From a data-gathering point of view, the first steps are to try and access the wireless network by password guessing, but also to connect to the network and capture traffic for analysis overnight. This provides other views on the actual technology and services used on the network, different both from the management and IT view as well as other tools discussed by staff. First or Second day Associate nmap scans, MAC addresses, and beacons with people and specific systems, plus servers/networking hardware Scans on the captured traffic for passwords, auth cookies, suspicious traffic, unencrypted connections Further Days (on Location) The next day you’re on location, you have hopefully looked through the research data you gathered, and have some specific follow-up things to investigate. It’s also now time to start going through the audit tasks. Deeper dive into what hardware is connected and what it is doing Begin organizing vulnerabilities and tracking against the audit framework External audit tasks Internal audit tasks Physical audit tasks Final Day (on Location) Discuss initial findings and responses Suggestions for follow-up training, resources to consult, and possibly targeted trainings for relevant staff (what is a secure password? How to communicate securely?) Discuss next steps: SAFETAG Report, connections to trainers, how to seek help EXPLORATION AND CHECK-INS Throughout the entire audit, aggressively make time to engage with staff - stop for coffee, eat lunch with them, have conversations. This can be integrated in to other parts of the process, such as the user device assessments, as well as being completely independent and natural. Having better connections with staff will make the group exercises, especially the risk assessment work, flow much better. Whenever you set off a scan (airodumping, nmap, openvas...) are good times to stand up and walk around. DEBRIEF AND SETTING EXPECTATIONS Page 20 of 240