Full Disk Encryption

A subject deliberately takes or appropriates physical assets belonging to an organization without authorization. This may include corporate laptops, mobile phones, storage devices, IT equipment, physical documents, or other organizational property.

Theft may result in financial loss, operational disruption, or the unauthorized possession of sensitive organizational information. Where stolen assets contain or provide access to organizational data, the infringement may also create opportunities for subsequent unauthorized access, data disclosure, or exfiltration.

A subject has the ability to access the system startup firmware of a target device, typically through the Basic Input/Output System (BIOS) or Unified Extensible Firmware Interface (UEFI). This access may allow the subject to view or modify low-level hardware and startup configurations, including boot device priorities, firmware security settings, and device initialization options.

Access to system startup firmware may enable the subject to alter how a device starts, initiate booting from external media, or modify security configurations that govern the startup process. Depending on the device configuration and available protections, these capabilities may facilitate subsequent unauthorized access to local storage, circumvention of operating system controls, or other preparatory activity.

The subject accesses or uses a corporate hardware asset, typically a laptop or other endpoint device, that is not assigned to them by role, provisioning, or inventory records. This behavior often emerges in environments with weak asset lifecycle controls, during periods of staff transition, or when hardware is reissued informally without updating allocation systems.

Subjects may obtain unassigned hardware through dormant inventory, “loaner” pools, peer handoffs, or by reactivating previously deprovisioned devices. Use of unassigned hardware circumvents standard monitoring, ownership attribution, and access governance. It may be leveraged to evade visibility, perform preparatory actions, or compartmentalize risky activity away from their primary, monitored device.

Investigators should view such access as a strong early indicator of potential infringement(s), particularly when associated with stale or unmanaged hardware, elevated privilege configuration, or the absence of endpoint telemetry.

When a Mac is booted into Target Disk Mode (by powering the computer on whilst holding the ‘T’ key), it acts as an external storage device, accessible from another computer via Thunderbolt, USB, or FireWire connections. A subject with physical access to the computer, and the ability to control boot options, can copy any data present on the target disk, bypassing the need to authenticate to the target computer.

A subject has the ability to place a compatible Intel-based Mac into Target Disk Mode, allowing the device to function as an external storage drive when connected to another computer through a supported interface, such as Thunderbolt or FireWire. This capability enables direct access to the target device's storage without booting into its normal operating system.

Target Disk Mode may allow the subject to examine, copy, or modify files stored on the device, depending on the available permissions and disk encryption protections. This capability may facilitate unauthorized data access or subsequent exfiltration, particularly where the subject has physical access to the device and can control its startup options.

Subjects with physical access to critical hardware—such as data center infrastructure, on-premises servers, network appliances, storage arrays, or specialized equipment like CCTV and alarm systems—represent a significant insider threat due to their ability to bypass logical controls and interact directly with systems. This level of access can facilitate a wide range of security compromises, many of which are difficult to detect through conventional digital monitoring.

Physical access may also include proximity to sensitive areas such as network closets, on-premises server racks, backup repositories, or control systems in operational technology (OT) environments. In high-security settings, even brief unsupervised access can be exploited to compromise system integrity or enable ongoing unauthorized access.

With this type of access, a subject can:

• Extract or clone drives and media for offline analysis or exfiltration of sensitive data, including proprietary documents, logs, authentication secrets, and configuration files.
• Introduce malicious hardware or firmware, such as USB-based keyloggers, hardware implants, or modified components that persist beyond reboots and may evade traditional endpoint protections.
• Bypass access controls by booting from external media, altering BIOS or UEFI settings, or resetting system passwords using direct hardware manipulation.
• Install or modify software directly on the system, enabling surveillance tools, remote access backdoors, or malicious code that blends in with legitimate system processes.
• Capture network traffic by tapping physical interfaces or inserting intermediary devices such as portable switches, protocol analyzers, or rogue wireless access points.
• Disable security mechanisms, such as disconnecting monitoring systems, tampering with surveillance equipment, or disabling redundant power and failover systems to induce outages.

In operational environments, subjects with access to physical control systems (e.g., ICS/SCADA components, industrial HMIs, or IoT gateways) may alter processes, cause service disruptions, or create safety hazards. Similarly, access to CCTV or badge systems may allow them to erase footage, monitor employee movements, or manipulate access control logs.

Subjects with this form of access represent an elevated risk, especially when combined with technical knowledge or administrative privileges. The risk is compounded in environments with limited physical security controls, inadequate logging of physical entry, or weak segmentation between physical and digital assets.

The subject accesses a corporate hardware asset, most commonly a laptop or corporate mobile device, after their employment has formally ended. This typically occurs due to gaps in deprovisioning, delayed hardware recovery, or the subject physically retaining the device despite offboarding procedures. Post-termination access may be opportunistic or intentional, and may precede or coincide with data exfiltration, sabotage, or unauthorized continuation of internal access.

This sub-section is relevant in cases where the hardware asset is no longer linked to an active identity in HR systems but remains technically functional and capable of network, VPN, or service access. Such access undermines the assumption that termination alone revokes operational capability and may point to procedural drift in IT, HR, or facilities handover workflows.