A man in a high visibility jacket spent thirty five minutes in the comms room at head office in June. He had a lanyard, a clipboard and a bag of tools, he propped the door open with a fire extinguisher while he worked, and he walked out past nine people. He was entirely legitimate, engaged by the landlord's fire alarm contractor, and I learned about it four days later because somebody from finance mentioned it to me in a lift.
Nobody had asked him anything. Not who he was, not who had let him in, not what he was doing beside the cabinet that every system in that building passes through.
I spent a week on physical access afterwards and it was the most uncomfortable week of my year. The reception sign in book is a book, and nothing is ever reconciled against it. The door code for that room was set in 2014 and is known to a cleaning contractor whose staff turn over roughly twice a year. At two depots the cameras record to a box whose disk failed in 2023, which nothing monitored and nobody had noticed. And our largest depot has forty one access fobs issued against twenty six employees, because a fob has never once appeared on a leaver checklist in the fifteen years we have used them.
That last point is the one I keep returning to. My department runs a careful process for accounts, laptops, licences and mailboxes the day somebody leaves. Keys, codes and fobs belong to facilities, who were never asked to join it, and a door does not send anyone a report.
The changes are ordinary. Comms rooms at the four largest sites sit on the building access system with logged entry, and the smaller ones behind a key safe whose code the service desk issues and records. Codes rotate on a leaver event rather than annually. Any contractor working in a technical space is escorted, and the escort is named on the work order before the visit. Camera recording state is monitored like any service we depend on. And the leaver checklist has a physical section, signed by the site contact.
Every control I am proud of assumes the person trying to get in is somewhere else. The cheapest route past all of them is a van, a clipboard and a polite manner.
– Serguey Shinder
Top comments (0)