Physical penetration tests can help organizations identify weaknesses in physical entry controls, employee awareness, and network access.
Unauthorized access and lax security measures can expose vulnerabilities such as open doors, unattended computers, and unrestricted network ports.
Deep dives
Gaining Unauthorized Access to Buckingham Palace
Michael Fagan, an interior painter, managed to enter Buckingham Palace twice without detection. Fagan climbed over the wall, up a drainpipe, and entered the palace through an open window. He walked around the palace, sat on the throne, and even drank wine from a bottle he found. Fagan's actions highlighted the inadequate security measures in place at the palace.
Summary of Jeremiah Rowe's Penetration Test
Jeremiah Rowe, a solutions architect for Synack, conducted a penetration test on a government contractor's satellite office. He followed a systematic approach, gathering information from Google Maps, conducting surveillance on the building, and exploring alternative entry points. Successfully bypassing key card access and NAC, his team gained physical and network access to the office. They discovered unlocked workstations and exploited a kiosk computer, showcasing vulnerabilities and prompting fixes from the organization.
The Importance of Physical Penetration Testing
Jeremiah Rowe's physical penetration test highlights the need for organizations to comprehensively assess their security measures. By mimicking the actions of potential attackers, such tests can uncover weaknesses in physical entry controls, employee awareness, and network access. Conducting physical red team assessments helps organizations identify and address potential vulnerabilities before malicious actors exploit them.
Lessons from Jeremiah Rowe's Penetration Test
Jeremiah Rowe's successful penetration test emphasizes the significant risks posed by unauthorized access and lax security measures. The test exposed vulnerabilities such as open doors, unattended computers, and unrestricted network ports. Organizations should prioritize employee awareness, physical security measures, and network access control to mitigate potential threats and protect valuable assets.
Jeremiah Roe is a seasoned penetration tester. In this episode he tells us about a time when he had to break into a building to prove it wasn’t as secure as the company thought.
You can catch more of Jeremiah on the We’re In podcast.
Sponsors
Support for this show comes from Axonius. The Axonius solution correlates asset data from your existing IT and security solutions to provide an always up-to-date inventory of all devices, users, cloud instances, and SaaS apps, so you can easily identify coverage gaps and automate response actions. Axonius gives IT and security teams the confidence to control complexity by mitigating threats, navigating risk, decreasing incidents, and informing business-level strategy — all while eliminating manual, repetitive tasks. Visit axonius.com/darknet to learn more and try it free.
Support for this show comes from Snyk. Snyk is a developer security platform that helps you secure your applications from the start. It automatically scans your code, dependencies, containers, and cloud infrastructure configs — finding and fixing vulnerabilities in real time. Create your free account at snyk.co/darknet.
Get the Snipd podcast app
Unlock the knowledge in podcasts with the podcast player of the future.
AI-powered podcast player
Listen to all your favourite podcasts with AI-powered features
Discover highlights
Listen to the best highlights from the podcasts you love and dive into the full episode
Save any moment
Hear something you like? Tap your headphones to save it with AI-generated key takeaways
Share & Export
Send highlights to Twitter, WhatsApp or export them to Notion, Readwise & more
AI-powered podcast player
Listen to all your favourite podcasts with AI-powered features
Discover highlights
Listen to the best highlights from the podcasts you love and dive into the full episode