PROFILING

Physical Security Assessment

Essentials

Physical Security Assessments are a holistic look into the overall physical security of buildings, facilities and locations. SecureState evaluates all the physical security controls in place at locations that are in scope. For example, our staff evaluates access control systems, security guards, CCTV cameras, access badges, locks, security lighting, fences and much more. The Physical Security Assessment is a non-invasive walkthrough assessment that is guided by the client’s security personnel while on-site. A Physical Attack & Penetration is an invasive assessment in which SecureState consultants attempt to “break-in” to the site or facility that is in scope. The Physical Security Assessment is paired perfectly when combined with a Physical Attack & Penetration Test.

Physical Security Assessments review all the physical security controls of a building, facility or location
Profiling Team members have years of experience conducting Physical Security Assessments for large or small companies
Profiling Team members know the latest technology, Physical Security controls and best practices in the Physical Security industry

Benefits

Many organizations never evaluate the physical security controls that are in place at a building or location. Some organizations spend thousands of dollars on physical security controls; but may not have them implemented correctly or according to security best practices. SecureState can determine how easy it might be to circumvent these controls. For example, cameras and alarms may not be in the correct locations and can be easily evaded. SecureState uses a detailed client guided approach to evaluate the available controls and technologies to a company in place for physical security.

Expertise

The SecureState Profiling Team has years of experience in conducting Physical Security Assessments and Physical Attack & Penetration Tests. Many of the Profiling Team members come from a military background and have extensive experience in conducting and building physical security assessment programs for complex organizations. Team members also have professional experience with bypassing locks, alarms and other physical security controls. What makes our Physical Security Assessments so unique is the fact that we’ve exploited many different types of Physical Security controls and know where the vulnerabilities are and how they are implemented. No other security consulting firm can provide this type of expertise.

Get Scoping Questions Now!

Fill in your details and you can download a FREE questionnaire to ask your vendors.

Your Name

Your Phone

Your Email

Your Company

We will not share or distribute your email to anyone. It will be used solely to contact you about the service you have inquired about.

Did You Know?

Physical Security is often overlooked in an organization
Physical Security breaches can have as much as an impact as computer breaches
Physical Security Assessments should be conducted on high value facilities and locations annually; or when significant changes to controls are implemented
Physical Security Assessments should be conducted by qualified personnel with years of experience in the industry

Our Approach and Methodology

The SecureState Profiling Team are well known and highly regarded as experts in Penetration Testing. Our approach follows industry accepted testing methodologies such as PTES, NIST 800-115 and OSSTMM. By following these methodologies, our clients can accurately replicate the testing SecureState has performed in their own environment to accurately mitigate identified vulnerabilities. The SecureState Profiling Team also helps identify strategic “root cause” issues through our Penetration Tests. Our Risk Management Team is uniquely positioned to work closely with the Profiling Team in order to assist clients with mitigating these strategic “root cause” issues.

Phase I – Pre-engagement Interactions:

In this phase, SecureState works with the client to establish the rules of engagement as well as the scope; and exchange contact information for both parties. SecureState provides a detailed Project Charter which contains information on scope and everything that will be required to conduct the testing. The Project Charter is discussed during the kickoff call prior to the beginning of the engagement.

Phase II – Remote Intelligence Gathering:

SecureState begins any Physical Security Assessment remotely by conducting an extensive search of open source intelligence on the target company. This research finds out information regarding the target company from public databases, tax records, job openings, social networks, Internet search engines and much more. Our staff then reviews extensive information about the target locations themselves through the use of online mapping tools; which include satellite imagery and street level views.

Information gathered from this phase is used to determine potential threats to the company and the locations in scope. In addition, this data is used in the report to provide a focused threat assessment specific to the facilities or locations.

Phase III – Guided Walkthrough:

SecureState meets with the client on-site to perform a guided walkthrough of the facility or location. Along with the client, SecureState evaluates all Physical Security controls that are in place. The following controls are evaluated for security best practices and implementation:

Visitor Entry and Verification Procedures
Access Control Systems (including badges)
Security Guards and Guard Rotation
Data Center Specific Controls
Document Destruction
CCTV or other Surveillance Cameras
Alarms
Locks
Physical Key Management
Security Lighting
Fences and Barricades
Safety Systems (fire suppression, backup power)

Phase IV – Vulnerability Analysis:

During the vulnerability analysis phase, SecureState attempts to determine what physical vulnerabilities of the evaluated controls are present. Included in this phase are questions to the client regarding recent physical security incidents as well as security concerns from the client themselves. SecureState uses this information to determine if certain controls need to be improved; or if a new technology can assist with mitigating threat agents identified from Phase I.

Phase V – Reporting:

As part of the deliverable, SecureState provides a report which contains a short graphical summary aimed at senior management, a narrative body which details major findings and a detailed findings section aimed at technical staff. SecureState also provides a closing call and a high level executive presentation to summarize the penetration test; as well as provide an opportunity to ask questions about the engagement.

What Makes Us Different

SecureState has many years of experience conducting Physical Security Assessments
Developed Physical Security Assessment programs for several Fortune 500 Financial Institutions
Highly involved in the local and National Physical Security community through Physical Security organizations such as ASIS International
SecureState Profiling Team Members founded the first local chapter of TOOOL (The Open Organisation Of Lockpickers) in the Cleveland Ohio area
Profiling Team members are frequent speakers at National and world-wide security and hacking conferences such as DEFCON, Black Hat, OWASP AppSec, SANS, ShmooCon, THOTCON, DerbyCon, ToorCon and more
Provides a secure two-factor authentication web portal for access to Penetration Test results
Follows industry standard testing methodologies, vulnerability rating systems and uses real attack data collected by SecureState through years of assessments to compare your company to your industry peers from a security perspective

Related Services

Physical Attack & Penetration

Downloads

Physical Security Assessment

We Can Help You

Generate New Image

Enter the code from above.