12 ms·

Problem #0: Security did not search his bag on entry, thus allowing him to bring rapelling equipment to a software sales meeting. Problem #4: Security has inad

Problem #0: Security did not search his bag on entry, thus allowing him to bring rapelling equipment to a software sales meeting. Problem #4: Security has inadequate visitor monitoring procedures, thus permitting a visitor who required escort to hide inside the building. No, I am not confusing this with #3; his escorts not bringing him to the front desk or whomever is (or should be) logging visitor arrivals to log his departure.

Crito 12y ago
> "Problem #0: Security did not search his bag on entry, thus allowing him to bring rapelling equipment to a software sales meeting." Realistically, what sort of security guard would actually stop him when they found the climbing gear? Unless they receive some special training, they'd be looking for weapons. The climbing gear would probably raise their eyebrows, but could easily be explained away ("I'm going to my climbing gym later this evening"). Relying on security guards to consider the possibility that their guest might be planning on repelling from the roof down into a secured floor doesn't seem practical.
- ecnahc515 12y ago
  Even that could be accounted for. If you have 'questionable' items, security could ask that you leave them at the front desk, and you can pick them up on your way out.
  - toomuchtodo 12y ago
    I'd deliver that gear to the roof by quadcopter the night before.
    - cobrabyte 12y ago
      Simple solution to a simple problem.
    - ZoF 12y ago
      Problem #5
  - Crito 12y ago
    At this point they'd have to start worrying about bulky clothing as well. It was hot outside in this instance, but in cooler weather/climates you'd need to go full TSA-mode on everybody entering the building. That's practical for some installations, but not many.
- ChuckMcM 12y ago
  The security guards were brutal at Intel in the 80's. You had to sign a waiver that gave Intel permission to keep anything you were carrying on your way out. They did it too (confiscate things they felt shouldn't leave the building). Most people were smart and just left everything at the desk. That said, these days with phones and laptops being nearly attached to the wrists of folks it would be a very hard policy to enforce. Google's solution was conference rooms that were outside the security perimeter and had bathrooms outside the security perimeter as well. That worked pretty well and would have defeated this particular attack.
  - vonmoltke 12y ago
    I lived in a different world for so long that my default behavior is to make sure my phone and laptop are in my car when I go into someone's building. Larger defense contractor facilities have those types of conference rooms as well.
electromagnetic 12y ago
Speaking as a construction worker, you'd be quite surprised how easy it is to get into places you generally shouldn't with no one asking questions. I don't wear a company uniform and I've gotten onto the roofs of buildings I really shouldn't have, including when I've been sent to the wrong address and I talked to everyone from the property manager to the building owner and everyone helped me. You'd also be surprised how easily security can be fobbed off by telling them something they've heard a few dozen times before. You can go to any uniform supply store and pick up some coveralls for a fake company. You would be able to walk into any commercial building with any equipment you want, and excuse it all off with knowing who the property management company is. If anyone asks too many questions you just say "I don't know, I just go where I'm told" and if you're getting nowhere you can get out of dodge by saying "Let me just call the office, make sure they didn't give me the wrong address." Your #4 assumes he'd be logged coming and going, which in my experience isn't true for construction workers. Also hiding inside the building isn't necessary. He knew his methodology for getting into the place, which meant accessing the roof. Security wouldn't check the roof once the electrical contact shows the door or hatch is closed. The weakest link in security is human nature. Build me the most complicated lock in the world, and it's only valuable if people remember to lock it and you can't get them to unlock it for you.
- RankingMember 12y ago
  Reminds me of this (artist undertook "Guerrilla Public Service", donning CalTrans worker garb and modifying a highway sign to be more helpful to motorists): http://www.laweekly.com/2009-12-31/la-life/richard-ankrom-s-freeway-art-caltrans-buys-into-the-prank/ http://www.laweekly.com/2009-12-31/la-life/richard-ankrom-s-... "The sign was so authentic that Caltrans officials let it remain in place for eight years, four months and 15 days, until its removal last month under a standard scheduled replacement. "
- vonmoltke 12y ago
  > Speaking as a construction worker, you'd be quite surprised how easy it is to get into places you generally shouldn't with no one asking questions. No, in general I'm not. At a place where the mere location of the main server room is confidential information, though, I would be very surprised. > Your #4 assumes he'd be logged coming and going, which in my experience isn't true for construction workers. It was true of every defense contractor facility I have ever been to. > Also hiding inside the building isn't necessary. He knew his methodology for getting into the place, which meant accessing the roof. Security wouldn't check the roof once the electrical contact shows the door or hatch is closed. Well, I was counting on the roof as inside the building; I wasn't clear on that. Still, security should have known the door had been opened at some point, and done due diligence with facilities to find out if there was a reason > The weakest link in security is human nature. Build me the most complicated lock in the world, and it's only valuable if people remember to lock it and you can't get them to unlock it for you. Absolutely correct, which is why training and awareness are the most important features of an effective physical security plan.[1] Basically, I keyed off the author's statement that this client has security and started thinking, WWDSSD[2]? The items I mentioned in my original post are items I would flag if I were inspecting a facility, in addition to what the author mentioned. [1] Shit, I'm starting to sound like a fucking DSS training pamphlet. [2] What Would the Defense Security Service Do
IgorPartola 12y ago
My dad used to work at a classified facility in the USSR that dealt with satellites. Naturally, they had pretty strict security for things going in and out. At the same time, they had ridiculous amounts of overstocked construction materials. My dad's friend told me a story once about how he and my dad got a bundle of copper piping out of there in front of the security guards. The two of them grabbed the bundle of pipes, and carried it to the front door, then put it right outside of the front entrance to the main building and pointed it at the gate, which was about 40 meters away. They then flipped it over at the far point, and counted "one!". Then again: "two!". And so on. This way they got to the gate, and then simply continued across the street, continuing to count. According to the different versions of the story (it's been told more than once), they either acknowledged the guards, or pretended to be super concerned with the counting. In either case, the piping went into the walls of my dad's friend's apartment shortly after and been there ever since. P.S.: Apparently, one of the people in their group also managed to sneak out a power drill (not as common back then), by tying it between his legs in a pair of large pants.

Crito 12y ago

> "Problem #0: Security did not search his bag on entry, thus allowing him to bring rapelling equipment to a software sales meeting." Realistically, what sort of security guard would actually stop him when they found the climbing gear? Unless they receive some special training, they'd be looking for weapons. The climbing gear would probably raise their eyebrows, but could easily be explained away ("I'm going to my climbing gym later this evening"). Relying on security guards to consider the possibility that their guest might be planning on repelling from the roof down into a secured floor doesn't seem practical.

ecnahc515 12y ago
Even that could be accounted for. If you have 'questionable' items, security could ask that you leave them at the front desk, and you can pick them up on your way out.
- toomuchtodo 12y ago
  I'd deliver that gear to the roof by quadcopter the night before.
  - cobrabyte 12y ago
    Simple solution to a simple problem.
  - ZoF 12y ago
    Problem #5
- Crito 12y ago
  At this point they'd have to start worrying about bulky clothing as well. It was hot outside in this instance, but in cooler weather/climates you'd need to go full TSA-mode on everybody entering the building. That's practical for some installations, but not many.
ChuckMcM 12y ago
The security guards were brutal at Intel in the 80's. You had to sign a waiver that gave Intel permission to keep anything you were carrying on your way out. They did it too (confiscate things they felt shouldn't leave the building). Most people were smart and just left everything at the desk. That said, these days with phones and laptops being nearly attached to the wrists of folks it would be a very hard policy to enforce. Google's solution was conference rooms that were outside the security perimeter and had bathrooms outside the security perimeter as well. That worked pretty well and would have defeated this particular attack.
- vonmoltke 12y ago
  I lived in a different world for so long that my default behavior is to make sure my phone and laptop are in my car when I go into someone's building. Larger defense contractor facilities have those types of conference rooms as well.

electromagnetic 12y ago

Speaking as a construction worker, you'd be quite surprised how easy it is to get into places you generally shouldn't with no one asking questions. I don't wear a company uniform and I've gotten onto the roofs of buildings I really shouldn't have, including when I've been sent to the wrong address and I talked to everyone from the property manager to the building owner and everyone helped me. You'd also be surprised how easily security can be fobbed off by telling them something they've heard a few dozen times before. You can go to any uniform supply store and pick up some coveralls for a fake company. You would be able to walk into any commercial building with any equipment you want, and excuse it all off with knowing who the property management company is. If anyone asks too many questions you just say "I don't know, I just go where I'm told" and if you're getting nowhere you can get out of dodge by saying "Let me just call the office, make sure they didn't give me the wrong address." Your #4 assumes he'd be logged coming and going, which in my experience isn't true for construction workers. Also hiding inside the building isn't necessary. He knew his methodology for getting into the place, which meant accessing the roof. Security wouldn't check the roof once the electrical contact shows the door or hatch is closed. The weakest link in security is human nature. Build me the most complicated lock in the world, and it's only valuable if people remember to lock it and you can't get them to unlock it for you.

RankingMember 12y ago
Reminds me of this (artist undertook "Guerrilla Public Service", donning CalTrans worker garb and modifying a highway sign to be more helpful to motorists): http://www.laweekly.com/2009-12-31/la-life/richard-ankrom-s-freeway-art-caltrans-buys-into-the-prank/ http://www.laweekly.com/2009-12-31/la-life/richard-ankrom-s-... "The sign was so authentic that Caltrans officials let it remain in place for eight years, four months and 15 days, until its removal last month under a standard scheduled replacement. "
vonmoltke 12y ago
> Speaking as a construction worker, you'd be quite surprised how easy it is to get into places you generally shouldn't with no one asking questions. No, in general I'm not. At a place where the mere location of the main server room is confidential information, though, I would be very surprised. > Your #4 assumes he'd be logged coming and going, which in my experience isn't true for construction workers. It was true of every defense contractor facility I have ever been to. > Also hiding inside the building isn't necessary. He knew his methodology for getting into the place, which meant accessing the roof. Security wouldn't check the roof once the electrical contact shows the door or hatch is closed. Well, I was counting on the roof as inside the building; I wasn't clear on that. Still, security should have known the door had been opened at some point, and done due diligence with facilities to find out if there was a reason > The weakest link in security is human nature. Build me the most complicated lock in the world, and it's only valuable if people remember to lock it and you can't get them to unlock it for you. Absolutely correct, which is why training and awareness are the most important features of an effective physical security plan.[1] Basically, I keyed off the author's statement that this client has security and started thinking, WWDSSD[2]? The items I mentioned in my original post are items I would flag if I were inspecting a facility, in addition to what the author mentioned. [1] Shit, I'm starting to sound like a fucking DSS training pamphlet. [2] What Would the Defense Security Service Do

IgorPartola 12y ago

My dad used to work at a classified facility in the USSR that dealt with satellites. Naturally, they had pretty strict security for things going in and out. At the same time, they had ridiculous amounts of overstocked construction materials. My dad's friend told me a story once about how he and my dad got a bundle of copper piping out of there in front of the security guards. The two of them grabbed the bundle of pipes, and carried it to the front door, then put it right outside of the front entrance to the main building and pointed it at the gate, which was about 40 meters away. They then flipped it over at the far point, and counted "one!". Then again: "two!". And so on. This way they got to the gate, and then simply continued across the street, continuing to count. According to the different versions of the story (it's been told more than once), they either acknowledged the guards, or pretended to be super concerned with the counting. In either case, the piping went into the walls of my dad's friend's apartment shortly after and been there ever since. P.S.: Apparently, one of the people in their group also managed to sneak out a power drill (not as common back then), by tying it between his legs in a pair of large pants.