Prohibition of Devices On-site

A subject attempts to defeat physical security controls by smuggling an item (potentially an innocent item at first) into a controlled area to facilitate an infringement (such as a smart phone with a camera).

A subject can capture photos, videos and/or audio with an external device, such as taking photos of a screen, documents, or their surroundings.

A subject uses an external device, such as a mobile phone or camera, to record audio, photos, or video to capture media.

A subject can mount and write to removable media.

A subject observes and/or records the locations of CCTV cameras in a target area.

The subject performs work-related tasks on an unauthorized, non-organization-owned device, likely violating organizational policy. Without the organization’s security controls in place, this device could be used to bypass established safeguards. Moreover, using a personal device increases the risk of sensitive data being retained or exposed, particularly after the subject is offboarded, as the organization has no visibility or control over information stored outside its managed systems.

An organization has a Bring Your Own Device (BYOD) policy, where a subject is authorized to connect personally owned devices—such as smartphones, tablets, or laptops—to organizational resources. These resources include corporate networks, cloud applications, and on-premises systems that may handle confidential and/or sensitive information.

The use of personal devices in a corporate environment introduces several risks, as these devices may lack the same level of security controls and monitoring as organization-owned equipment.

A subject exfiltrates files using AirDrop as the transportation medium.

A subject exfiltrates files using BlueTooth as the transportation medium.

A subject uses a device, such as a mobile phone or camera, to take photos containing sensitive information.

A subject uses an external device, such as a mobile phone or camera, to take video recordings containing sensitive information.

A subject uses an external device, such as a mobile phone or camera, to take record audio containing sensitive information, such as conversations.

A subject can mount and write to a USB mass storage device.

A subject can mount and write to an SD card, either directly from the system, or through a USB connector.

The subject uses a USB cable, and any relevant software if required, to transfer files or data from one system to a mobile device. This device is then taken outside of the organization's control, where the subject can later access the contents.