start	end	text
1620	5840	Hello, DEF CON Lockpick Village. Super excited to be here.
5900	9740	This is my talk, Doors, Cameras, and Mantraps. Oh my!
9840	13740	An overview about the ins and outs of physical security risk assessment.
13960	19040	If you are curious about pursuing this as a career option, you are in the right place.
19040	21160	If you want to learn about lockpicking,
21160	24760	I'll mention some sources that can help with that later on in the talk.
28760	30700	Here is a quick intro.
30700	34180	I am The Magician, or Dylan, whichever you prefer.
34360	38740	I am a member of the Open Organization of Lockpickers in Orlando.
38740	41840	I am a security consultant with Gold Sky Security.
42120	45540	I teach cybersecurity at the University of Central Florida.
45540	46560	Go Knights!
46640	49700	And I am an overall security enthusiast.
49700	52640	This is really a hobby for me, as much as a career.
54800	60380	What I do is straightforward. I explore client sites with the defenders in tow,
60380	64720	so I can demonstrate for them any physical security vulnerabilities I spot.
65400	70540	Bringing the client defenders with me allows for a teach-back while on-site,
70540	74460	instead of solely in our report. It is an absolute blast.
75340	78040	This mostly summarizes the process.
78120	81700	I show them the vulnerability, and I tell them the mitigation.
84470	87190	So, what are we going to discuss in this talk?
87190	90510	This is not a lockpicking or how-to talk.
90510	93550	This is more a talk about the processes and procedures,
94170	100230	mostly about what we look for and how we relay the information to the clients.
100810	106530	I will cover physical security controls, key questions I ask my clients,
106530	110270	and how I go about educating the clients about risk mitigation.
110550	114270	At the end, I'll talk about how to approach this field.
116450	119870	Physical security controls start with the front door, I think.
119870	122950	So, I want to start with doors and windows.
125160	131500	There are a lot of mechanical components to doors, but here's a short list I tackle.
131500	137460	Do perimeter doors have the hinges exposed to the outside? Those hinges can be exploited.
138160	141420	Can I slide something between the latch and the strike plate
141420	144800	to pull the door open without a key or combination?
145220	150700	Can I get tools over or under the doors to manipulate the door handles?
151340	155000	If I run across double doors, can I manipulate crash bars,
155000	159500	those bars that go across the middle of doors that you can kind of push open with your hip
159500	165980	so you don't need to use a knob or a handle? These are all resolvable exploits.
168550	172830	While some windows can be opened or manipulated in similar ways,
172830	177390	they offer different challenges. In a lot of office spaces,
177390	180290	some clients don't have policies about shoulder surfing
180290	184270	or looking over the shoulder of a user to obtain information.
184710	189750	This is a physical security risk. If someone is trying to establish
190310	195810	a good time for physical entry, maybe just what PC operating systems are being used,
195810	201370	or even information as simple as what browser type a particular company is using,
201370	204670	looking through a window is really low effort.
204730	210270	This clip, by the way, is very much not a risk model my clients have ever asked me to test.
213660	219920	The next physical controls are fencing and bollards. Both are passive and require little
219920	224560	maintenance in most cases. Even though some folks are scratching their heads about what
224560	232980	bollards are, don't worry, you've seen them before. Fencing is obvious, maybe folks have
232980	239740	them in their homes or at work maybe. Fencing establishes a clear perimeter,
239740	246000	if locked, clearly sets an expectation of limited access. It would take a heck of an improviser
246000	252020	to explain to a guard why you are walking around a parking lot or building at a locked and closed
252020	258760	facility. It's also near impossible to scale a fence in most environments without attracting
258760	267760	attention, unless in a very rural location. You have all seen bollards before, they are
267760	273240	the reinforced obstacles that prevent the use of a vehicle as a battering ram to create a point
273240	279240	of entry in an otherwise defended structure. This is a very fancy hydraulically assisted version, but
281360	287420	here we are at a Target. Remember when we used to go to Target in 2019 for groceries?
287420	294620	Those were the days. In front of the store, these steel reinforced concrete spheres are not just to
294620	299520	look cool, they actually prevent people from running their cars into the glass doors to gain
299520	308800	access in off hours to steal random stuff. It's a pretty simple passive risk mitigation, I think.
308800	319060	Full bonus, I just find it fun to say bollards. Next up are Mantraps. This is a super cool concept.
322520	328940	Mantraps are completely underutilized. Sure, it's a challenge to get people through them, you'll
328940	334900	understand why a flow of people can be interrupted in a moment, but I think they are really awesome.
335000	339420	Many banks have them, and after seeing the next slide, I'm willing to bet a few of you are going
339420	347040	to be sitting at home saying, holy cow, I've totally seen those. This is a great scene from
347040	351720	the movie Sneakers, my personal favorite hacker movie. The lead character, Bishop,
351720	357800	walks through a glass sliding door after using a magnetic stripe reader. The door closes behind him,
357800	364120	and another door is in his way that uses a biometric reader. Now he has to get past that.
364580	368160	Super neat control that I would love to see in more places.
371070	375870	Cameras are a great security control for several reasons. If you have the means,
375870	382070	I encourage you all to grab some power over ethernet or wi-fi cameras and try hacking them.
384600	390180	Cameras are in most businesses and some homes now. If you have the funding at a job site,
390180	397600	you can even have your cameras actively monitored in a SOC or security operations center. Lots of
397600	403900	small to mid-sized businesses just record video and reference it in incident response if something
403900	410980	goes wrong for forensic purposes. Video is easy to store and you could find out who took company
410980	417060	property maybe after they got terminated or who was negligent in some security policy. There are
417060	422140	many technologies in the world of cameras, but I firmly believe that wi-fi cameras specifically
422140	429800	are a poor choice. Please reach out for that soapbox rant if you like. A fun fact about a lot
429800	439020	security cameras is that often they aren't even powered on at job sites. Because I love
439020	445160	surveillance cameras and have several to tinker with at home, my oldest son has developed a
445160	450440	curiosity around them and likes to point them out when we are at theme parks here in Orlando.
450440	455760	He can quite accurately count the number of cameras on the walk up to a structure.
455760	460400	Would you have seen the two massive dome cameras on top of this archway at Universal Studios
460400	467240	Florida if I had not put boxes in this photo? Heck, I can't even see them hardly with the boxes,
467240	471360	but I assure you if you go to Google Maps, they are there. Go check it out.
474080	479940	For electronic access, I am going to do a very light touch because it is quite a dense topic.
482720	488460	Most of you are in an office environment and have some token that grants you access.
489040	494460	A radio frequency ID badge that you wave in front of a reader that opens a magnetic
494460	500000	sealed door might be your front door. A pin code that is shared among employees
500000	505420	and janitorial staff might get you into privileged rooms. Maybe a fingerprint even
505420	511720	unlocks the laptop at your desk. Grocery stores even have electronic sensors that
511720	515820	know when someone is there and detect motion and open for you.
518200	525040	All of these things can be exploited or copied in some way. I personally am one of the many
525040	530620	cyborgs in the hacker community. I got an implant from Dangerous Things last year and can clone
530620	536160	radio frequency ID badges to my hand and I use that to educate clients about the importance
536160	545160	of cycling the guest badge so that way someone can't take that badge number and then come back
545160	555090	with it and let themselves in. Next I want to talk about how to speak to clients in a productive way.
557240	563900	What is your personal area of concern? In other words, ask a client what on earth
563900	569600	they care about. I've demoed a parking lot to server room break-in in four minutes
569600	575160	and had a client shrug their shoulders. Their dollars were in a manufacturing area
575160	582880	in another more secure location. Ask your client what they want you to put time into.
582880	589900	Being efficient is a good way to get repeat clients in a role where often you're billing hourly.
592620	597120	Don't miss any doors. There is no shame in verifying with a client
597120	599740	that you have tested the entire perimeter.
602020	608880	Ask which doors get the most traffic and which get the least. Some doors may have super beefy
608880	614660	security while another may be a smoking area door, has people flowing in and out of it throughout
614660	620480	the day, and has less security favoring convenience. Those are good doors to test
620740	624740	a tailgating attack where you try and walk in behind an employee.
627450	633770	Because you truly are a guest in the scenario of being a security risk assessor, you can test
633770	642090	guest access policies firsthand. In some cases, if it is in scope, meaning if the client has agreed
642090	647930	to it ahead of time, try entering the client premises and asking to use the restroom. Then
647930	655250	see how far you can get into the building unattended. If you show up and notice a robust
655250	662270	check-in policy, maybe with a photo and temp badge, great. That is often not the case.
662490	670090	Do you get an escort? Also a bonus. Can I keep an RFID badge and replay it when I come back
670090	676490	next year for an assignment? Not ideal, but I've seen that before. Do you get watched like you're
676630	680810	a suspicious hacker in a hoodie, or is there instant trust once you've made it past the
680810	687890	perimeter? Final fun thing to look for if you get a guest badge. Where can you get in the
687890	693730	building? You might be surprised to find yourself in a CEO or CFO office if you're lucky.
696070	703410	Here we see some extremely robust guest security policies in action. Armed guards are monitoring a
703410	709910	guest who is also restrained and has their tools confiscated temporarily. Someone in a security
709910	716310	someone in security operations hands the guest off to a person of authority who is also armed
716310	722090	for the purposes of communication. This is a bit much, but similar procedures are not unheard of
722090	731260	in a military or DoD establishment. As a social engineering enthusiast myself, this is a huge
731260	737360	topic. Entire companies are dedicated to just educating and empowering employees to act as
737360	745860	part of the security team for a company. Here are quick points on the matter. Gamify your security
745860	751680	training. A traveling trophy can go on the desk of the person with the least clicks on email
751680	758180	phishing one month. Or maybe someone else who always locks their computer when they head to
758180	764380	the break room. Be creative. Let employees know that they are an integral part in the security
764380	771040	of their company and that they can be the first line of defense. Every employee is part of the
771040	781330	security team. As a social engineering enthusiast, this is equally important. You want to make sure
781330	788190	you're establishing rapport with your clients. You want them to want you to come back. Constructive
788190	797890	criticism can be done in a very positive way. While there have been tons of talks about how to
797890	804290	exploit mechanical components of physical security, there have been just a few that cover
804290	809670	the specifics of educating the clients on how to go about resolving the exploits that you've
809670	816670	demonstrated on the job. Constructive criticisms are the way to go. A positive focus is absolutely
816670	822190	critical. Directed or accusatory verbiage is never productive. Saying things like,
822190	825970	this is so bad, or I can't believe you set it up this way,
825970	831210	need to be replaced with, we have some good opportunities here for improvement.
831650	837910	Simple phrasing can mean a huge world of difference. Also, leading a client to come
837910	843690	to their own conclusions through education and demonstration will work wonders for client morale.
846030	850530	Here is the show and tell part. This really is my favorite part of the job.
852880	857500	Showing the defender's vulnerabilities on-site is immensely fun and can have an
857500	863400	extremely positive impact. Telling someone you can bypass a door versus showing them how
863400	867920	has a huge difference in the likelihood that a mitigation will be implemented.
868340	873020	This step in the process also gets the most heads popping into the room.
873220	878740	It gets people excited about the security of their company. I have yet to run across a group
878740	883340	of employees that doesn't show interest in an under-door tool or a latch slip.
886270	892210	This is pretty big. This is all about soft skills and keeping people calm in an otherwise
892210	898330	stressful environment. Fear, uncertainty, and doubt have no place when you're trying to be productive.
901180	908920	You want to avoid saying things like, oh, this is bad, or you've done this incorrectly. Instead,
908920	916140	be inclusive and positive. We can fix this. No big deal. Make sure that you're explaining things.
916140	922180	You're not telling them. You don't want to just send an email with resolutions. You want to
922180	929780	actually have a human conversation. This is pretty much the best explainer of fear, uncertainty,
929780	935040	and doubt and why it can damage a client relationship. Fear is not a good motivator
935040	939860	to get risks mitigated. Educate and empower. Never belittle or disrespect.
943720	948800	Provide some means for clients to reach out to you. Don't be out of touch.
950240	956140	A reputable company should provide you with a company email, and if you're lucky, a company
956140	962660	phone number. This can separate work and home, and keeping a work-life balance in this particular
962660	967800	career field can be challenging at times. Make sure to also set expectations about when you
967800	976960	can be reached and how long it may take for you to respond. I feel education is the most
976960	981640	important aspect of hacking and security. That's not to say that a four-year degree or anything
981640	988800	like that is needed. Kudos if you're going that route. The different approaches to learning
988800	996360	are varied, but here are a few. Podcasts, YouTube, and Udemy were big wins for me personally.
998120	1004040	If you want to get into lockpicking or just see some jaw-dropping feats of lock exploits,
1004040	1009260	then look no further than Lockpicking Lawyer. The content on his channel is consistently enjoyable
1009260	1016700	and never stale or boring. If you are an auditory learner, then podcasts are fantastic. Darknet
1016700	1022120	Diaries is amazing, with great storytelling and incredible guests. The lessons learned are
1022120	1026340	valuable and always come in an entertaining package. If you want to develop your own podcast,
1026340	1030260	or if you want to direct your attention at certification to prove you know a specific
1030260	1036060	skillset, then Mike Myers on Udemy has, I personally think, the best online content
1036060	1042180	for CompTIA Security Plus and Network Plus. He does cover some physical security content
1042180	1048200	in the Security Plus lecture, and he does it in a very fun way. These three are Bill Nye-level
1048200	1052420	explainers, for those of you who are old enough to remember Bill Nye from the 90s.
1054460	1060540	Well, not everyone learns from books. I know I certainly can, specifically if the content is
1060540	1068140	fascinating to me. I tried to trim this down to a short list that I can recommend for everybody.
1069400	1075000	Social Engineering, The Science of Human Hacking by Chris Hadnagy is a very professional
1075000	1080340	and comprehensive guide to social engineering. If you want to learn more about that kind of
1080340	1086600	engagement, Practical Lock Picking by Deviant gives you a more complete understanding of locks,
1086600	1092580	not just how to pick them. The Art of Deception by Kevin Mitnick is super famous, and if you
1092580	1098420	haven't read it, you really should. Although, I will mention that Chris Hadnagy's book is more
1098420	1103800	of a scientific and professional approach to learning about social engineering. What every
1103800	1109620	body is saying is very useful if reading people. This is helpful in everyday life as well as on
1109620	1115480	the job. Just like previously, I wanted to throw in something strictly for those aiming at
1115480	1121880	certifications. I really am a huge fan of anything and everything under the ExamCram
1121880	1127560	brand. I really think they portray the information in a way that's very easy to absorb.
1129740	1135460	This was a big topic for me, and I hope to emulate those who helped me and pay it forward,
1135460	1140920	so to speak. Approach professionals and listen to talks.
1142180	1148940	Be courteous. These people are busy and have their own lives. That consideration aside,
1148940	1153660	security professionals are people and like to share their experiences. I have received an
1153660	1158320	amazing amount of support from the security community and wanted to list folks who were
1158320	1164820	large influences for me. I encourage you to pore over previous DEF CON talks and find individuals
1164820	1171080	who share your personal mindset and speak to you specifically. Use the knowledge shared in
1171080	1179300	venues like this to build an even stronger community of sharing. While I know I am
1179300	1184540	biased as an instructor, I recommend taking guided courses if you are able.
1187040	1194320	Here are some I personally plan to attend as soon as we are able. You can learn physical security,
1194320	1199460	social engineering, or really anything you like in a course guided by a professional
1199460	1206520	in the field. A textbook will never have all the answers. Being able to raise your hand and ask the
1206520	1212600	what ifs and what about this type questions are hugely valuable.
1216760	1222340	Since we are all at DEF CON, you all have already nailed this so well played,
1222340	1227780	attending events and local meetups is a great way to meet new people and network.
1230440	1236200	The people I have met in Orlando through meetups and events have truly driven my career. I was able
1236200	1241240	to learn all the skills I couldn't practice because either I personally did not have the tools
1241240	1246800	or the content online didn't quite break things down well enough for me. Just getting introduced
1246800	1252260	to people that could help me understand things between the lines of textbooks was awesome.
1252260	1258180	Huge shout out to the folks at CitrusSec in Orlando and DC407.
1261160	1266440	If you see your city on the list, then that means there is a chapter of the Open Organization
1266440	1271020	of Lockpickers in your town. I encourage you to reach out to your local tool group
1271020	1277080	and meet some cool people. If you don't see your city, good news! You can now start a chapter
1277080	1282240	in your town and find people that are into physical security. The Open Organization of
1282240	1288320	Lockpickers, or TOOL, has been amazing to me and I love being a member.
1291160	1297240	Second to last slide, I promise, but I want to say thanks to my family and friends. Mostly my
1297240	1303040	wife and kids. Thank you for understanding when I disappear into my lab for hours at a time for
1303040	1309920	random projects. Thanks Orlando hackers for just being total class acts. I want to thank TOOL for
1309920	1314240	providing me an unbelievable networking opportunity and the ability to practice
1314240	1319960	hands-on with locks and tools I would never have seen otherwise. Thanks GoldSky Security
1319960	1326120	for the opportunity to learn and grow in an incredible supportive environment. DEF CON,
1326120	1331700	thank you for having me. This event is so special. And to the hacker community at large,
1331700	1335000	keep being curious and keep pushing boundaries.
1337420	1343500	I love helping people who are getting started or maybe who are stuck on something. Feel free
1343500	1349960	to reach out. I might take a bit to respond, but I will do my level best to help. This was a lot
1349960	1355040	of information in a short amount of time. So if you want clarification on something,
1355040	1360920	I am at 31337Magician on Twitter, and here is my LinkedIn if you prefer that channel.
1361020	1364820	Thanks for listening to my talk. That's all I have on this topic,
1364820	1367820	but feel free to reach out if you want to have anything answered
1367820	1372460	that you are still curious about. Have an excellent day and enjoy DEF CON.