Standard: "PGP and Other Alternatives" (The Penetration Testing Execution Standard: Pre-Engagement Guidelines) Guide: "Participant Security" (SaferJourno) Guide: Operational Security Management in Violent Environments ACTIVITIES GUIDED TOUR Summary During this component an auditor tours the audit location(s) and flags potential risks related to physical access at that location. Overview Have your point of contact walk you around the office (often as part of introductions on the first day) - mentally note physical security concerns. Document how difficult it would be for a visitor or after-hours break-in to access sensitive systems. Identify physical assets with sensitive content, such as: Networking equipment and servers User devices (workstations/laptops, smarthpones, USB drives) Sensitive information or external storage drives lying on desks Accounts/passwords written on post-its, white-boards, etc. Unattended, logged in computers Unlocked cabinets, computer rooms, or wiring closets Network ports that are not in use, especially ones not in plain sight This can be done remotely via secure videoconference over a smartphone or tablet that can moved around the office easily. Combining this activity with Office Mapping helps to reduce the awkwardness of taking notes while walking around the office, and if being done remotely, the two separate activities can be used to cross-verify the accuracy of each. Materials Needed Page 114 of 240