of critical doors allow someone using a balloon
or other device to trip a sensor on the inside of a “secure” room?
✓ Would it be easy to force doors open? A simple kick near the doorknob
is usually enough for standard doors.
✓ What is the building or data center made of (steel, wood, concrete), and
how sturdy are the walls and entryways? How resilient is the material to
earthquakes, tornadoes, strong winds, heavy rains, and vehicles driving
into the building? Would these disasters leave the building exposed so
that looters and others with malicious intent could gain access to the
computer room or other critical areas?
✓ Are any doors or windows made of glass? Is this glass clear? Is the glass
shatterproof or bulletproof?