Let's Get Physical

A first-hand account of a physical penetration test at a multi-building corporate campus. The tester and a colleague spent five days testing physical security by tailgating through doors, stealing a shredding bin containing sensitive documents (payroll, employee data), picking a lock to access the CEO's office and planting a business card, and attempting to breach a server room. Despite being on camera repeatedly and behaving suspiciously, security guards never intervened. The only person who stopped them was a cleaning lady who refused to open the server room door. The post highlights how human complacency, unlocked doors, weak locks on secure bins, and lack of security awareness create massive physical security gaps even when IT security is strong.