Sony Pixel Power calrec Sony

The legend of Tom, Dick or Harriet: a tale of physical security and social engineering

25/08/2023

The following is based on real events; names and other details have been changed to maintain confidentiality and protect the innocent.

When anyone mentions cyber security and information security , many of us immediately think of the internet and criminals hacking our networks. We're right to think like this, but we're forgetting something equally as important: physical security, which is just as likely to come under attack. This is where our tricky trio above come in. They're all experienced consultants and regularly test the physical security of clients, while others investigate logical security.

By the time you meet them, they've already done a lot of work: online reconnaissance using the client's website, LinkedIn (and other social media), public company information and a general internet trawl to garner details of directors, staff, offices - including managed buildings, departmental structure, leadership team, current and past projects, clients, supply chain, investors, annual reports, general news and potentially much more. A thorough trawl indeed.

Next step: they'll visit your offices and, without stepping foot inside, check out barriers, receptionists, use of proximity cards, ID badges, specific lanyard colours and designs, public areas, shared office space, all the entrances to the building and who they're used by, contractor access, car parks, where staff go for coffee and lunch, busy and quiet times, windows which give internal views, even down to how you call the lifts and how many staff head to each floor. A long list of things that is certainly not exhaustive. They'll easily be able to identify areas of poor security and the rate at which controls are bypassed, such as tailgating or opening doors for others and not checking identification.

Meet the consultants Let's introduce you to Tom. Tom is a very nice guy, young, keen, always smiling. Tom's target? A small, merchant bank in the city. When he arrives, he's got company ID that looks legitimate, knows where he's going, and looks confident. With his phone to his ear and clutching two laptop bags, he arrives with a group of others and silently indicates his hands are full and if you don't mind opening the door for him ? Tom stands by the lifts still talking on the phone, watching as someone waves their proximity card in front of the screen to call the lift and presses the button for the fifth floor - Tom's destination. He jumps into the lift, still on the phone, and mouths thanks'. Tom knows the fifth floor is where the finance department is (from the reconnaissance phase, remember?), he exits the lift and walks in the opposite direction to the other person. Rounding a corner, he spots a half-empty hot-desking area. Ending his fictitious phone call, he quickly gets a laptop out of one of his bags and sets up. Someone wanders up behind him and says hello. Tom isn't fazed. He turns around, says hi and introduces himself, explaining that he's working on the company's latest marketing campaign and is usually based in the Edinburgh office. They chat some more. His audience is instantly at ease, they're in finance so know nothing about marketing but it's obvious that Tom is genuine, he knows all about the way the bank operates. Tom asks where the finance director's office is as he needs to speak to him later. The office is pointed out to him, and the employee is thanked for their help. After a few minutes, Tom leaves his laptop and goes to the bathroom where he hides until lunch. When he re-emerges, the office is quiet, he picks up his laptop - it was never switched on and contains no data anyway - and walks to the office of the FD. Nobody is around, but the FD's laptop is on the desk. Quickly but confidently Tom picks up the laptop, disconnects the cables, and puts it in his second bag. Ostensibly making arrangements for lunch on his phone he leaves, using the same techniques to get out as he did to get in.

Consultant number two Dick's target is a utility company site. He arrives wearing a hard hat and high vis jacket over a suit, he looks the part and most certainly like he's supposed to be there. If anyone asks, he's here to do an inspection and is usually based at head office, so unfamiliarity with the site is expected. He uses the car park exit, which he knows is not observed, to enter the site. Dick reaches the unmanned reception area but now needs to get through the locked door. Luckily, he spots a worker outside and introduces himself, spinning his prepared story and needs to be let through. He apologises for not having his official photo ID but does have a business card - with the company logo and address - which he presents. They share a laugh when Dick suggests his identity can be confirmed by calling the mobile number on the card and checking if his phone rings. This worker is impressed by Dick's friendliness and air of authority and is only too pleased to let Dick through the door! Once inside, Dick can wander through most of the building, being careful to keep away from areas where senior staff and managers are so he's not questioned. He takes photos of any documentation, internal information and security controls he finds. He also unplugs a USB memory stick from a workstation before exiting the building using another door which opens from the inside and is soon off the site.

and consultant number three Harriet's target is a technology start-up. They're based in a shared office which has very lax security: no IDs are worn, the reception is unmanned, the secure doors are propped open, and everyone inside is so used to strangers passing through they have no problem with opening doors for Harriet - how useful. She's young, vibrant and has a cheery thank-you for everyone as she qu
LINK: https://www.resillion.com/the-legend-of-tom-dick-or-harriet-a-tale-of-...
See more stories from eurofins

Most recent headlines

06/12/2025

L3Harris Chair and CEO Appears on CNBC at Reagan National Defense Forum

In a live broadcast from the Reagan National Defense Forum, L3Harris Chair and CEO Christopher Kubasik joined Morgan Brennan on CNBCs Closing Bell: Overtime. Ku...

06/12/2025

Survey: M&E Embraces Horizontally Integrated Media Archiving Approach

FORT LAUDERDALE, Fla. A new survey from Pixitmedia by Datacore revealed a major shift in the Media & Entertainment industry in media archiving, with 85% of resp...

06/12/2025

Czech TV Deploys LiveU Solutions in 10 OB Vans

HACKENSACK, N.J. LiveU has announced that the national public broadcaster Czech Television has completed one of the largest LiveU live production deployments fo...

06/12/2025

NATAS Celebrates 76th Technology & Engineering Emmy Award Honorees

NEW YORK The National Academy of Television Arts and Sciences (NATAS) presented the Excellence in Production Technology Emmy Award to NASA+ and Dr. Tom Leight...

05/12/2025

2025 Sports Broadcasting Hall of Fame: Curt Gowdy Jr. - Master Storyteller, Nationally and Regionally

2025 Sports Broadcasting Hall of Fame: Curt Gowdy Jr. - Master Storyteller, Nati...

05/12/2025

SVG Sit-Down: Veritone's Sean King on the Power of Mining Video, Audio Data

SVG Sit-Down: Veritone's Sean King on the Power of Mining Video, Audio DataThe company's Data Refinery offers users total control and governance over da...

05/12/2025

Platinum White Paper: Inside the Nashville Predators' Unified, Flexible, Scalable Production System with Ross Video

Platinum White Paper: Inside the Nashville Predators' Unified, Flexible, Sca...

05/12/2025

Netflix Reaches Agreement To Acquire Warner Bros. Following Planned WBD Split

Netflix Reaches Agreement To Acquire Warner Bros. Following Planned WBD SplitThe deal does not include WBDs sports assets like TNT Sports (US, UK, LatAm), Euros...

05/12/2025

FOX Sports Returns to Indianapolis for Primetime Broadcast of Big Ten Championship

FOX Sports Returns to Indianapolis for Primetime Broadcast of Big Ten Championsh...

05/12/2025

SVG Summit 2025 Preview: Digital Engagement & Monetization Workshop Tackles the Future of the Viewer Experience

SVG Summit 2025 Preview: Digital Engagement & Monetization Workshop Tackles the ...

05/12/2025

Atlanta United Lights Up New Emory Healthcare Studio With First Live Broadcast for World Cup Draw

Atlanta United Lights Up New Emory Healthcare Studio With First Live Broadcast f...

05/12/2025

As Messi Takes the Pitch, MLS, Apple, NEP Roll Out Largest MLS Cup Production Ever

As Messi Takes the Pitch, MLS, Apple, NEP Roll Out Largest MLS Cup Production Ev...

05/12/2025

ESPN Enters College Football's Most Intense Month With Elevated Workflows for Championship Week

ESPN Enters College Football's Most Intense Month With Elevated Workflows fo...

05/12/2025

Sorry, Baby, Peter Hujar's Day, Among Sundance Institute-Supported Projects Nominated for 2026 Film Independent Spirit Awards

It's about that time! Awards season is in full swing, and the Film Independe...

05/12/2025

Surprised by Your 2025 Wrapped? Here's a Look at How the Data Comes to Life

Every year, Spotify Wrapped offers a personalized look back at the audio that defined your year. It's a snapshot of your listening habits, designed to tell ...

05/12/2025

Celebrating Spotify's GLOW, RADAR, and EQUAL Artists of 2025

In 2025, Spotify's EQUAL, GLOW, and RADAR programs celebrated women, LGBTQIA , and emerging artists who turned moments into milestones. From breaking record...

05/12/2025

Wi-Fi 7 - Go Beyond Speed to Deliver Security, Trust and Value

In our latest blog, we explain how Wi-Fi 7 rollouts can drive consumer loyalty with value-add services such as consumer cybersecurity. We also explore how this ...

05/12/2025

Netflix to Acquire Warner Bros. in Deal Worth $82.7 Billon

LOS ANGELES Netflix announced it has entered into an agreement to acquire the assets of Warner Bros. for $82.7 billion....

05/12/2025

Gracenote Launches New CTV Ad Platform

NEW YORK Nielsens Gracenote has launched Gracenote Content Connect, a new ad platform that provides agencies, brands, supply-side platforms (SSPs) and demand-si...

05/12/2025

IAB Tech Lab Releases Deals API

NEW YORK In an most important update to the workings of deal-based programmatic advertising, IAB Tech Lab has released version 1.0 of its Deals API for public c...

05/12/2025

Nielsen: NFL Thanksgiving Games Score Big Audiences

NEW YORK Pass the turkey. Pass the stuffing. Pass the cranberry sauce. All are common requests of Americans celebrating Thanksgiving Day with family and f...

05/12/2025

Iris Cloud-Connected Camera Control Platform Now Available

NEW YORK Iris, the new cloud-connected camera control platform, has officially launched with features that turn virtually any PTZ camera into a software-connect...

05/12/2025

Netflix to Acquire Warner Bros. in Deal Worth $82.7B

HOLLYWOOD, Calif. Netflix announced today that it has entered into an agreement to acquire the assets of Warner Bros. for $82.7 billion....

05/12/2025

Iris Cloud-Connected Camera Control Platform Is Now Available

NEW YORK Iris, the new cloud-connected camera control platform, has officially launched with features that turn virtually any PTZ camera into a software-connect...

05/12/2025

FCC Approves AT&T's $1 Billion Acquisition of UScellular Spectrum

WASHINGTON The Federal Communications Commission has approved AT&T's $1.02 billion acquisition of spectrum from UScellular in a decision that was issued sho...

05/12/2025

The Best Coldplay Songs: 21 Tracks That Shoot for the Stars

The Best Coldplay Songs: 21 Tracks That Shoot for the Stars From Yellow to Viva La Vida, Fix You to Paradise, this playlist goes back to the start. December ...

05/12/2025

Zafris Lecture Series Brings Nabil Ayers to Berklee

Zafris Lecture Series Brings Nabil Ayers to Berklee The 32nd annual James G. Zafris Distinguished Lecture series was held on Thursday, November 13, with guest...

05/12/2025

Netflix Unveils the First Look for Land of Sin' - Premiering on January 2, 2026

Back to All News Netflix Unveils the First Look for Land of Sin' - Premier...

05/12/2025

Introducing New Perks to Help You Get Even More from...

Introducing New Perks to Help You Get Even More from LinkedIn Premium Published on Dec 5, 2025 Categories: Company News, Product News LinkedIn Corporate Co...

05/12/2025

A new Game of Thrones Tale: Official trailer for Sky Exclusive series A Knight of the Seven Kingdoms lands today

Friday 5 December 2025 A new Game of Thrones Tale: Official trailer for Sky Exc...

05/12/2025

Don Lee, Lee Jin-uk, and Lalisa Manobal to Star in Netflix Action Thriller 'TYGO'

Back to All News Don Lee, Lee Jin-uk, and Lalisa Manobal to Star in Netflix Act...

05/12/2025

Give Back Fridays with a twist is back for 2025!

Tis the season of giving once again and this year we've taken our Give Back Fridays' concept and turned it on its head. In the autumn we were approach...

05/12/2025

2025-11-06

Brayden Gogis doesn't remember a time when he wasn't completely fixated on games in all forms. In preschool, when they asked us to dress up as what we ...

05/12/2025

The Grinch steals the spotlight as the theme for The Late Late Toy Show 2025

The Grinch steals the spotlight as the theme for The Late Late Toy Show 2025 Tune in tonight at 9:35pm on RT One and worldwide on RT Player #LateLateToyShow...

05/12/2025

RT Announces New Presenters of Flagship News Programmes

RT Announces New Presenters of Flagship News Programmes New RT Six One News co-presenter Tommy Meskill Sarah McInerney & Justin McCarthy join Morning Ir...

04/12/2025

ToolsOnAir Blackmagic Design HyperDeck Event Presets for just:in mac pro 2025 & just:in linux

ToolsOnAir Blackmagic Design HyperDeck Event Presets for just:in mac pro 2025 & ...

04/12/2025

ToolsOnAir AJA Ki Pro Event Presets for just:in mac pro 2025 & just:in linux

ToolsOnAir AJA Ki Pro Event Presets for just:in mac pro 2025 & just:in linux More Details:Starting with version 5.5, both just:in mac pro and just:in linux sol...

04/12/2025

Young Journalist finalists looking to the future

Wangu Kanuri from Kenya and Godwin Asediba from Ghana are two of this years finalists for Thomsons Young Journalist of the Year Award. The pair are runners-up i...

04/12/2025

SVG Sit-Down: ProximaVision's Claudio Lisman on Why Tethered Drones Could Be a Game-Changer for Live Sports Production

SVG Sit-Down: ProximaVision's Claudio Lisman on Why Tethered Drones Could Be...

04/12/2025

SVG Campus Shot Callers: Imry Halevi, Senior Associate Director of Athletics, Content & Strategic Communications, Harvard University

SVG Campus Shot Callers: Imry Halevi, Senior Associate Director of Athletics, Co...

04/12/2025

Platinum White Paper: LiveU Lightweight Sports Production: A Step Change in Sports Storytelling

Platinum White Paper: LiveU Lightweight Sports Production: A Step Change in Spor...

04/12/2025

London to Riyadh: DAZN Brings the Boxing Glamour to New Production Levels for Benavidez v Yarde in Saudi Arabia

London to Riyadh: DAZN brings the boxing glamour to new production levels for Be...

04/12/2025

Analysis: Paramount Bets on the Battering Ram' with Champions League Play

Analysis: Paramount bets on the battering ram' with Champions League play By Callum McCarthy, Editor-at-Large Tuesday, December 2, 2025 - 10:12 Print ...

04/12/2025

Space City Home Network Launches SCHN+ DTC App for Astros and Rockets

Space City Home Network Launches SCHN DTC App for Astros and RocketsThe Rockets and Astros were previously the lone NBA and MLB teams without a DTC appBy Jason...

04/12/2025

SVG Summit 2025 Preview: Content Workflows Workshop Spotlights Evolution of Sports Media Supply Chain

SVG Summit 2025 Preview: Content Workflows Workshop Spotlights Evolution of Spor...

04/12/2025

New Sponsor Spotlight: Geotech's Patrick Wambold On the Unreal Engine Revolution Taking Place in Sports Broadcasting

New Sponsor Spotlight: Geotech's Patrick Wambold On the Unreal Engine Revolu...

04/12/2025

Curt Gowdy Jr. - Master Storyteller, Nationally and Regionally

Curt Gowdy Jr. - Master Storyteller, Nationally and RegionallyBy Jason Dachman, Editorial Director, U.S. Thursday, December 4, 2025 - 1:52 pm Print This Sto...

04/12/2025

Cutting Through Rocks ( ) Shows the Difference That One Person Can Make for Change

(L-R) Rebecca Lichtenfeld, Mohammadreza Eyni, Sara Khaki, and Judith Helfand att...