All tagged tip
CARVER is an acronym that stands for Criticality, Accessibility, Recuperability, Vulnerability, Effect and Recognizability. It’s a system used by Special Forces to assess the targets and see which one needs to be addressed first. Let me write down what each component means in terms of information security.
A few years back, a customer asked us to test their newly installed (and very expensive) surveillance and security system. The products promised them an automated system that was so secure they wouldn’t have to place a security guard there.
After some recon we discovered that while the entrance was guarded by a very secure keypad + access card combination lock, the inside had an automated “unlock” sensor so if anyone wanted to come out, the door would unlock from the inside.
After some careful review of the pictures we took we found out that the top and bottom of the doors were not sealed tight against the floor, we could see a tiny bit of light from there (we took the pictures with a high resolution night capable camera). A plan was set in motion.
We arrived, we approached the door and we remove the piece of gear that would, hopefully, allow us to bypass the very secure lock: a old credit card.
We slid the old credit card under the door and… nothing.
This is an idea I've been playing with for a while. It's still under development, but the basic technique is similar to the one snipers use to search and detect targets.
One of the skills we learned at the scout/sniper school was the detection of targets. We would lay on our bellies and try to find hidden objects that the instructors placed in the field via the use of scopes. We also needed to detect an instructor acting like a sniper.
All the objects (or potential threats) were hidden in a large piece of land, some close and some far. It would have been almost impossible to randomly start scanning for the targets in such a large area, so a simple technique was used: begin scanning with the naked eye for objects near and from left to right, then move a bit farther from right to left, etc. Once you get to a point where the naked eye is not good anymore, use a scope.
Essentially you create a grid on the area where you move from close to far and from left to right and scan each sector for a potential threat, then you log everything you see.
