Unauthorised Access: Physical Penetration Testing For IT Security Teams

In this book Wil Allsopp has created a thorough reference for those looking to advance into the area of physical penetration testing. The book also serves as a guidebook for in–house security managers seeking to institute better policy safeguards.” – From the Foreword, by Kevin Mitnick
Most IT security teams concentrate on keeping networks and systems safe from the outside – usually with the entire focus on firewalls, server configuration, application security, intrusion detection systems, and the like. But what if your attacker was on the inside? What if they were sitting at an employee’s computer, or placing a wireless access point hidden in a wiring closet or even roaming inside your server room?
Unauthorised Access provides the first guide to planning and performing physical penetration tests. Inside, IT security expert Wil Allsopp guides you through the entire process from gathering intelligence, getting inside, dealing with threats, staying hidden (often in plain sight) and getting access to networks and data. Learn to think like an attacker with topics that include:Types of target vs level of anticipated response Dealing with guards Intelligence tradecraft, satellite imagery and in depth information gathering Planting bugs and covert wireless access points Hacking security cameras Strategic, tactical and operational planning Defeating locks, electronic keypads and other electronic access systems Social engineering – the weakest link Using your “Get Out of Jail Free” card Complying with local laws Attacking wireless networks

Spis treści:
Preface.
Acknowledgements.
Foreword.
1 The Basics of Physical Penetration Testing.
What Do Penetration Testers Do?
Security Testing in the Real World.
Legal and Procedural Issues.
Know th e Enemy.
Engaging a Penetration Testing Team.
Summary.
2 Planning Your Physical Penetration Tests.
Building the Operating Team.
Project Planning and Workflow.
Codes, Call Signs and Communication.
Summary.
3 Executing Tests.
Common Paradigms for Conducting Tests.
Conducting Site Exploration.
Example Tactical Approaches.
Mechanisms of Physical Security.
Summary.
4 An Introduction to Social Engineering Techniques.
Introduction to Guerilla Psychology.
Tactical Approaches to Social Engineering.
Summary.
5 Lock Picking.
Lock Picking as a Hobby.
Introduction to Lock Picking.
Advanced Techniques.
Attacking Other Mechanisms.
Summary.
6 Information Gathering.
Dumpster Diving.
Shoulder Surfing.
Collecting Photographic Intelligence.
Finding Information From Public Sources and the Internet.
Electronic Surveillance.
Covert Surveillance.
Summary.
7 Hacking Wireless Equipment.
Wireless Networking Concepts.
Introduction to Wireless Cryptography.
Cracking Encryption.
Attacking a Wireless Client.
Mounting a Bluetooth Attack.
Summary.
8 Gathering the Right Equipment.
The ‘‘Get of Jail Free’’ Card.
Photography and Surveillance Equipment.
Computer Equipment.
Wireless Equipment.
Global Positioning Systems.
Lock Picking Tools.
Forensics Equipment.
Communications Equipment.
Scanners.
Summary.
9 Tales from the Front Line.
SCADA Raiders.
Night Vision.
Unauthorized Access.
Summary.
10 Introducing Security Policy Concepts.
Physical Security.
Protectively Marked or Classified GDI Material.
Protective Markings in the Corporate World.
Communications Security.
Staff Background Checks.
Data Destruction.
Data Encryption.
Outsourcing Risks.
Incident Response Policies.
Summary.
11 Counter Intelligence.
Understan ding the Sources of Information Exposure.
Social Engineering Attacks.
Protecting Against Electronic Monitoring.
Securing Refuse.
Protecting Against Tailgating and Shoulder Surfing.
Performing Penetration Testing.
Baseline Physical Security.
Summary.
Appendix A: UK Law.
Computer Misuse Act.
Human Rights Act.
Regulation of Investigatory Powers Act.
Data Protection Act.
Appendix B: US Law.
Computer Fraud and Abuse Act.
Electronic Communications Privacy Act.
SOX and HIPAA.
Appendix C: EU Law.
European Network and Information Security Agency.
Data Protection Directive.
Appendix D: Security Clearances.
Clearance Procedures in the United Kingdom.
Levels of Clearance in the United Kingdom.
Levels of Clearance in the United States.
Appendix E: Security Accreditations.
Certified Information Systems Security Professional.
Communication–Electronics Security Group CHECK.
Global Information Assurance Certification.
INFOSEC Assessment and Evaluation.
Index.

Okładka tylna:
In this book Wil Allsopp has created a thorough reference for those looking to advance into the area of physical penetration testing. The book also serves as a guidebook for in–house security managers seeking to institute better policy safeguards.” – From the Foreword, by Kevin Mitnick
Most IT security teams concentrate on keeping networks and systems safe from the outside – usually with the entire focus on firewalls, server configuration, application security, intrusion detection systems, and the like. But what if your attacker was on the inside? What if they were sitting at an employee’s computer, or placing a wireless access point hidden in a wiring closet or even roaming inside your server room?
Unauthorised Access provides the first guide to planning and performing physical penetration tests. Inside, IT security expert Wil Allsopp guides you through the entire process from gathering intelligence, getting inside, dealing with threats, staying hidden (often in plain sight) and getting access to networks and data. Learn to think like an attacker with topics that include:Types of target vs level of anticipated response Dealing with guards Intelligence tradecraft, satellite imagery and in depth information gathering Planting bugs and covert wireless access points Hacking security cameras Strategic, tactical and operational planning Defeating locks, electronic keypads and other electronic access systems Social engineering – the weakest link Using your “Get Out of Jail Free” card Complying with local laws Attacking wireless networks