Nicolas Aunay
5 min read
While investment companies invest heavily in digital security, our real-world assessments reveal that physical security often lags behind. Drawing from our on-site findings with an investment firm, this blog explores how physical vulnerabilities can pose serious risks. Learn how a comprehensive security approach can protect both people and critical assets.
As investment companies handle sensitive financial data and transactions, ensuring robust physical security is paramount. In response to the growing need for a comprehensive security strategy, this article delves into the findings of a recent penetration test conducted by a team of two pentesters over a span of two days, both day and night. The objective was to assess vulnerabilities related to unauthorized access and potential insider threats. The scenarios explored include opportunistic approaches, emergency door situations, employee access, and the exploitation of cleaning staff and window washer roles.
Opportunist Scenario
Emergency Door
The emergency door was identified as a potential weak point. The team managed to gain access through the emergency exit, emphasizing the necessity of monitoring and securing such exits.
Employee Access
Testing employee access controls revealed a few instances where unauthorized access was granted due to lax badge management and insufficient employee training.
Cleaning Staff and Window Washer
Exploiting the cleaning staff and window washer roles, the penetration testers successfully gained access to restricted areas. The company should enhance vetting procedures for third-party contractors and implement stricter access controls during non-business hours.
The penetration testing results underscore the critical importance of a robust physical security strategy for investment companies. By implementing the recommended measures, these organizations can fortify their defenses against unauthorized access and potential insider threats.
Continuous monitoring, employee training, and stringent access controls are pivotal components of an effective security posture, ensuring the protection of sensitive financial assets and maintaining the trust of clients and stakeholders.
To find out more, take a look at our conference (in French) on physical intrusion:
