Plan, Deploy and Engage in Authorised Physical Penetration Testing — Qualifications Network Occupational Qualification Public Services Revision
This element focuses on the end-to-end execution of authorised physical penetration testing, from initial desktop reconnaissance and site assessment throug
Topic Synopsis
This element focuses on the end-to-end execution of authorised physical penetration testing, from initial desktop reconnaissance and site assessment through to operational planning, deployment, and post-engagement reporting. Learners will develop the practical skills to identify vulnerabilities in physical security controls, produce comprehensive operation orders, and deliver professional debriefs and client reports. Mastery of this process ensures that security assessments are conducted ethically, safely, and effectively, providing actionable intelligence to improve client security posture.
Key Concepts & Core Principles
- Lock picking and bypass techniques: Understanding pin tumbler, wafer, and disc detainer locks, and using tools like tension wrenches and picks to manipulate them without damage.
- Social engineering: Exploiting human psychology to gain unauthorised access, including pretexting, tailgating, and phishing, and how to test staff awareness.
- Electronic access control systems: Assessing vulnerabilities in RFID cards, keypads, biometric scanners, and intercoms, including cloning and replay attacks.
- Reporting and documentation: Writing clear, actionable penetration test reports that identify risks, provide evidence, and recommend mitigations in line with industry standards.
Exam Tips & Revision Strategies
- Always cross-reference your reconnaissance findings with a physical visit plan, and be prepared to justify why certain observation points or times were chosen based on initial desktop intelligence.
- In the debrief and report, explicitly map each vulnerability to the reconnaissance and testing evidence, demonstrating a clear chain from discovery to recommendation.
- Practice writing operation orders under simulated time pressure to ensure they remain concise yet comprehensive, with special attention to communication loss contingencies.
- When performing the test, document everything contemporaneously (e.g. photos, notes, timestamps) as this forms the basis of a credible client report and validates your findings.
Common Misconceptions & Mistakes to Avoid
- Failing to verify the scope and legal authorisation before commencing reconnaissance or testing, leading to potential unauthorised surveillance or trespass.
- Overlooking open-source intelligence (OSINT) gathering techniques, resulting in an incomplete desktop reconnaissance and missed vulnerabilities.
- Confusing observation with analysis: students often record security measures without interpreting their effectiveness or interdependencies.
- Producing an operation order that is too rigid or lacks contingency planning, which can paralyse the team when unexpected situations arise during the test.
- Misinterpreting rules of engagement, especially regarding areas that are explicitly out of scope, which can lead to breaches of trust or legal consequences.
- Submitting a client report that is overly technical without clear executive summaries or actionable recommendations, diminishing its practical value.
Examiner Marking Points
- Award credit for demonstrating a systematic approach to desktop reconnaissance that identifies relevant public and non-public information sources, including social media, mapping tools, and regulatory filings.
- Expect a detailed reconnaissance plan that outlines specific observation points, timings, equipment requirements, and risk assessments tailored to the target site.
- Assess the ability to accurately identify and document security provisions such as access control systems, surveillance coverage, guarding patterns, and physical barriers through direct observation.
- Credit a detailed operation order that includes clear objectives, team roles, communication protocols, rules of engagement, contingency plans, and an explicit ethical framework for the penetration test.
- Look for proficient execution of the physical penetration test, demonstrating appropriate tradecraft (e.g., lock picking, tailgating, social engineering) while adhering to safety and legal boundaries.
- Award marks for a comprehensive debrief that systematically reviews objectives, methods, outcomes, and lessons learned, and a client report that translates technical findings into clear, prioritized recommendations with supporting evidence.