Was Hudson installing Riverbed network devices?

So the building physical security system is run off the same hardware as the business network. Even allowing for VLANs, is this normal?

It is everywhere I've worked.

Most lock controllers are now PoE, so when the switch is powered down, the lock will either fail secure, or fail safe. Most sensible installers will add a battery back-up to any external doors, and those controllers have a local database of recently used cards for when they lose contact with the central server.

The last big place I worked at had dedicated wiring for the electronic locks. That wiring ended up at a big box in the Facilities/Security building, with a dedicated Windows PC in the Security room connected to the control box via RS232C.

Most servers, the NOC, the mainframes, and the Help Desk all resided in four different buildings.

That sounds like an old (and probably very reliable) system. The RS232 / 485 systems were great, but more expensive to install, and usually relied solely on the central data store, so power cuts would see the lock controllers fail. The place I currently work had that problem. and we all got locked out one morning after a powercut saw all the external doors firmly locked. Luckily someone had left a window open, so the smallest member of staff had to break in and physically remove the magnet from the front door.

I don't think I've seen a hard wired system that works with anything newer than Windows 7, so probably best to keep the system well away from the internet. Great for a single site, not so great for a multi-site operation.

The security building had its own Diesel generator and battery back-up system, but it was "their" system, IT was kept away from it, and I knew nothing about their maintenance and test procedures, if any.

The locks ran on 24 VDC, and the control PC ran Windows 3.1. (It was in the 1990s/early 2000s.)

I'd initially thought this was about building security and the way companies spend thousands on e-security only to leave themselves wide open to a 'people hack'. As in a recent BBC podcast on this topic. There's a book too.

People Hacker: Confessions of a Burglar for Hire https://www.amazon.co.uk/People-Hacker-Jenny-Radcliffe/dp/1398519014

That actually ended up happening, popping hinges is the oldest trick in the book!

I think one of the issues is that it seems like many "high-tech" security systems are designed without consulting designers of "legacy" security systems, which effectively means every lesson they learned the hard way, has to be learned yet again.

You commonly see logically bulletproof electronic systems, but they can be bypassed by shims, magnets, picking poor backup locks, or simply a large heavy object.

The LockPickingLawyer has a great series of videos comically bypassing locks, i highly recommend watching them if you want a good laugh.

A few years ago I was working at a large boarding school.

Its location in a small, respectable town meant that security wasn't really a high priority, with most buildings unlocked for much of the day, even though the local towns people would regularly walk their dogs in the grounds.

During lockdown though, we had a few issues with visitors to the area wandering around the buildings, somehow assuming we were a local attraction (the buildings were open so the site team and IT department could take advantage of the empty site to do essentially upgrades)

One of the leadership decided we needed to join the 21st century and ordered a fancy Paxton 10 system. At no point did he let us know in IT until the engineer arrived on site to do the install.

This system was so new, the engineer had never seen one before, and as he'd only just returned from furlough that morning, he'd not had any training - hurdle number 1

Hurdle number 2 - these locks all used PoE+, and we had no spare capacity on the PoE switches, so we needed new switches for every building, 15 new switches were ordered for next day delivery.

Hurdle number 3 - there was no structured cabling anywhere near most of the doors, so we had to run new wiring.

The system was installed, tested and commissioned just in time for the kids to return from lockdown 2

Hurdle number 4 - the locks were bluetooth, something the guy who ordered the locks hadn't thought about, naturally. His answer, the kids can download the app to their phones. Ahh, they're not allowed their phones in lessons. We could order 600 bluetooth fobs, I suggest. Ahh, nothing left in the budget.

We estimate the 30 locks, with 15 switches, cabling, 4 days installation time, new server and software, cost around £3,000 per door, and they were never used.

The server was quite nice though, an i7 Intel NUC which found a use controlling a display wall in the new 6th Form building

Manglement gets a "bright" idea and goes about spending money without any analysis whatsoever.

The new kit cannot be installed without yet more kit, so another round of spending because hey, manglement is never wrong, right ?

Finally, new kit is installed at x times the cost, hits another hurdle and manglement gives up.

At least you got a nice server out of it.

That's hilarious, i see this sort of thing a lot but they rarely score that high on the incompetence scale!

You're also damn lucky you could get your hands on that many switches during that time period. I have pretty good rapport with a couple of large vendors but i was really struggling to get my hands on switches during that time period.

We were going to order those switches for a different project at another school site, so they'd been reserved for us.

The huge overspend on the access control SNAFU meant that project was sidelined.

What we did have a huge problem with was webcams, they were rare as hens teeth, and kept going missing, so had to be replaced. I ended up ordering a box full direct from Logitech at about 3x the pre-pandemic price, it was handy having the IT director's credit card details...

I believe Deviant Ollam is the better choice for intrusion videos.

Darknet Diaries and, to a lesser extent, Malicious Life have both done multiple episodes on using social engineering to bypass both physical and logical barriers put up by companies with huge security budgets. Jenny Radcliffe (who wrote the book Nifty linked to above) was on Darknet Diaries ep #90 (simply called "Jenny"), and there have been many others. Anything with Rachel Tobac is worth listening to, as is Alethe Denis; but pretty much all of them are fascinating. (There are occasional exceptions where you can tell that the person being interviewed is CLEARLY exaggerating what happened to them and don't get challenged by the interviewer.)

Some ploys used by social engineers are extremely elaborate, but in many cases the old trope of people always stopping to let a person wearing a high-viz vest and carrying a clipboard through any door still seems to hold scarily true.

...

"Manual override, sir"

occurred at my university when the builders of a shiny new building forgot to install electronic locks on certain doors. These were doors to labs with kit like powerful lasers or other expensive and potentially dangerous kit was housed. Apart from not installing an electronic lock, no mechanical lock was installed either, so anyone could just stroll into these labs. Quite apart from kit being stolen, sauntering into a lab where powerful lasers are being operated without wearing suitable safety goggles is not high on my list of recommendations. The building itself is open to the public during daytime, so a lot of people were less than pleased. Quite the security and safety nightmare. Moving labs from the old building to the new had to be delayed.

The Nixon Administration's "plumbers" were undone when they taped-over the openings of striker plates of doorlocks while they were breaking into the Democratic Party's headquarters in the Watergate Hotel.

A semi-ept security guard found the tape and removed it (yet did not call in a general alert).

I expect a techie's hold-the-door-open chocks would be removed, if discovered by Security.

much better to stuff the striker plate full black fabric, harder to see than tape over the opening.

I have some little blocks of wood which fit into the latch-hole for this very purpose. A bit of silver or black duct-tape and they are almost invisible.....

We were at bank's HQ, and were meant to be escorted every where. We were only allowed in the operations room in special circumstances.

On our last day we had a meeting scheduled for the conference room in the operations area.

We parked our car, walked to the building and saw the door locks were green, so in we went, and found the operations area. The cleaner was there doing the room, and had blocked the door open to use the power supply outside the area. We smiled at the cleaner, said Hello, and sat down and did our preparation.

A little while later someone(we were working with) came past and asked "How did you guys get in here". We explained.

He came back later and said that there had been a little glitch with the outside doors (power ?) and they all unlocked for about 30 seconds. He also said he would fix the cleaner. I think this meant education and the provision of a "cleaner's socket" inside the secure area.

Did you see the cleaner again? Or was anyone perchance laying new concrete as you were leaving?

Enquiring minds and all that...

Working overnight when the power went out. Generator didn't kick in (broken switch in the start panel), and because of a fault on the building management system, switching to UPS failed too - and was behind 3 locked doors (locks failed shut with loss of power).

We had no choice but to kick the doors open (which was fun with only a small torch, especially as one of the rooms was a lights-out machine room - eerie in its own right as we were so used to the noise we usually heard in there).

Still, one screwdriver in the switch started up the generator. The rest of the night was spent recovering systems.