Section 06
Intermediate
Evidence & Reporting
A physical engagement is easy to sensationalize and easy to under-document. Your report needs to show the route, the failed controls, the minimum proof of impact, and the practical remediation path without drifting into storytelling or naming-and-shaming staff.
Warning
Never photograph employee faces, personal belongings, or screen contents beyond what is needed to prove a control failure. Over-collection creates legal risk and erodes client trust.
What To Carry
Core Kit
- • Signed authorization letter and point-of-contact sheet
- • Charged phone and secondary note-taking method
- • Body camera only if explicitly approved and legally appropriate
- • Simple timestamping habit for every transition point
Evidence Rules
- • Capture the control failure, not more private data than needed
- • Prefer role descriptions over employee names in the final report
- • Record exact timing around entry, challenge, and detection
- • Keep sensitive photos segregated for sanitization before delivery
Live Timeline Discipline
engagement-timeline.txt
08:41 - arrived on exterior perimeter, camera coverage observed on main lobby and garage gate
08:47 - identified side entrance used by smokers, no guard visibility from reception
09:04 - entered via visitor pretext, front desk issued temporary pass without verifying host using trusted number
09:07 - reached elevator bank unescorted
09:12 - arrived on third floor, no challenge from staff despite visible visitor badge
09:16 - photographed open network drop in conference room and returned to public corridor
09:21 - exited without interception
finding logic:
- initial failure: visitor verification
- secondary failure: lack of escort enforcement
- tertiary failure: challenge culture absent on secure floor
- business impact: unauthorized person reached internal workspace and network access point in under 10 minutesPhoto and Evidence Targets
| Capture | Why | Sanitization Note |
|---|---|---|
| Door, badge reader, or latch bypass point | Shows the specific control that failed | Avoid capturing unrelated people where possible |
| Camera blind spot or poor approach coverage | Turns a route description into an observable design flaw | No need to reveal full camera management UI if one photo proves the point |
| Sensitive room or exposed network drop | Demonstrates business impact without live exploitation | Blur asset names or labels if the client prefers sanitized output |
Suggested Severity Factors
- • Depth reached: lobby, workspace, restricted room, or critical infrastructure zone
- • Control chain failure: one weak control or repeated failures across people, process, and hardware
- • Objective proximity: could the route reasonably lead to data, network, equipment, or executive space?
- • Detection quality: challenged immediately, challenged late, or not challenged at all
Finding Structure
physical-finding-template.txt
Title: Visitors could access staff floors without trusted host verification or escort enforcement
Summary:
During a daytime engagement, a tester received a temporary visitor badge after providing a believable contractor pretext. Reception did not verify the host via a trusted contact path, and no escort was provided. The tester reached an internal workspace and observed live network connectivity options within 10 minutes.
Why this matters:
This converts a weak reception workflow into unauthorized physical and internal access. If combined with a rogue device or unattended workstation, the issue becomes a direct bridge into technical compromise.
Evidence:
- Timeline of route and interaction points
- Photo of visitor badge and arrival on staff floor
- Photo of exposed network drop in conference area
Recommendations:
1. Require trusted host verification before issuing access
2. Enforce escort rules for all visitor badges beyond reception
3. Add challenge training for staff floors and camera coverage on elevator exits
4. Review whether conference-room network drops should remain active without local controlsProfessional Exit Discipline
Always have a burned-exit plan. If challenged, de-escalate immediately, present authorization, and move the interaction toward the approved point of contact. Your best report does not come from “winning” an argument with local security.
Recommended Tools
📹
Body Cameras
Discreet 1080p body cameras for evidence capture during physical engagements. Always get explicit written approval before recording.
📸
Timestamp Cameras
GPS-synced timestamp cameras ensure photographic evidence has accurate, verifiable time metadata for your engagement timeline.
False Positives
- Timestamp drift: A camera clock and a tester clock disagree by minutes. A photo stamped 09:04 beside a note that says 09:12 is an evidence problem to fix before delivery, not a finding.
- Photo without context: A door, a reader, or a network drop with no location frame cannot be tied to a control failure. Retake it with the surrounding corridor or room number.
- Observation outside the window: Anything captured before the authorised start or after the agreed end is context. Label it, and keep it out of the findings table.
- State caused by the tester: A door left on the snib, a cable moved, or a badge placed on a desk by the tester is not a pre-existing weakness.
- A control that failed once: One missed challenge is an anecdote. Say how many attempts were made and how many were stopped, or state plainly that the sample is one.
Evidence QA Checklist
Before writing
- ☐ Every photo has a location, a timestamp, and a timeline entry.
- ☐ The timeline matches the photo order, including the entries that show nothing happened.
- ☐ No faces, screens, or personal belongings beyond the minimum needed to prove the failure.
Writing the finding
- ☐ One route, one failure chain, one recommendation per finding.
- ☐ Severity argued from depth reached, control chain, objective proximity, and detection quality.
- ☐ Role titles instead of employee names unless the client asked otherwise.
Handover
- ☐ Sanitised appendix separated from the raw capture, with the mapping kept internal.
- ☐ Every recommendation has an owner and a review date.
- ☐ Retention and destruction date agreed in writing, and the raw set stored accordingly.
Related Topics
As an Amazon Associate I earn from qualifying purchases.