9.4 Physical Security Concepts for PenTests

Objective 3.3 Explain physical security concepts is short, still on the exam, and easy to skip because Domain 3 otherwise looks like Nessus and Kubernetes. CompTIA lists five bullets: tailgating, site surveys, USB drops, badge cloning, and lock picking. None of them is implied by a network CIDR in the SoW. They require explicit physical-test scope: named buildings, hours, whether law enforcement and facilities have been notified, and which of the five techniques are allowed. A tester who clones a badge during a purely remote web test has not found a vulnerability. They have committed a crime.

Physical work also has safety and legal risk for the tester: security officers, local trespass law, and possession rules for lock picks vary by jurisdiction. The authorization letter exists partly so you are not treated as a burglar when you are on the loading dock at 02:00.

Tailgating versus piggybacking

Tailgating is entering a controlled door or turnstile by following an authorized person who did not cooperate — the employee badges in, the tester slips through before the door latches, and the employee never held the door or agreed to escort a visitor. CompTIA’s listed term is tailgating. Stems that show an unaware staff member and a silent follower want that word.

Piggybacking is the cousin language: the authorized person knowingly holds the door (“you look like you belong, come on in”). Some vendors reverse the two words. On PT0-003, keep the distinction by consent. Unaware follow-through = tailgating. Knowing hold-the-door = piggybacking. An access-control vestibule (mantrap) is the usual architectural countermeasure; cameras and training are the operational pair. Those remediations live in objective 1.5. Here you only need to recognize the attack and that it is a physical test, not a phishing email.

Exam trap: calling every lobby conversation tailgating. If the tester talked past a receptionist with a fake visitor story, that is social engineering (objective 4.8). Tailgating is the body through the door.

Site surveys come first

A site survey is the authorized walk-through or observation pass before you try USB drops, clones, or picks. You record camera locations and blind spots, lighting, fence lines, badge-reader type, whether doors latch and alarm, visitor sign-in, loading docks, smoker’s doors that are propped, and whether a vestibule actually cycles one person at a time. The survey itself may be overt (escorted, white-box physical) or covert (from public sidewalks and lobbies the RoE named). It is still reconnaissance of physical controls, not a wireless site survey of SSIDs — that is a different 3.1 bullet.

Skipping the survey is how testers pick a camera-covered padlock at night, clone a card at a reader that already logs unique IDs to a SOC, or tailgate into a floor that was excluded because of safety. The survey also tells you which 3.3 techniques are even possible: a modern encrypted smart-card reader is a different badge problem than a legacy proximity reader.

USB drops are legal only when authorized

A USB drop plants removable media where a person will pick it up and plug it in: lobby, parking lot, restroom, mail stop. The stick may present as a human-interface device, carry a lure document, or rely on someone opening a file. Technical details are not the 3.3 point. The point is authorization.

A USB drop without authorization is a crime, not a finding. It can violate computer-crime statutes, the client’s acceptable-use policy, and the engagement contract. Labeling the stick “payroll bonus” does not make it a test. “The lobby is public” does not put USB media in scope. “Network testing was authorized” does not include planting malware on staff machines. If the RoE is silent on USB drops, the answer is do not drop. If USB drops are allowed, the RoE should say where, whether the payload may phone home, how you retrieve unplugged sticks, and how you avoid targeting visitors who are not in scope.

Exam trap: treating a successful unauthorized drop as evidence the client needs training. You do not get a finding from an illegal act. You may get a lawsuit.

Badge cloning and proximity cards

Badge cloning copies an access credential, most classically a low-frequency proximity (prox) card (for example 125 kHz HID Prox-style tokens) whose identifier can be read at a short distance and written to a spare card or emulator. The tester then presents the clone at a reader. Encrypted smart cards and phones in a secure wallet are harder; the exam still wants you to know cloning is the 3.3 technique against weak badge technology.

Cloning requires physical-test permission that names badges, readers, and whether you may stand near an employee turnstile with a reader. Stealing a badge from a purse is theft plus cloning, not “just 3.3.” Using a cloned badge on a building that was not listed is out of scope even if the card opened it.

Lock picking

Lock picking is opening a mechanical lock without the assigned key: pin tumblers on server cages, padlocks on docks, office doors, cabinets. Related skills (bump keys, shimming a padlock, bypassing a cheap privacy latch) sit in the same concept bucket on a multiple-choice item. Possession of picks can be restricted by local law. On the exam, the operational rule is the same as USB and cloning: only with written physical authorization, only on named locks, and usually after the site survey shows cameras and alarms.

Picking a lock to “save time” during a network test is not clever. It is unauthorized physical access. If the RoE allows a cage pick to plant a drop box, you still stop at the named cage. Adjacent offices are not a bonus round.

Worked authorization decision

The SoW authorizes 10.4.0.0/16 and the corporate web applications. It does not mention buildings. A tester who tailgates into HQ, clones a prox card at the garage reader, leaves USB sticks on the receptionist’s counter, and picks the server-cage lock has performed four 3.3 techniques without physical-test scope. None of that is a valid finding. The lawful path is: amend the RoE for a named street address and window, complete a site survey, then run only the techniques the client approved — perhaps tailgating and a camera-aware badge test, with USB drops forbidden. If USB is later approved, the drop is a controlled test with retrieval, not a surprise crime.

3.3 is explain-level: you must know the names, the consent language at the door, and that physical work is a scoped engagement of its own. Domain 4 will reuse some of these ideas under social engineering. Here, the scoring is whether you treat the body, the badge, the stick, and the lock as authorized physical tests or as improvisation.