This happened about fifteen minutes into our assessment. One of the first things Nickerson did was point out was how the building's generator was both uncaged and unlocked. He even went up to the generator and opened up the doors. About ten minutes later, we were approached by a man who introduced himself as the facilities manager.
"Hi, how are you doing?" Nickerson said casually as he walked up to the approaching man.
"I understand you were looking at the generator and opening the doors on it. I got a security call," the facilities manager said, clearly concerned.
"Actually we are doing a security assessment and pointing out things around the building," said Nickerson.
"OK, and who do you work for?" the man asked.
Nickerson said we worked for CSO and the manager seemed satisfied with that answer.
"Alright, very good," he said as he left us to continue our assessment.
" I have absolutely no credentials on me that verify that," noted Nickerson. "So we were just allowed to go fully access the building, poke at stuff, and now we have a point of verification that is trust. Now we can go in and be even worse with the camera because we already have a pre-verified point and we know security has been called on us for opening generators. They are now actually going to help us into the building knowing full well what we are doing, even though they have no reason to believe us."
Nickerson said during his team's assessments, questions from client staff come up all the time. This is a common occurrence for him and his skill at the fine art of BS is obvious.
"People are usually good about asking what you are doing," he said. "But once you give them a viable excuse, they let you go. As long as you do your intelligence right, you will never get caught. People don't like confrontation."
We spent about 20 minutes more continuing to photograph the building and poking around. The facilities manager checked back on us before we left and asked for more details of our project.
"I just want to be clear that people are watching and I am getting calls," the facilities manager told Nickerson.
However, at that point, we had already collected enough information about the building to make any criminal's mouth water.
As we were heading out, we saw the manager on the generator, taking stock of its unlocked state.
"Hey you know what? I think we've already secured the building," Nickerson laughed. "See? Security assessments change facilities."
Join the CIO Australia group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.