Testing Security Controls

A subject attempts to access a system, repository, application, physical area, account, record set, or other restricted resource to determine whether the applicable access control prevents entry or generates a response.

The subject may use their own identity to request or attempt access slightly outside their normal responsibilities, test an expired or unauthorized physical identity token, navigate directly to a restricted application resource, or attempt to view information associated with another team, customer, case, or business function.

The action may be deliberately limited so that it can be described as accidental if challenged. Repeated denied attempts, access testing across several resources, or a later successful entry may indicate that the subject is mapping authorization boundaries before conducting unauthorized access or another infringement.

A subject conducts a limited transfer of non-sensitive or low-value data to determine whether organizational controls detect, block, quarantine, or escalate the activity.

The subject may send a file to a personal email account, upload content to an unapproved cloud storage service, transfer data through a messaging platform, or use another external destination before attempting a larger or more sensitive transfer. They may vary the file type, size, classification, destination, compression, encryption, or transfer method to identify which conditions trigger Data Loss Prevention (DLP), web proxy, email gateway, or cloud access security controls.

The behavior may include a pause after the test while the subject waits to determine whether security personnel, management, or another authority responds. A successful test may establish a viable exfiltration route or reveal thresholds that can be avoided during a later infringement.

A subject performs a limited action on an organizational endpoint to determine whether software restrictions, endpoint security controls, browser management, device controls, or application policies prevent or report the behavior.

The subject may install a low-impact unauthorized application, add a browser extension, execute a portable utility, alter a minor endpoint setting, or attempt to run software from an unusual location. They may also connect a removable device or use a test script to establish whether application allowlisting, Endpoint Detection and Response (EDR), antivirus, mobile device management, or device-control policies are active.

The test may be designed to resemble ordinary experimentation or troubleshooting. Investigators should consider whether the subject subsequently used the same installation method, application type, device, or control weakness to support data collection, persistence, circumvention, or another infringement.

A subject conducts a minor policy violation or suspicious action to determine whether the organization detects the behavior, how quickly it responds, and which personnel or processes become involved.

Unlike testing a particular technical control, the subject is assessing the organization’s wider investigative and enforcement response. They may perform an observable but low-impact action, wait to see whether they are contacted, and use the absence, timing, or nature of the response to estimate alert-review practices, escalation thresholds, investigative coverage, or Organizational Tolerance.

The subject may repeat similar tests through different systems or channels to establish whether detections are centrally correlated. They may also deliberately pause before escalating, allowing time to determine whether the test has produced a security, management, Human Resources, or compliance response.

Investigators should look for a sequence consisting of a minor test action, an observation period, and a later increase in severity or volume. Repeated low-level infringements without corrective intervention may provide the subject with confidence that more serious activity will also go undetected or unenforced.

A subject performs limited network activity to determine whether firewalls, network segmentation, Domain Name System filtering, web proxies, intrusion detection systems, or protocol restrictions identify or block the connection.

The subject may attempt to reach a prohibited domain, connect to a restricted port, access another network segment, use an unapproved protocol, configure a proxy, or send a small amount of traffic through a normally restricted route. The objective is to establish whether the network path is available and whether the activity produces an alert or investigative response.

Testing may be repeated across different destinations, ports, protocols, systems, or times of day. A subject may use the results to select a less monitored network route, bypass segmentation, communicate with external infrastructure, or prepare a data-transfer channel.

A subject performs a limited physical action to determine whether access controls, security personnel, surveillance, visitor procedures, alarms, or other physical safeguards prevent or identify unauthorized presence.

The subject may test a restricted door, present a credential at an unauthorized area, follow another person through a controlled entrance, remain in an area after their approved access period, or enter a sensitive location without a clear operational reason. They may also observe whether security personnel challenge unfamiliar subjects or whether physical access violations generate follow-up activity.

The behavior is distinct from general physical exploration because the subject actively interacts with or crosses a security boundary to evaluate the result. The test may support later unauthorized entry, physical sabotage, theft, access to infrastructure, or facilitation of another person’s presence.