The MSP Security Gap
The door held itself open.
The scenario:
A visitor walked into a legal firm's office carrying two coffee cups and a laptop bag, hands too full to badge in. An employee walking in behind him held the door, the way most people do for someone who looks like they belong and clearly cannot reach for a badge right now.
The badge reader logged one valid entry. Two people walked through.
How it unfolds:
The visitor was not a client, a delivery person, or anyone with legitimate business in the building. He walked confidently to an unlocked server closet on the same floor, a room secured only by the assumption that anyone inside the office had already been vetted at the front door.
He plugged a small device into an open network port, left within four minutes, and was gone before anyone thought to ask who he was.
The device sat quietly on the network for weeks, giving remote access to anyone who knew it was there.
The warning signs:
An unfamiliar face inside a secured area that nobody accounts for or vouches for
Doors or badge-controlled areas being held open as a courtesy, especially for anyone whose hands are full or who appears rushed
Physically secured rooms, like server or network closets, that rely on the building's front door as their only real security layer
Stop it:
Train staff that holding a secure door for someone else, even someone who looks legitimate, defeats the badge system, and that it's acceptable to ask a stranger to badge in themselves
Lock network and server closets independently of general office access, with their own access list separate from the building's front door
Physically inventory network ports in shared or semi-public areas of the office, disabling any not in use
-
P.S. Physical intrusion this direct is rare because it works so well when it happens, which is why most offices have never tested whether their layout and habits would stop it. Every layer of network monitoring in the world does not help if the entry point is a held door and an open port nobody is watching. Detection across the network itself, not only at the internet-facing edge, is what would have caught that device the moment it started talking to anything.