Section 01

Intermediate

Recon & Threat Modeling

Good physical operators do not start with a pick or cloned badge. They start with routes, routines, people, and pressure points. Reconnaissance is where you convert a site into an attack path map and a defensive control map at the same time.

Recon Still Requires Scope Discipline

Photography, vehicle observation, badge-reader inspection, and after-hours pattern collection can all create friction if your rules of engagement are vague. Make sure the client has agreed to the hours, the perimeter, and any restrictions around employees, parking, or third-party tenants.

Recon Objectives

Find Viable Entry Paths

• Public lobby and reception routes
• Employee-only doors, loading docks, and side entrances
• Smoke-break clusters, parking flows, and shift-change chokepoints
• Doors where convenience beats policy

Map Defender Visibility

• Camera placement, PTZ sweep habits, and likely blind spots
• Guard lines of sight and patrol windows
• Reception desk coverage versus actual door activity
• Alarmed versus merely locked doors

Profile the Human System

• Visitor check-in quality and badge issuance habits
• Contractor normalization and vendor trust levels
• Challenge culture around tailgating and wrong-floor presence
• Employee use of stairs, elevators, and shared entrances

Identify Post-Entry Objectives

• Network drops and conference-room gear
• Badge-printing areas and security offices
• Telecom closets, IDF rooms, and unattended workstations
• Executive floors, labs, and document-heavy zones

Patterns of Life

The strongest physical findings usually come from understanding how the building behaves over time. Observe where convenience overrides control: lunch rushes, shift changes, deliveries, cleaners, and late arrivals are where people and process drift first.

Simple physical threat model: routes, trust transitions, and post-entry objectives

flowchart LR A[Public Space] --> B[Lobby / Reception] B --> C[Badge Door] C --> D[Workspace] D --> E[Critical Area] F[Loading Dock] --> D G[Smoke Break] --> C H[Visitor Check-In] --> B I[Stairwell / Side Entry] --> D C --> J[Challenge or No Challenge] D --> K[Escort or No Escort] E --> L[Objective Achieved]

Recon Checklist

Phase	What To Capture	Why It Matters
OSINT	Maps, staff names, vendors, social posts, security job listings, tenant directories	Build believable pretexts and identify likely controls before you arrive
Exterior Walk	Camera positions, badge readers, side doors, guard behavior, smoking areas, deliveries	Shows which routes are watched, ignored, or normalized
Timing Pass	Lunch flow, shift change, cleaners, reception load, parking churn	Identifies when social friction and scrutiny are lowest
Post-Entry Planning	Network drops, printer clusters, badge stock, stairwells, telecom closets, boardrooms	Prevents aimless wandering and reduces unnecessary exposure once inside

Rapid Threat Model Notes

physical-threat-model.txt

target: downtown office, 3 floors, reception desk, garage access, shared tenant lobby

entry path 1: visitor pretext
- likely route: reception -> temporary pass -> elevator -> unescorted floor access
- assumptions: receptionist is overloaded at 8:30-9:15, no secondary ID verification
- detection points: front desk, elevator camera, floor manager challenge

entry path 2: lunch-rush tailgate
- likely route: side badge door -> open office floor -> conference area
- assumptions: employees carry food / laptops and hold the door
- detection points: badge-door anti-passback, nearby camera, challenge culture

entry path 3: credential attack
- likely route: weak 125 kHz credential cloned -> badge door -> telecom closet
- assumptions: legacy badge tech, reader cable exposed, no escort rules after-hours
- detection points: access logs, door-held-open alerts, SOC review cadence

objective after entry:
- prove access to internal network drop and sensitive floor without causing damage
- capture minimal evidence: route, timestamps, camera gaps, challenge failures, target room photo

What Strong Defenders Do Differently

Defensive Signals

• Reception can see and influence the badge-controlled choke point
• Visitors are verified, logged, and visibly escorted
• Cameras cover the approach to sensitive areas, not just the front door
• Side entrances behave like security boundaries, not convenience paths

High-Risk Signals

• Badge readers exist but people routinely hold the door anyway
• Cameras are present but obviously miss the actual route into secure areas
• Employees wear badges inconsistently or display them clearly enough to photograph
• Contractors and delivery staff move unchallenged after the first threshold

Observation Record

A recon finding is only as good as the record behind it. Every observation should carry these fields:

Site and zone: Building, floor, and the entrance or door identifier, plus the zone class the observation belongs to: public, staff, or restricted.

Date and time window: When the observation was made, in local time, set against the authorised window so an out-of-hours sighting cannot be read as a tested condition.

Control inspected: The camera, reader, guard post, or piece of door hardware, named by location and model rather than by what the vendor claims it does.

Photo reference: The filename or frame number that matches the timeline entry. An unnamed image in the appendix cannot be tied to a control failure.

Access tested: Whether the control was tested at all, and by what method: walk-by, pretext, tailgate attempt, or credential.

Route taken: The path from the perimeter to the point of observation, including every transition where someone granted trust.

False Positives

Control present but unverified: A camera aimed at a door is not coverage, and a reader on the wall is not enforcement. Record what you saw the control do, not what the hardware inventory says it can do.
Environmental condition: Rain, low sun, a delivery backlog, or a fire drill explains an observation. Note the condition beside the observation.
Outside the authorised window: Anything seen before the start or after the end of the agreed hours is context for the report, not a finding in it.
Observer effect: Staff who notice the tester behave differently afterwards. The second pass, not the first, is the one worth recording.
One pass treated as a pattern: A single walk-by cannot establish a pattern of life. Two passes on different days, ideally at different times, is the minimum.

Remediation

Physical layer

• Put a staffed choke point between the public lobby and the first badge door, and treat side entrances as boundaries rather than shortcuts.
• Cover the approach to sensitive areas, not just the front door, and check the recorded field of view against the route people actually walk.

Human layer

• Make escort rules explicit for every visitor badge issued beyond reception.
• Give staff a named person to call when a challenge is needed, so polite friction does not depend on individual courage.

Verification schedule

• Re-walk the perimeter and re-test the visitor path at 90 days, and again after any fit-out, tenancy change, or reception restaffing.

Physical Security

Return to the section overview and tier model.

Visitor Controls & Social Engineering

Turn recon into credible pretexts and challenge-culture tests.

OSINT

Build richer staff and vendor profiles before the site walk.

Camera Coverage Planner

Map the surveillance side of your recon notes.