FORTRESS Framework

The speaker, who has tested physical security for about fifteen years, argues that the field lacks a structured methodology. Assessments are often ad hoc, driven by personal checklists and scattered notes, so reports from different firms or teams are hard to compare. He says compliance regimes such as HIPAA and CMMC call for physical testing that is frequently skipped or treated lightly.

He introduces FORTRESS as a web application that organizes physical attacker behavior into tactics, techniques and procedures, in a style modeled on MITRE ATT&CK. Each entry links to compliance controls and includes execution steps, pass or fail validation, and evidence requirements. The talk walks through attack chains for both a simple assessment and a full red-team engagement, covering reconnaissance of entry points, guards and cameras, tailgating, badge bypass, impersonation and movement between floors. He also shares lessons from his own work, including a detention after entering a facility the client did not actually control, and the need to photograph proof.

The takeaway is that physical testing should follow a repeatable method, check rules of engagement first, and record findings as the work proceeds. The speaker plans to add report generation and blue-team detection content in future versions.