Where are the servers and network components that host and manage the organizations assets? Are there active network jacks that are unused, are they in public spaces, are they in places where people would not notice if there was somthing plugged into them? How is data accessed and stored outside of the organization's main offices/workspaces? Do staff travel with organizational information? How are backups managed? Where are they stored? APPROACHES Physical Access to the Lan, wifi, and Servers: Tour the office and look for exposed network devices, servers, and network jacks, document how difficult it would be for a visitor or after-hours break-in to access sensitive systems. Determine the reach of the wireless network and how easy it is to identify it as connected to the organization. Mapping potential physical vulnerabilities with digital security impacts: Document potential vulnerabilities to the organization's information security based on physical aspects -- e.g. unencrypted devices which could be stolen, written passwords, or even wireless network metadata. OUTPUTS Notes on specific unsecured servers, workstations, and digital storage media. Access controls to the office Travel policies and practices Remote work and other external / non-organizational device access to organizational data. Depending on the risk level of the organization, observations on digital media (USB sticks) and digitally-related items (print-outs) Office Map with potential vulnerable locations and the extent of wifi access outside of the controlled office space. Discussion of potential risks associated with broadcast wireless data. OPERATIONAL SECURITY Any physical notes taken on physical security should be destroyed. Digital notes should be kept in line with overall SAFETAG standards. Note relevant laws regarding wireless signal monitoring. Ensure and mapping tools used do not themselves leak or share data PREPARATION RESOURCES Guide: "Step Zero: The Go / Don't Go Decision"(Level-Up) Page 113 of 240