I'll Let Myself In: Tactics of Physical Pen Testers (2017) [video]

Looking lost or "looking for something" while wandering in is another great tactic.

Once upon a time, I worked at a Unix workstation manufacturer [1], which was having some financial problems.

The hardware developers worked in a room in the center of our offices. It had no windows, and one door to a hallways. If you went right down that hallway, you would pass my office and another programmer's office on your left, and my supervisor's office and the office of the head of software on the right, and then reach the back door to the office.

If you went left, you'd have to go past the reception desk and through an open area to reach the front door. Next to the front door was the office of the guy in charge of engineering.

The way the desks were arranged in all four offices in my hall, and in the engineering head's office near reception, you could easily see if anyone walked by.

The hardware developers had a large format printer in their area. That thing was something like 5 ft side, 4 feet tall, 3 feet deep, and weighed maybe 300 lbs.

One morning they printed something just before noon, then went to lunch. When they got back from lunch maybe 30 minutes later, the printer was gone. During the time they were out of the hardware area, I was in my office, and at least two other people were in their offices in my hall. The receptionist was at the front desk the whole time, and the engineering head was in his office.

None of us saw what happened to the printer. Later that afternoon the company we rented it from called and said that they had successfully repossessed it from us, so apparently a couple repo men managed to stroll into the office, passing several people, walk into the hardware area, disconnect the printer, and walk out with it, with nobody noticing.

Our office was just engineering. Sales and admin were in a different building in the same office park. Manufacturing, shipping, and the warehouse were in a third building there. Meetings with outsiders, even outsiders who were there to meet with engineers, took place in the conference rooms in the sales/admin building. We generally didn't have visitors in the engineering building except when interviewing someone for a job, and we always knew when those were expected.

[1] Callan Data Systems

https://www.youtube.com/watch?v=4YYvBLAF4T8

Deviant Ollam is always an interesting listen. He's got a very good way of explaining things in understandable layman's terms.