performing-physical-intrusion-assessment

name	performing-physical-intrusion-assessment
description	Conduct authorized physical penetration testing against facilities, server rooms, and restricted areas using tailgating, RFID badge cloning, lock bypassing, rogue network device deployment, and security-guard procedure testing. Use as part of a full-scope red team engagement to evaluate physical security controls and their path to network access, always under signed client authorization.
domain	cybersecurity
subdomain	red-teaming
tags	["physical-security","red-team","tailgating","badge-cloning","lock-picking","rfid","physical-pentest"]
version	1.0
author	mahipal
license	Apache-2.0
d3fend_techniques	["Platform Hardening","Hardware Component Inventory","Electromagnetic Radiation Hardening","RF Shielding","Asset Inventory"]
nist_csf	["ID.RA-01","GV.OV-02","DE.AE-07"]
mitre_attack	["T1595","T1190","T1059","T1078","T1027"]

Performing Physical Intrusion Assessment

Overview

Physical intrusion assessment evaluates an organization's physical security controls by attempting to gain unauthorized access to facilities, server rooms, and restricted areas. This includes tailgating employees, cloning RFID access badges, bypassing locks, deploying rogue network devices, and testing security guard procedures. Physical security testing is a critical component of full-scope red team engagements, as it often provides the most direct path to network access. MITRE ATT&CK maps physical access techniques under T1200 (Hardware Additions) and T1091 (Replication Through Removable Media).

When to Use

• When conducting security assessments that involve performing physical intrusion assessment
• When following incident response procedures for related security events
• When performing scheduled security testing or auditing activities
• When validating security controls through hands-on testing

Prerequisites

• Signed authorization letter (carry at all times during assessment)
• Emergency contact for client security team (24/7)
• Get-out-of-jail letter signed by executive authority
• Physical security testing toolkit
• Body camera or documentation equipment
• Disguise/cover identity materials (uniform, badge, clipboard)

MITRE ATT&CK Mapping

Technique ID	Name	Tactic
T1200	Hardware Additions	Initial Access
T1091	Replication Through Removable Media	Initial Access
T1199	Trusted Relationship	Initial Access
T1078	Valid Accounts	Initial Access

Physical Security Testing Toolkit

Tool	Purpose	Approximate Cost
Proxmark3 RDV4	RFID badge cloning (125kHz/13.56MHz)	$300
Flipper Zero	Multi-protocol RF analysis	$170
Lock pick set (Sparrows)	Mechanical lock bypassing	$35
Under-door tool (UDT)	Bypass door from outside	$30
Shove knife / latch slip	Spring bolt bypass