How to test your office network for physical access risks

Physical network security is easy to overlook when most attention goes toward firewalls, antivirus software, and endpoint protection. But an unlocked server room, an exposed switch port, or an unmonitored Ethernet jack in a meeting room can hand an attacker direct access to your internal network in minutes. Conducting a structured penetration testing assessment of your physical network access points is one of the most practical ways to find those gaps before someone else does. This guide walks you through the full process, from preparation to remediation, so you can complete the assessment with confidence.

What you need before starting the assessment

Before you touch a single cable or access panel, gather the right materials and confirm you have the authority to conduct the assessment. Performing this kind of test without documented authorization, even on your own employer’s network, can create legal and organizational complications. Get written sign-off from the appropriate stakeholders before you begin.

• A floor plan or building layout showing all offices, server rooms, comms closets, and shared spaces
• A laptop or device capable of running network scanning tools such as Nmap or a similar utility
• A portable network tester or cable tester to check live ports
• A notepad or digital template for logging findings as you go
• A copy of the organization’s current network diagram, if one exists
• Written authorization from IT management or the appropriate decision-maker

If your organization does not have an up-to-date network diagram, that is itself a finding worth noting. You will be building a clearer picture as you work through the following steps.

Map all physical network access points

Start by walking the entire facility and cataloging every location where a physical connection to the network is possible. This includes obvious locations like server rooms and IT closets, but also less obvious ones like conference rooms, reception desks, hallways, and shared printing areas. Attackers often target low-traffic areas precisely because they go unnoticed.

1. Walk each floor or zone of the building systematically, room by room.
2. Identify and record every Ethernet wall jack, patch panel port, network switch, and wireless access point.
3. Note the physical condition of each point: is it labeled, locked, or exposed?
4. Mark locations that are accessible to visitors, contractors, or members of the public without escort.

After this walkthrough, you should have a complete list of every physical access point in the building. Cross-reference this list against your existing network diagram if you have one. Any ports or devices that appear on your physical list but not on the diagram are immediate red flags that need further investigation.

Test each access point for live connectivity

Not every wall jack or patch panel port is active, but you cannot assume an unused-looking port is disconnected. Many organizations leave ports live after employees move desks or departments change, creating open entry points that nobody is monitoring. Your job in this step is to determine which ports carry a live network signal.

1. Plug a network tester or a laptop into each port and check for link activity.
2. For ports that show activity, use a network scanning tool to identify what network segment or VLAN the port connects to.
3. Note whether the port provides access to a guest network, the internal corporate network, or a sensitive segment such as a management or OT network.
4. Record the physical location, port identifier, and network segment for every live port you find.

Pay particular attention to any live port located in a publicly accessible area, such as a lobby, waiting room, or conference room. A live port with access to the internal corporate network in an unsecured location is a high-severity finding on its own, regardless of what else you discover.

Check for rogue devices and unauthorized connections

Rogue devices are unauthorized hardware connected to your network, ranging from personal routers and switches to deliberate implants placed by someone with physical access. They are among the most dangerous physical security risks because they often operate silently for extended periods. This step focuses on identifying anything connected to the network that should not be there.

1. Run a network scan using a tool like Nmap across each subnet identified in the previous step to enumerate all connected devices.
2. Compare the discovered device list against your authorized asset inventory. Flag any device that does not appear on the inventory.
3. Physically inspect switches, patch panels, and accessible cable runs for any hardware that has been added without authorization, including small form-factor devices plugged into switch ports.
4. Check wireless access points for unauthorized SSIDs or rogue APs broadcasting from within the building.

If you find a device you cannot immediately identify, do not disconnect it without coordinating with your IT team. Disconnecting a device abruptly can disrupt legitimate services if the asset inventory is incomplete. Document it thoroughly first, then follow your organization’s incident response procedure to investigate and remove it safely.

Evaluate access controls around critical network hardware

Physical access controls are the last line of defense for your most sensitive network hardware. A switch or router that anyone can walk up to and plug into, or worse, physically reset, represents a fundamental security failure that no software control can fully compensate for. Evaluate whether your critical hardware is adequately protected.

1. Inspect server rooms and network closets to confirm they require key card access, a physical key, or another authenticated entry method.
2. Check whether entry logs exist and are reviewed regularly. A door that requires a badge but whose logs are never audited provides limited protection.
3. Verify that network switches and routers are mounted in locked cabinets or racks, not left open on shelves.
4. Confirm that console ports on critical devices are either disabled or require authentication before use.
5. Check whether cameras cover entry points to sensitive network areas and whether footage is retained for a meaningful period.

After reviewing each control, note whether the protection in place is technical, procedural, or physical, and whether it is actually enforced. A policy that says only IT staff may enter the server room means nothing if the door is propped open during the day.

Document findings and prioritize remediation steps

A thorough assessment is only valuable if its findings lead to action. Compile everything you have recorded into a structured report that clearly describes each finding, its location, the risk it presents, and the recommended fix. Prioritize findings based on the combination of likelihood and impact: a live port in a public area with access to the internal network ranks higher than an unlabeled but inactive jack in a locked room.

1. Group findings by severity: critical, high, medium, and low.
2. For each finding, write a brief description of the issue, where it was found, and what an attacker could realistically do with it.
3. Pair each finding with a specific, actionable remediation step, such as disabling the port, adding a lock, or updating the asset inventory.
4. Assign ownership for each remediation item so it is clear who is responsible for resolving it.
5. Set target completion dates and schedule a follow-up review to confirm fixes have been implemented.

Physical network assessments like this one should not be a one-time exercise. Networks change, people move, and new hardware gets added. Running this process at least once a year, or after any significant office renovation or infrastructure change, keeps your physical security posture current. If your team lacks the bandwidth or expertise to conduct these assessments internally, we are here to help. Reach out to us to discuss how we can support your organization with ongoing security assessments tailored to your environment.