Penetration Test, Hampshire

The client was the owner of the recently redeveloped rural estate, which consisted of a large house, expansive outbuildings, and surrounding pastoral land. Having invested substantially in security infrastructure, the client sought to validate the efficacy of their security measures by engaging our team to conduct a thorough physical penetration test.

The primary objective of the project was to identify and exploit any vulnerabilities in the estate’s physical, technical, and procedural security plan. The client wanted to understand potential weaknesses that could be exploited by malicious actors, including organised criminal groups (OCGs), using real-world methodologies such as social engineering, hostile reconnaissance, drone flights, and climbing.

Our team meticulously planned and executed a series of simulated attacks encompassing a range of threat scenarios, following two days of hostile reconnaissance. These scenarios were designed to mirror the tactics employed by organised criminal groups, terrorists, and other malicious actors. The following methodologies were employed:

Social Engineering.  Our team conducted social engineering experiments to test the estate’s staff and residents’ awareness of security protocols. We posed as service personnel, delivery drivers, or contractors to assess the estate’s susceptibility to unauthorised access.

Open-source intelligence.  We used open-source intelligence techniques to gather information about the estate from publicly available sources, including analysing satellite imagery, mapping escape routes, identifying security camera placements, and determining potential access points.

Hostile Reconnaissance.  The team established a series of observation posts at day and night to observe staff presence, movements, and procedures. They gained access onto the property by exploiting the public access routes across the estate, and testing to see whether they would be identified if they strayed from these paths.

Drone Flights.  The team flew several drone sorties to generate current aerial imagery, test the security team’s awareness and response to aerial reconnaissance, and to identify physical and technical security measures and key assets on the property.

Using all of the intelligence gathered during the reconnaissance period, the team planned an executed a raid on the property, with the objective of getting into the house without detection.

Upon successful completion of the penetration test, our team compiled a comprehensive report for the client. The report included:

• Methodology Overview: Detailed descriptions of the tactics, techniques, and procedures employed during the penetration test.
• Potential Courses of Action: A breakdown of possible strategies that malicious actors might employ to breach the estate’s security.
• Vulnerabilities Identified: A list of the vulnerabilities and weaknesses discovered during the tests, categorised based on their severity and potential impact.
• Recommendations: A set of actionable recommendations to mitigate the identified security risks. These recommendations included improvements to physical barriers, security camera placements, access control measures, staff training, and procedures for handling visitors and contractors.

The successful completion of the physical penetration test provided the client with valuable insights into the strengths and weaknesses of their security infrastructure.

By simulating real-world threat scenarios, the test revealed vulnerabilities that might have otherwise gone unnoticed. The comprehensive report and recommendations empowered the client to take targeted actions to strengthen their security posture and protect their valuable assets against potential threats.