Question

A company has hired an external security consultant to conduct a thorough review of all aspects of corporate security. The company is particularly concerned about unauthorized access to its physical offices resulting in network compromises.

Which of the following should the consultant recommend be performed to evaluate potential risks?

A. The consultant should attempt to gain access to physical offices through social engineering and then attempt data exfiltration

B. The consultant should be granted access to all physical access control systems to review logs and evaluate the likelihood of the threat

C. The company should conduct internal audits of access logs and employee social media feeds to identify potential insider threats

D. The company should install a temporary CCTV system to detect unauthorized access to physical offices

Answer 1

The consultant should be granted access to all physical access control systems to review logs and evaluate the likelihood of the threat. (option B)

Step-by-step explanation:

Option B is the most appropriate choice for evaluating potential risks related to unauthorized physical access. Granting the external security consultant access to physical access control systems allows for a comprehensive review of access logs, helping to identify any irregularities or potential security vulnerabilities. This method provides insights into who has accessed the physical offices, when, and under what circumstances.

On the other hand, options A, C, and D have significant drawbacks. Option A, attempting to gain access through social engineering, could pose ethical and legal concerns. Option C focuses on internal audits and social media feeds, which may not directly assess physical access risks. Option D, installing a temporary CCTV system, addresses detection rather than evaluation and may not provide a holistic view of existing vulnerabilities.

Option B provides a methodical and focused approach to assessing the risk of unauthorized physical access by leveraging access control system logs, making it the most suitable recommendation for the security consultant.