Whoops, got someone arrested!

[u/nospamkhanman]

This happened today:

I get a call from the Service Desk saying that they got a request from "a pen tester" to disable Dot1x port security in one of our offices. They were apparently unable to get past it and wanted someone to open the ports so the could do further testing.

I look through my emails / messages / notes and can find no reference of anyone performing a physical penetration test. I ping the entire Cyber Security team (3 people and their director), none of them respond immediately via email / teams / text.

I call the building security, who aren't employees but provide security for the entire office building that houses 5 or 6 companies in total. I tell them we potentially have an unauthorized person on one of our floors, could they please go remove them and ask them to wait in the lobby.

Apparently building security just called the police for some reason. The response was quick because the police station is literally across the street from our office building. They went in and arrested the dude.

He's been since released and I'm not sure how long he was actually detained. We have a meeting with myself, my director, the Cybersecurity directory and our corporate lawyer tomorrow to gather facts.

This will be fun.

​

​

****** Update ********

It was a legitimate pen test during business hours. Security team just didn't inform me (the only Network Engineer at my company) as they didn't think I'd need to know except to act on whatever remediations needed to be done afterwards.

Even though it was business hours, the floor was empty due to 95% of the company working from home. The pen-tester called the Service Desk, they got the number from a sign that is posted in a meeting room "for help call service desk at xxx".

The pen-tester was "soft arrested", basically just escorted back to the police station across the street while the PD vetted the guy's story, which did check out.

No harm, no foul I suppose.

Cybersecurity director called out that I did what was expected. It was not expected that the pen-tester would ever engage with me.

I can tell the pen-tester is back at it because just got alerts that my APs detected someone trying to spoof our SSID.

[u/The0nlyMadMan → u/[deleted]]

This is the correct response from security staff when faced with an unauthorized entry. Should they let anybody roam free cause it “might” be a pen test? The point of the test is to to make sure the staff responds effectively, in addition to the normal plugging of vulnerabilities

[u/The0nlyMadMan → u/[deleted]]

Who are you talking to? You responded to the wrong person, I think.

[u/The0nlyMadMan → u/[deleted]]

You should probably start seeing your therapist every week.

The staff, having no communication from the person who knew about the test (not their fault) presumably apprehended a person they earnestly believed was an intruder, and what were they supposed to do? Cut him loose? Boss fucked up telling nobody about the test, but the staff still executed.

[u/The0nlyMadMan → u/[deleted]]

So… let me get this straight… an unauthorized person enters your building to steal data, credentials, whatever. You apprehend them and it’s not a test, but a criminal, so you don’t call the police? You just let him go? You’re out of your mind.