Physical Penetration Testing: Objectives, Tactics, Process

A physical penetration test is an authorized, simulated break-in where testers try to get past a facility’s barriers, access controls and staff to reach areas or systems they shouldn’t. It shows whether the controls protecting your buildings hold up against a determined person, not just on paper.

Every physical penetration test is authorized in writing before anyone approaches the site. It’s a separate engagement from social engineering testing, though the two can run in one project, and it’s quoted individually.

Key objectives

• Expose vulnerabilities: Find weak locks, faulty sensors, unmonitored doors and gaps in perimeter controls before a real intruder does.
• Test human behavior: See whether employees challenge strangers, hold doors for people without badges or accept a cover story.
• Bridge to digital networks: Show what an intruder could reach once inside, such as an open network port or an unattended workstation. Pairing the test with an internal penetration test shows how far that foothold reaches.

Common entry tactics and tools

• Tailgating and social engineering: Following an employee through a secured door or posing as a visitor, contractor or delivery person. Remote phishing and vishing fall under social engineering testing.
• Door and lock bypasses: Testing whether doors, locks and exit sensors can be defeated without a key or badge.
• Hardware implants: Where the scope allows it, checking whether a small network device left in an open network port could give an attacker remote access.

The process

1. Pre-engagement: Agreeing on sites, timing and rules of engagement, plus a signed letter of authorization that testers carry on site and the emergency contact list PTES recommends. We sign an NDA before testing and carry professional indemnity insurance.
2. Reconnaissance: Studying building layouts, entrances, staff movement and visible security to plan entry attempts.
3. Execution: Attempting entry within the agreed rules and collecting photo or video evidence of each step. If testers confirm a critical finding, they report it right away to the agreed contact instead of waiting for the final report.
4. Reporting: An Executive Summary for management and a Technical Report with findings, evidence and step-by-step remediation (see this sample penetration test report); a retest is available after fixes.

How physical testing fits with social engineering and red teaming

Physical testing can run in three ways:

• Standalone: One or more sites, with its own authorization and quote.
• Combined with phishing and vishing: In-person, email and phone attempts run together in one project.
• Part of red teaming: Red teaming is an objective-driven attack simulation from $15,000. Physical entry is included only if it’s agreed in the scope, and that part is quoted individually.

Compare red team vs penetration testing, or review the main types of penetration testing.

Sources: PTES Pre-engagement.