What can a victim company do when it&#39;s hard to differentiate between a Physical Pentest from a Criminal Physical Penetration
<p>Red Team: Adversary Simulation. A team of penetration testers (a red team) is hired to <em>legally</em> break into a facility to test its security.</p>

<p>Since the job of Red Teaming and Penetration Testing, especially physical, which is the focus of this question, involves a lot of traveling, it's hard to pin point a country to apply this question to. If it's absolutely necessary, let's assume US and European laws.</p>

<hr>

<p>Hypothetical Situation:</p>

<p>The company <strong>Blue</strong> hires the company <strong>Red</strong> to do a Red Team engagement on <strong>Blue</strong>. Here, I'll be discussing only the physical part of the engagement, not social and cyber.</p>

<p><strong>Red</strong> successfully infiltrates <strong>Blue</strong> and gives detailed reports of what was done in the engagement. Example part of the report:</p>

<pre><code>...
In building A:

At door A101, we picked the lock. Techniques used in picking: Raking, Bump Key.
At door A102, we picked the lock. Techniques used in picking: Raking.
...
</code></pre>

<p>The report includes details of techniques used to exploit and infiltrate.</p>

<p>A week after the engagement is done, <strong>Blue</strong> is attacked by real criminals and had their data exfiltrated from building A. They didn't have camera footage of every door exploited. Installation of the doors and locks in building A are confirmed to be proper and most likely picked. However, those doors/locks have also been reported to be picked by <strong>Red</strong> during their engagement the week before.</p>

<hr>

<p>The problem:</p>

<p>The locks being tested have been picked and exploited by both <strong>Red</strong> and the criminals. Forensics evidence would likely show traces of both or just <strong>Red</strong>'s engagement. Since red team engagements are to simulate real criminals as accurately as possible, it's hard to differentiate between evidence left by <strong>Red</strong> and those left by the criminals.</p>

<p><strong>Blue</strong> is highly confident that those locks were picked by the criminals, and let's assume they're correct about that. <strong>Blue</strong> wishes to investigate how exactly the criminals got in and track down those criminals. Additionally, <strong>Blue</strong> also wants to claim insurance for those locks being picked. (I've heard we can get insurance from the lock manufacturer if the locks are picked and we take damage from that)</p>

<hr>

<p>Question(s):</p>

<p>How can forensic evident on the locks be used in court (for insurance) and investigation? How <em>should</em> <strong>Blue</strong> use said forensic evidence to claim their insurance and track down the criminals when it's hard to distinguish between marks left by <strong>Red</strong> and the criminals?</p>

<p>It's not really a legal question, but a question of evidence. For an insurance claim, you usually have to show evidence of damage to the company. The damage is likely easy to show, but you'd also have to show evidence that you didn't do it yourself. "I didn't do it because that would be criminal" is often enough evidence. In your situation the insurance might want evidence that it wasn't the invited "red team" that caused the damage. </p>

<p>Worst case, you end up in civil court suing your insurance company, and there you have to demonstrate to a judge that it is more likely that the damage was caused by some criminals than being caused by your "red team". How you prove that is up to you. You also need to check your contract with the insurance, in case that inviting the "red team" somehow invalidated your insurance. </p>

evidence security