Unauthorised Access - Physical Penetration Testing for It Security Teams

Informationen zum Autor Wil Allsopp (Netherlands) is an IT security expert who has provided security audits for some of the largest companies in the UK including top tier banking, government and most of the Fortune 100. His job requires him to be part hacker, and part thief as companies hire him to probe their security measures to the extreme. Klappentext The first guide to planning and performing a physical penetration test on your computer's securityMost IT security teams concentrate on keeping networks and systems safe from attacks from the outside-but what if your attacker was on the inside? While nearly all IT teams perform a variety of network and application penetration testing procedures, an audit and test of the physical location has not been as prevalent. IT teams are now increasingly requesting physical penetration tests, but there is little available in terms of training. The goal of the test is to demonstrate any deficiencies in operating procedures concerning physical security.Featuring a Foreword written by world-renowned hacker Kevin D. Mitnick and lead author of The Art of Intrusion and The Art of Deception, this book is the first guide to planning and performing a physical penetration test. Inside, IT security expert Wil Allsopp guides you through the entire process from gathering intelligence, getting inside, dealing with threats, staying hidden (often in plain sight), and getting access to networks and data.* Teaches IT security teams how to break into their own facility in order to defend against such attacks, which is often overlooked by IT security teams but is of critical importance* Deals with intelligence gathering, such as getting access building blueprints and satellite imagery, hacking security cameras, planting bugs, and eavesdropping on security channels* Includes safeguards for consultants paid to probe facilities unbeknown to staff* Covers preparing the report and presenting it to managementIn order to defend data, you need to think like a thief-let Unauthorised Access show you how to get inside. Zusammenfassung A guide to planning and performing a physical penetration test on your computer's security. It guides you through the entire process from gathering intelligence, getting inside, dealing with threats, staying hidden (often in plain sight), and getting access to networks and data. Inhaltsverzeichnis Preface xi Acknowledgements xv Foreword xvii 1 The Basics of Physical Penetration Testing 1 What Do Penetration Testers Do? 2 Security Testing in the Real World 2 Legal and Procedural Issues 4 Know the Enemy 8 Engaging a Penetration Testing Team 9 Summary 10 2 Planning Your Physical Penetration Tests 11 Building the Operating Team 12 Project Planning and Workflow 15 Codes, Call Signs and Communication 26 Summary 28 3 Executing Tests 29 Common Paradigms for Conducting Tests 30 Conducting Site Exploration 31 Example Tactical Approaches 34 Mechanisms of Physical Security 36 Summary 50 4 An Introduction to Social Engineering Techniques 51 Introduction to Guerilla Psychology 53 Tactical Approaches to Social Engineering 61 Summary 66 5 Lock Picking 67 Lock Picking as a Hobby 68 Introduction to Lock Picking 72 Advanced Techniques 80 Attacking Other Mechanisms 82 Summary 86 6 Information Gathering 89 Dumpster Diving 90 Shoulder Surfing 99 Collecting Photographic Intelligence 102 Finding Information From Public Sources and the Internet 107 Electronic Surveillance 115 Covert Surveillance 117 Summary 119 7 Hacking Wireless Equipment 121 Wireless Networking Concepts 122 Introduction to Wireless Cryptography 125 Cr...

List of contents

Preface.
 
Acknowledgements.
 
Foreword.
 
1 The Basics of Physical Penetration Testing.
 
What Do Penetration Testers Do?
 
Security Testing in the Real World.
 
Legal and Procedural Issues.
 
Know the Enemy.
 
Engaging a Penetration Testing Team.
 
Summary.
 
2 Planning Your Physical Penetration Tests.
 
Building the Operating Team.
 
Project Planning and Workflow.
 
Codes, Call Signs and Communication.
 
Summary.
 
3 Executing Tests.
 
Common Paradigms for Conducting Tests.
 
Conducting Site Exploration.
 
Example Tactical Approaches.
 
Mechanisms of Physical Security.
 
Summary.
 
4 An Introduction to Social Engineering Techniques.
 
Introduction to Guerilla Psychology.
 
Tactical Approaches to Social Engineering.
 
Summary.
 
5 Lock Picking.
 
Lock Picking as a Hobby.
 
Introduction to Lock Picking.
 
Advanced Techniques.
 
Attacking Other Mechanisms.
 
Summary.
 
6 Information Gathering.
 
Dumpster Diving.
 
Shoulder Surfing.
 
Collecting Photographic Intelligence.
 
Finding Information From Public Sources and the Internet.
 
Electronic Surveillance.
 
Covert Surveillance.
 
Summary.
 
7 Hacking Wireless Equipment.
 
Wireless Networking Concepts.
 
Introduction to Wireless Cryptography.
 
Cracking Encryption.
 
Attacking a Wireless Client.
 
Mounting a Bluetooth Attack.
 
Summary.
 
8 Gathering the Right Equipment.
 
The ''Get of Jail Free'' Card.
 
Photography and Surveillance Equipment.
 
Computer Equipment.
 
Wireless Equipment.
 
Global Positioning Systems.
 
Lock Picking Tools.
 
Forensics Equipment.
 
Communications Equipment.
 
Scanners.
 
Summary.
 
9 Tales from the Front Line.
 
SCADA Raiders.
 
Night Vision.
 
Unauthorized Access.
 
Summary.
 
10 Introducing Security Policy Concepts.
 
Physical Security.
 
Protectively Marked or Classified GDI Material.
 
Protective Markings in the Corporate World.
 
Communications Security.
 
Staff Background Checks.
 
Data Destruction.
 
Data Encryption.
 
Outsourcing Risks.
 
Incident Response Policies.
 
Summary.
 
11 Counter Intelligence.
 
Understanding the Sources of Information Exposure.
 
Social Engineering Attacks.
 
Protecting Against Electronic Monitoring.
 
Securing Refuse.
 
Protecting Against Tailgating and Shoulder Surfing.
 
Performing Penetration Testing.
 
Baseline Physical Security.
 
Summary.
 
Appendix A: UK Law.
 
Computer Misuse Act.
 
Human Rights Act.
 
Regulation of Investigatory Powers Act.
 
Data Protection Act.
 
Appendix B: US Law.
 
Computer Fraud and Abuse Act.
 
Electronic Communications Privacy Act.
 
SOX and HIPAA.
 
Appendix C: EU Law.
 
European Network and Information Security Agency.
 
Data Protection Directive.
 
Appendix D: Security Clearances.
 
Clearance Procedures in the United Kingdom.
 
Levels of Clearance in the United Kingdom.
 
Levels of Clearance in the United States.
 
Appendix E: Security Accreditations.
 
Certified Information Systems Security Professional.

Product details

• Authors: Wil Allsopp, Allsopp Wil
• Publisher: Wiley, John and Sons Ltd
• Languages: English
• Product format: Paperback / Softback
• Released: 07.08.2009
• EAN: 9780470747612
• ISBN: 978-0-470-74761-2
• No. of pages: 302
• Subjects: Natural sciences, medicine, IT, technology > IT, data processing > Data communication, networks; Informatik, Netzwerksicherheit, computer science, Networking / Security, Netzwerke / Sicherheit