Using Detection Evidence

The lesson on detection controls decided where cameras, motion sensors, locks, and guards belong. This lesson reads the evidence those controls and a badge door produce once they're in place: an alert, a picture, a door log. For each kind, the questions are what it shows, what it leaves out, and what a defender checks next.

A regional crime lab keeps its evidence in a storage wing. Evidence enters at an intake counter, and a corridor runs from the counter past the evidence room, whose door opens to a staff badge, to long-term storage. Cameras cover the counter, the corridor, and the storage room, and a motion detector also covers the storage room. The night supervisor watches them from a monitoring desk. One night shift brings two alerts, and the evidence room door keeps a week of records.

The intake camera's live feed shows the counter as it happens, and its recording keeps a visual record of what took place there. The camera is also paired with facial recognition software. The software compares each face it sees with the faces enrolled as staff, and alerts the desk when a face matches none.

At 11:16 p.m. the desk gets an alert: a face at the intake counter isn't enrolled as staff. The supervisor, busy with another feed, opens the intake camera two minutes later and finds the counter empty. The alert says a face at the counter matched nobody enrolled as staff. It doesn't say who that was, where they went, or what they did.

The person's path and actions come from two sources. The recording covers the two minutes before the supervisor looked. The live feeds cover everything after.

The path runs from the counter, down the corridor to the storage room door, and back out. Along the way the person did two things. They photographed tonight's intake entries, so that information has left the wing, and they tried the storage room door, which held. It's easy to start the account at 11:18 p.m., when the supervisor looked, but the photograph is only in the recording. The supervisor called the building's security officer at 11:18 p.m., but the officer reached the wing at 11:23, after the person had gone.

At 1:37 a.m. the motion detector in long-term storage raises an alert. Nobody works in that room at night, and its door is the one the visitor tried two hours earlier. The alert reports motion in the room. It doesn't say whether a person caused it.

On the storage room camera, the live feed shows the room empty and a box on the floor below a top shelf. An empty room now doesn't prove the room was empty at the alert, since a person could have come and gone within a minute. So the supervisor plays the recording from 1:35 to 1:39. At 1:37 a box slides off a top shelf onto the floor, and nobody enters or leaves. The box caused the motion, and no breach happened. As at the intake counter, the live feed showed the room now and the recording showed the moment of the alert.

The evidence room door unlocks only for a staff badge, and a sensor on the door times each opening. Each morning the door system summarizes the night shift. The summaries for one week follow.

EVIDENCE ROOM DOOR, NIGHT SHIFTS, ONE WEEK
NIGHT  OPENINGS  MEDIAN (s)  LONGEST (s)
Mon    14        5           9
Tue    11        6           8
Wed    16        5           10
Thu    12        5           9
Fri    13        6           74
Sat    9         5           8
Sun    10        6           9

The first thing to read is what's normal for this door. Every night the median opening is 5 or 6 seconds, so half the openings took that long or less. That's about the time one person needs to badge, open the door, walk through, and let it close. On six of the seven nights the longest opening is between 8 and 10 seconds. So an ordinary opening of this door lasts 10 seconds or less.

Friday's median is 6 seconds, within the usual 5 to 6, but its longest opening is 74 seconds. That's more than seven times the longest opening on any other night. A door open that long after one badge leaves time for a second person to pass through.

A second person on one badge is what piggybacking and tailgating share, and the physical attacks lesson told them apart by who knew. In piggybacking, the adversary talks the badge holder into letting them in, so the badge holder knows. In tailgating, the adversary follows close behind without the badge holder knowing. Friday's 74-second opening is possible evidence of either attack.

The summary doesn't say whose badge opened the door or when, and a door held open for an evidence cart runs long too. So the defender pulls Friday's entry log for that opening, then the corridor camera's recording at that minute, which shows whether a second person went in.