Dressed in black camo, hiding in the woods in the dead of night on the edge of a Pennsylvania mountain; it's not your typical IT job.
But that's where Matt Neely found himself a few years back. As vice president of consulting for SecureState at the time, Neely's job was to test the physical security of his firm's clients, which include large federal agencies, major retailers, energy plants, and even entire countries. Trained in the art of picking locks by his previous employer (a bank), Neely uses his breaking-and-entering skills so that organizations can find holes in their perimeter and fill them.
On this cold December night, Neely and a colleague were asked to break into a mining facility just past midnight and steal "trophy data," while two other SecureState penetration testers social-engineered their way in via the front gate. The coal mine was concerned about environmental activists breaking in and tampering with its SCADA systems, causing the mine to shut down. They had good reason to worry.
According to Neely, the mine's external security was so porous that he and his partner were in and out in 10 minutes, or about two hours and 20 minutes less than he'd bargained for. The area around the mine was so remote there was no cellphone coverage, so he had no way to reach the other SecureState team. He and his partner had to hunker down for two hours in a freezing rain before they got picked up.
Roughly 75 percent of the time, Neely says he's able to break in to a facility without getting caught. On the other hand, he says his social-engineering comrades succeed about 90 percent of the time -- and when they fail it's usually because somebody got tipped off a test was coming.
Neely always carries a "get out of jail free" card on his jobs, listing the names and numbers of company personnel who've authorized the security test. So far, he's never had to use it -- even when caught red-handed breaking into a power plant by the cops. Fortunately for Neely, SecureState's policies prohibit performing tests on facilities where the guards carry weapons.