i was that guy that walked around aimlessly in your facility, accessing things i shouldn’t, and making your security look quite foolish in the process.

// art of the larp >

i was tasked to conduct my first physical security audit at a location out in houston earlier this week. i always imagined it would be a fun challenge to try gaining unauthorized access to a building while pretending to be a contractor, but i honestly didn’t think i would be this good at it. or, perhaps, it was just that this company is thoroughly lacking in effectively training their employees to recognize potential risks.

whatever the case may be, i was able to move freely through the building without anyone asking me who i was or what i was doing there–initially, at least.

i dressed the part; blue jeans, button down short sleeve, pants tucked into some construction boots, hat and sunglasses, and carried around a multimeter and network tone-and-probe while periodically making it beep to make it sound like i was doing something important. when i arrived on site, i cased the outside briefly, but quickly noticed that the entrance was too close to the secondary, authorized-personnel entrance, which made it seem like it could be difficult to get in at first.

i encountered two employees outside and made some quick small talk before heading for the employee-only entrance, but two additional employees came out of the main entrance ahead of me. i followed behind them, tools in hand, and they were kind enough to hold the door for me without asking any questions.

once inside, i produced my phone to start taking pictures. i did a lap around the inside of the building, capturing stills of different locations, unlocked devices, and other sensitive areas. it wasn’t until i arrived at the entrance to the breakroom that i was stopped and questioned. i had given myself away by snapping pictures of a latop that was in front of several people, one of which happened to be the facilities manager. the facilities manager approached and asked what i was doing and which company i was with. i made up a random company name, point of contact, and said i was on site to check out a leak. he asked me to wait while he confirmed this, but i told him i needed a drink of water, so he asked me to wait in the breakroom where i could get some water. this was a huge mistake on his part.

as soon as he let me go, i kept moving to the other side of the building where i encountered my boss (one of the few people who knew what i was doing), where she took me to her office to update her on what i had done so far. she was quite amuzed by everything and we could hear the facilities manager outside yelling about a contractor that pissed him off. my boss decided to let him in on it and brought him to me to make the introduction. he was clearly still pissed off, despite now knowing that i wasn’t a contractor.

at any rate, my boss told me to continue with the rest of the facility to see if anyone else would stop me. i continued my adventure, even going so far as to recruit a lady to give me a tour and unlock areas that i should not have had access to without so much as providing my name. every time i spotted the facilities manager, i made sure to shoot him a big smile and wave to rub it in further.

it is clear to my boss, and our compliance team, that physical security is almost non-existent at this facility.

it was a fun experience overall, but i was definitely nervous at the start.

// eof >

not sure how often i will get opportunities like this, especially now that a good number of people have seen my face, but it was interesting to say the least.

people underestimate the importance of physical security. hopefully this will open their eyes to keep all employees informed and prepared for these types of situations.

oh, and i didn’t have a category prepared for this, so i’m just posting it as an update.

• an0malous