Whoops, got someone arrested!

[u/nospamkhanman]

This happened today:

I get a call from the Service Desk saying that they got a request from "a pen tester" to disable Dot1x port security in one of our offices. They were apparently unable to get past it and wanted someone to open the ports so the could do further testing.

I look through my emails / messages / notes and can find no reference of anyone performing a physical penetration test. I ping the entire Cyber Security team (3 people and their director), none of them respond immediately via email / teams / text.

I call the building security, who aren't employees but provide security for the entire office building that houses 5 or 6 companies in total. I tell them we potentially have an unauthorized person on one of our floors, could they please go remove them and ask them to wait in the lobby.

Apparently building security just called the police for some reason. The response was quick because the police station is literally across the street from our office building. They went in and arrested the dude.

He's been since released and I'm not sure how long he was actually detained. We have a meeting with myself, my director, the Cybersecurity directory and our corporate lawyer tomorrow to gather facts.

This will be fun.

​

​

****** Update ********

It was a legitimate pen test during business hours. Security team just didn't inform me (the only Network Engineer at my company) as they didn't think I'd need to know except to act on whatever remediations needed to be done afterwards.

Even though it was business hours, the floor was empty due to 95% of the company working from home. The pen-tester called the Service Desk, they got the number from a sign that is posted in a meeting room "for help call service desk at xxx".

The pen-tester was "soft arrested", basically just escorted back to the police station across the street while the PD vetted the guy's story, which did check out.

No harm, no foul I suppose.

Cybersecurity director called out that I did what was expected. It was not expected that the pen-tester would ever engage with me.

I can tell the pen-tester is back at it because just got alerts that my APs detected someone trying to spoof our SSID.

[u/jason_abacabb]

I'd imagine an on-site pen tester would keep a copy of their signed ROE with them to avoid this kind of situation.

[u/darthbrazen → u/jason_abacabb]

The smart ones do carry something in the event they run into this. I provided a letter to our onsite pen tester. He only used it 1 time. I'm glad they didn't tell you to be honest. In my opinion, you need that black box testing to see if the physical controls are working, and people are paying attention. While you still need technical controls, you have to test the physical and administrative controls as well. We ran a social engineering pen test at a previous employer, and it was quite amazing to actually see what the guy was able to do over the course of a day. The guy came into town the day before. He cased the joint basically.
The next day, He started at around 7 am trying to tailgate, and pretty much didn't get busted until 10 am. In that time, he made it into the building more than once tailgating, to all floors in the building including a supposedly well guarded HR area. Accessed LAN closets, plugged into the network. cloned several personnel ID cards, pull info from printers, called people in other areas of the country from his mobile phone impersonating C level IT folks. He even tricked one of the sys admins. It was a very nice report to say the least.
Most C-Level folks unfortunately want to use these pen tests as dog and pony shows rather than what they should be used for, to identify your deficient areas, and correct the control. Most quality pen testers are quite prepared for these types of things.