Sony Pixel Power calrec Sony

The legend of Tom, Dick or Harriet: a tale of physical security and social engineering

25/08/2023

The following is based on real events; names and other details have been changed to maintain confidentiality and protect the innocent.

When anyone mentions cyber security and information security , many of us immediately think of the internet and criminals hacking our networks. We're right to think like this, but we're forgetting something equally as important: physical security, which is just as likely to come under attack. This is where our tricky trio above come in. They're all experienced consultants and regularly test the physical security of clients, while others investigate logical security.

By the time you meet them, they've already done a lot of work: online reconnaissance using the client's website, LinkedIn (and other social media), public company information and a general internet trawl to garner details of directors, staff, offices - including managed buildings, departmental structure, leadership team, current and past projects, clients, supply chain, investors, annual reports, general news and potentially much more. A thorough trawl indeed.

Next step: they'll visit your offices and, without stepping foot inside, check out barriers, receptionists, use of proximity cards, ID badges, specific lanyard colours and designs, public areas, shared office space, all the entrances to the building and who they're used by, contractor access, car parks, where staff go for coffee and lunch, busy and quiet times, windows which give internal views, even down to how you call the lifts and how many staff head to each floor. A long list of things that is certainly not exhaustive. They'll easily be able to identify areas of poor security and the rate at which controls are bypassed, such as tailgating or opening doors for others and not checking identification.

Meet the consultants Let's introduce you to Tom. Tom is a very nice guy, young, keen, always smiling. Tom's target? A small, merchant bank in the city. When he arrives, he's got company ID that looks legitimate, knows where he's going, and looks confident. With his phone to his ear and clutching two laptop bags, he arrives with a group of others and silently indicates his hands are full and if you don't mind opening the door for him ? Tom stands by the lifts still talking on the phone, watching as someone waves their proximity card in front of the screen to call the lift and presses the button for the fifth floor - Tom's destination. He jumps into the lift, still on the phone, and mouths thanks'. Tom knows the fifth floor is where the finance department is (from the reconnaissance phase, remember?), he exits the lift and walks in the opposite direction to the other person. Rounding a corner, he spots a half-empty hot-desking area. Ending his fictitious phone call, he quickly gets a laptop out of one of his bags and sets up. Someone wanders up behind him and says hello. Tom isn't fazed. He turns around, says hi and introduces himself, explaining that he's working on the company's latest marketing campaign and is usually based in the Edinburgh office. They chat some more. His audience is instantly at ease, they're in finance so know nothing about marketing but it's obvious that Tom is genuine, he knows all about the way the bank operates. Tom asks where the finance director's office is as he needs to speak to him later. The office is pointed out to him, and the employee is thanked for their help. After a few minutes, Tom leaves his laptop and goes to the bathroom where he hides until lunch. When he re-emerges, the office is quiet, he picks up his laptop - it was never switched on and contains no data anyway - and walks to the office of the FD. Nobody is around, but the FD's laptop is on the desk. Quickly but confidently Tom picks up the laptop, disconnects the cables, and puts it in his second bag. Ostensibly making arrangements for lunch on his phone he leaves, using the same techniques to get out as he did to get in.

Consultant number two Dick's target is a utility company site. He arrives wearing a hard hat and high vis jacket over a suit, he looks the part and most certainly like he's supposed to be there. If anyone asks, he's here to do an inspection and is usually based at head office, so unfamiliarity with the site is expected. He uses the car park exit, which he knows is not observed, to enter the site. Dick reaches the unmanned reception area but now needs to get through the locked door. Luckily, he spots a worker outside and introduces himself, spinning his prepared story and needs to be let through. He apologises for not having his official photo ID but does have a business card - with the company logo and address - which he presents. They share a laugh when Dick suggests his identity can be confirmed by calling the mobile number on the card and checking if his phone rings. This worker is impressed by Dick's friendliness and air of authority and is only too pleased to let Dick through the door! Once inside, Dick can wander through most of the building, being careful to keep away from areas where senior staff and managers are so he's not questioned. He takes photos of any documentation, internal information and security controls he finds. He also unplugs a USB memory stick from a workstation before exiting the building using another door which opens from the inside and is soon off the site.

and consultant number three Harriet's target is a technology start-up. They're based in a shared office which has very lax security: no IDs are worn, the reception is unmanned, the secure doors are propped open, and everyone inside is so used to strangers passing through they have no problem with opening doors for Harriet - how useful. She's young, vibrant and has a cheery thank-you for everyone as she qu
LINK: https://www.resillion.com/the-legend-of-tom-dick-or-harriet-a-tale-of-...
See more stories from eurofins

Most recent headlines

06/10/2025

France Tlvisions Wins Prestigious 2025 EBU Technology & Innovation Award in Groundbreaking Collaboration with Dalet

France T l visions, France's leading broadcaster, has received the 2025 EBU ...

04/09/2025

Monumental Sports & Entertainment and Dalet Win Prestigious 2025 NAB Show Project of the Year Award

Monumental Sports & Entertainment (MSE), in collaboration with Dalet, has been a...

30/08/2025

FCC Slightly Raises Regulatory Fees for TV Stations

WASHINGTON The Federal Communications Commission has adopted its FY 2025 Regulatory Fees Order that establishes the regulatory fee rates for the broadcast stati...

29/08/2025

Australian Red Cross and SBS launch training to help workplaces in the fight against Modern Slavery

Australian Red Cross and SBS launch training to help workplaces in the fight aga...

29/08/2025

Call for entries is now open for the 19th Annual South African Film & Television Awards (SAFTAs19)

The National Film and Video Foundation (NFVF), an agency of the Department of Sp...

29/08/2025

L3Harris Launches Counter-Unmanned Systems Initiative

L3Harris Technologies has concentrated decades of expertise across the entire enterprise to develop affordable and reliable best-of-breed solutions to rapidly c...

29/08/2025

The CW Network Extends Pac-12 Deal Through 2030-31 Season

BURBANK, Calif. The CW Network and the Pac-12 Conference have announced a new media rights deal that will extend their broadcast partnership beginning with the ...

29/08/2025

Global FAST Channel Count Continues to Spike

NEW YORK Gracenote has released a new analysis of its global video dataset showing that the number of FAST channels grew nearly 14% from Q1 2025 and 76% since 2...

29/08/2025

Harmonic Unveils New Capabilities for Its Live Sports Streaming Solution

SAN JOSE, Calif. Harmonic has announced a series of improvements to its live sports streaming solution that the company said will improve fan engagement, protec...

29/08/2025

Youtube TV, Fox Settle Differences, Renew Carriage Agreement

NEW YORK and LOS ANGELES Fox Corp. and YouTube TV last night announced a renewal of the full portfolio of Fox networks, including Fox News Channel, Fox Business...

29/08/2025

Lightware MTR integration brings advanced flexibility and...

Budapest, Hungary, August 2025 - The integration of Microsoft Teams Rooms (MTR) with Lightware's Taurus universal matrix switchers delivers a new level of f...

29/08/2025

Frequency Launches Studio Live - a Unified Platform to Br...

Frequency, the engine behind many of the world's best-known streaming television channels, today announced it will launch Studio Live, a next-generation uni...

29/08/2025

Scality Day 2025 Celebrating 10 years of global innovatio...

In an era when AI and cyber resilience are essential, Scality will mark the 10th anniversary of Scality Day on October 16, 2025 in Paris. This flagship global e...

29/08/2025

Disguise Drives New Immersive Racing Experience - F1 Box

Disguise's In-House Creative and Technical Teams Pre-Visualised, Programmed and Delivered Content for the Experience, All Powered by EX 3+ Technology solu...

29/08/2025

Disguise Supports Fellow Entertainment Tech Leaders at IB...

Disguise will be demonstrating the latest workflows for TV, film and live events on a number of partner booths at the show Disguise, the industry-leading tech...

29/08/2025

Accedo to Highlight Compose AI-Agent Enhanced Orchestration Layer

STOCKHOLM, Sweden Accedo will showcase Accedo Compose, its AI agent-powered modular orchestration layer that assists streaming providers in transitioning client...

29/08/2025

Cineverse Launches Streaming Apps for In-Vehicle Video Streaming

LOS ANGELES Cineverse has announced that it is working with Xperi to bring four of its streaming channels to automobiles for the first time as part of the DTS A...

29/08/2025

Gray Media to Simulcast 17 Dallas Stars NHL Games

DALLAS & ATLANTA Gray Media has announced an agreement with the sports streaming service Victory+ to simulcast 17 Dallas Stars NHL games in 15 television market...

29/08/2025

Comcast NBCU and Amazon Ink New Distribution Agreements

NEW YORK AND CULVER CITY Comcast NBCUniversal and Amazon have announced new and extended distribution agreements that will expand the content available on their...

29/08/2025

RED Digital Cinema To Highlight Cine-Broadcast Module At IBC2025

FOOTHILL RANCH, Calif. RED Digital Cinema will feature its Cine-Broadcast Module supporting live broadcast workflows during IBC2025, Sept. 12-15, at the RAI Ams...

29/08/2025

Kyivstar Rings Opening Bell at Nasdaq Marking Landmark Listing and Highlighting Ukraine's Investment Case

29 Aug 2025 Kyivstar Rings Opening Bell at Nasdaq Marking Landmark Listing and ...

29/08/2025

Sky Sports to show more NFL games than ever as part of new rights agreement

More than half of all NFL games live on Sky for the first timeFriday 29 August 2025 Sky Sports has announced a new three-year deal with the NFL, extending its ...

29/08/2025

'RIV4LRIES': The Trailer of the New Series With Samuele Carrino Only on Netflix October 1

Back to All News RIV4LRIES: The Trailer of the New Series With Samuele Carrino ...

29/08/2025

Steps ahead: RT to air inspiring documentary on 12-year-old Irish dance star

Get ready for an inspiring and emotional insight into the world of competitive Irish dancing with My Story: Tomi Champion of the World airing on RT 2 this monda...

29/08/2025

TODAY WITH DAVID MCCULLAGH TO AIR ON RT RADIO 1 WEEKDAYS AT 10AM

RT has today announced that David McCullagh is to be the new presenter of RT Radio 1's flagship Today programme, which airs every weekday at 10am, replaci...

28/08/2025

Meet the 2025 Sundance Institute Documentary Edit Residency Artists

By Kristin Feeley, Director, Documentary Film & Artist Programs If you want to tell untold stories, if you want to give voice to the voiceless, you've got ...

28/08/2025

Watch These 9 Sundance Institute-Supported Documentaries That Spotlight Workers' Rights

Directed by Steven Bognar and Julia Reichert, Sundance Institute-supported Amer...

28/08/2025

Motivational Corridos: The New Sound of Resilience in Msica Mexicana

Corridos have been a cornerstone of M sica Mexicana for generations, telling stories rooted in everyday life. Now, a new chapter is taking shape: motivational c...

28/08/2025

Corridos Motivadores: El Nuevo Sonido de la Resiliencia en Mxico

Los corridos han sido un pilar de la M sica Mexicana durante generaciones, contando historias enraizadas en la vida cotidiana. Ahora, un nuevo cap tulo est tom...

28/08/2025

Verano Forever Brings Myke Towers, Bele, Elena Rose, and More to Miami for an Unforgettable Latin Summer Celebration

Earlier this month, we promised our Verano Forever party would bring the heat, a...

28/08/2025

Poland Selects L3Harris Electronic Warfare System for F-16 Fleet

L3Harris will provide the Polish F-16V fleet with the Viper Shield electronic warfare system as part of an upgrade program....

28/08/2025

AgileTV consolidates its technological leadership with the development of Lowi TV in Spain

Bilbao, August 26, 2025 - AgileTV, an international television and video technol...

28/08/2025

Craft Interview: Ken Wilkinson, Audio Engineer

Ken Wilkinson is an Emmy Awards nominated New York audio engineer who specialises in production sound mixing for film, commercial, episodic and documentary work...

28/08/2025

Fubo to Launch Fubo Sports Skinny Bundle for $56 Per Month

NEW YORK FuboTV today announced that it will launch Fubo Sports, a skinny bundle that focuses on sports with a subscription price of $56 monthly....

28/08/2025

Telestream to Launch 'Global Ingest Workflow at IBC2025

NEVADA City, Calif. At IBC2025, Sept. 12-15 at the RAI Amsterdam, Telestream will debut its new Global Ingest strategy, introducing a next-generation ingest arc...

28/08/2025

Dr. Rhoda Bernard Releases Groundbreaking Debut Book on Accessible Arts Education

Dr. Rhoda Bernard Releases Groundbreaking Debut Book on Accessible Arts Educatio...

28/08/2025

TAG Strengthens Regional Presence with Appointment of Oli...

TAG Video Systems, the leader in software-based IP end-to-end workflow monitoring, deep probing, and real-time visualization, has named Oliver Gappa as Sales Di...

28/08/2025

DHD to Demonstrate AI-Based Voice Enhancement at IBC 2025

AI-based voice enhancement will be among a series of innovations making their IBC 2025 debut on the DHD stand B46 in Hall 8 at the RAI Amsterdam Convention Cent...

28/08/2025

Telefonica Servicios Audiovisuales Hit the Back of the Ne...

Telef nica Servicios Audiovisuales (TSA), the leading system integrator and service provider in the media sector in Spain, with the support of Appear, the globa...

28/08/2025

Optical Media Anchors LiveU IQ into its On site Productio...

To fully immerse sailing fans in the world's biggest offshore yacht race, production company, Optical Media turned to LiveU's On-site Production solutio...

28/08/2025

WNED Adopts Calrec Type R console to weather any storm an...

Working with Calrec on its most recent overhaul, radio and television broadcaster, WNED has migrated to a fully IP infrastructure with multiple Type R consoles,...

28/08/2025

Cleeng unveils first ever free D2C subscription platform...

Cleeng, the Subscriber Retention Management (SRM ) inventor, has unveiled Cleeng Pro, the first-ever direct-to-consumer (D2C) subscription management platform t...

28/08/2025

Zixi and OKAST Partner to Power Scalable Global FAST Chan...

Zixi, the industry leader in live broadcast-quality video over IP, today announced that French media distribution platform OKAST has selected Zixi to enable rel...

28/08/2025

Nixer to unveil CV1 AoIP monitoring tool to address evolv...

Solution offers a streamlined, speaker-free architecture to optimize integration with premium external loudspeakers and advanced loudness metering Nixer Pro Au...

28/08/2025

Cinegy Announces Strategic Partnership with One Touch Pro...

Cinegy, the premier provider of software-defined television technology, has announced a strategic partnership with Vision One Touch Film Production Services L.L...

28/08/2025

Telestream Global Ingest Workflow Powered by Vantage Open...

Telestream, a global leader in media workflow technologies, will debut its new Global Ingest strategy at IBC2025, introducing a next-generation ingest architect...

28/08/2025

Telenor partners with Broadpeak for multi-country content...

Tier 1 operator selects Broadpeak to power high-performance, unified CDN solution across Norway, Sweden and Finland Broadpeak, a leader in streaming and moneti...

28/08/2025

24 Frames Digital goes live with Synamedia Quortex Play f...

Leading video software provider, Synamedia, today announced that 24 Frames Digital, one of India's leading live event streaming service providers, has chose...

28/08/2025

VisualOn at IBC 2025 - Whats Next in AI Powered Video Str...

Meet VisualOn at IBC2025: See What's Next in AI-Powered Video Streaming Join VisualOn at IBC2025 and discover how our AI-driven Optimizer and advanced media...