Basic Physical Access Control System (PACS) Assessment

A basic assessment of your physical access control system (PACS). This focuses mostly on cloning but also looks for signs of reader configuration weaknesses and installation issues. This is a single day engagement and a report and is aimed at organisations for whom a full PACS audit is cost prohibitive. The approach is adversarial, seeing your system as the criminal does. We aim to give disinterested, neutral information which considers your system holistically and always looks for ways to improve your situation without spending a fortune.

The report will give a 1-6 rating for your access control system’s security based on the areas we cover. This rating is aimed to be easily understood by decision makers to communicate the skill required to compromise the system. Whilst we give this rating in isolation, our report does take the use of the system and where it sits in an overall system into consideration.

Our methods operate entirely independently of special installer or admin level access. We see what the criminal sees but we can also perform a significant degree of assessment without any involvement from installers, etc. This can be useful when documentation has been lost or installers with access and information have gone bust.

It should be remembered that a full PACS audit involves far more than this service offers. This service does not look at critical elements, such as policies or auditing active credentials against current employees or areas we feel can be adequately covered by your own estates teams after familiarisation on the day of the engagement.

Uses:

• Organisations who need an independent assessment of their system.
• Second opinion after a surprise assessment.
• Due diligence when moving premises.
• Review after recent installation.
• Investigation when system technologies, configuration, etc are unclear.

Report:

• A 1-6 rating representing ease of cloning of your cards / fobs.
• Suggestions for improvements and risk mitigation.
• Highlighting of any installation vulnerabilities and mitigation suggestions.
• Any evidence of reader configuration issues.

Not Included:

• Review of protocols, policies, etc.
• Extensive examination of controller, wiring, etc.
• Anything requiring installer level access.