Architecture Overview

APCAF Specification & Philosophy

The Adversarial Physical Control Assessment Framework (APCAF) is an open-source technical standard modeled directly after MITRE ATT&CK and Atomic Red Team for physical and hardware-layer security.

Traditional compliance standards (such as ISO 27001:2022 A.7 or PCI DSS v4 Requirement 9) verify whether physical controls exist on paper. APCAF deterministically measures whether installed hardware withstands real-world adversary bypasses in a non-destructive 45-second field walkthrough.

The Core Thesis: Zero Operational Budget Remediation

Hardware deficiencies (e.g. unencrypted 125 kHz Prox cards or excessive 4.5mm door latch clearances) are contractor installation defects. By conducting a passive 45-second inspection during commissioning, security leaders legally hold final invoice retainage payments and mandate zero-cost warranty repairs.

Legal Authorization

Zero-Liability SOW Fast-Path Clause

APCAF inspections require zero destructive tools, zero lockpicks, and zero bypass of life-safety hardware. To authorize passive physical testing in professional service agreements, insert the following single-sentence clause into master service agreements or site walk authorization memos:

"Client explicitly authorizes the assessment team to perform non-invasive,
passive radio frequency (RF) credential reads and non-intrusive passive
physical network port link detection during the inspection to verify vendor
hardware installation specifications."

Field Methodology

The 45-Second Non-Invasive Execution Model

Every APCAF test is engineered around a deterministic 45-second time budget per checkpoint:

5 Seconds

RF Credential Read: Contactless pocket reader scan to verify AES-128 crypto handshake vs unencrypted static UID.

30 Seconds

Perimeter & REX Inspection: Feeler gauge check for frame gaps (≤ 3.2mm) and optical line-of-sight check for REX PIR sensor shrouding.

10 Seconds

Exposed Port Signal Check: Passive zero-packet LED link-state tester to confirm port isolation or 802.1X NAC enforcement.

PHY-TAC-02: Credential Access

PHY-T1001: Unencrypted RFID Harvesting

CRITICAL SEVERITY

Adversaries interrogate unencrypted legacy proximity credentials (125 kHz HID Prox, EM4100) or static high-frequency CSNs (MIFARE Classic 1K/4K) using portable interrogators to harvest badge IDs in under 5 seconds from up to 1 meter away.

Atomic Red Team Test Definition (YAML)

attack_technique: PHY-T1001
display_name: "Unencrypted RFID Harvesting (125 kHz / MIFARE CSN)"
atomic_tests:
  - name: "Passive Badge Interrogation"
    auto_generated_guid: "apcaf-t1001-test-01"
    description: "Verify if credential emits unencrypted static UID or AES-128 crypto challenge."
    supported_platforms: ["physical"]
    input_arguments:
      interrogator_type:
        description: "Pocket dual-frequency RFID reader"
        default: "Proxmark3 / Keysy"
    executor:
      name: "passive_rf_read"
      command: "rfid lf search && hf 14a info"
      cleanup_command: "rfid off"
    pass_criteria: "Card initiates ISO/IEC 14443-4 AES-128 handshake (DESFire EV2/EV3/Seos)."
    fail_criteria: "Card returns plaintext 26-bit facility code on 125 kHz carrier in under 3 seconds."

45-Second Step-by-Step Test Procedure

Step 01

Power on pocket interrogator in passive read mode. Hold credential within 5 cm.

Step 02

Observe demodulated signal: Check carrier frequency (125 kHz vs 13.56 MHz).

Step 03

If unencrypted facility code broadcasts plaintext, flag as DEFECT (Legacy/Soft).

Contractor Warranty Mitigation Specification (PHY-M1001)

Systems Integrator must replace unencrypted 125 kHz credentials with AES-128 mutual-authenticating smartcards (DESFire EV3 / Seos) and activate cryptographic SAM profiles on readers under standard contract warranty at zero additional cost to client.

PHY-TAC-03: Portal Ingress

PHY-T1002: Mechanical Latch Manipulation

CRITICAL SEVERITY

Adversaries retract latch bolts on outward-opening doors using flexible shove knives, under-door tools, or latch slips when perimeter door frame clearances exceed standard IBC tolerances (> 3.2mm).

attack_technique: PHY-T1002
display_name: "Mechanical Latch Manipulation (Slip & Under-Door Tool)"
atomic_tests:
  - name: "Door Frame Clearance & Astragal Inspection"
    auto_generated_guid: "apcaf-t1002-test-01"
    supported_platforms: ["physical"]
    input_arguments:
      max_clearance_mm:
        description: "Maximum allowable perimeter frame gap"
        default: 3.2
    executor:
      name: "feeler_gauge_check"
      command: "measure_door_gap --target=strike_jamb --max=3.2mm"
    pass_criteria: "Jamb margin <= 3.2mm OR overlapping continuous stainless steel astragal installed."
    fail_criteria: "Margin > 3.2mm with direct line-of-sight to latch bolt bevel without protective plate."

Contractor Warranty Mitigation Specification (PHY-M1002)

Integrator must furnish and mount continuous full-height stainless steel security astragals and adjust door closer latching speed to ensure positive deadlatching under contract warranty.

PHY-TAC-03: Portal Ingress

PHY-T1003: Request-to-Exit (REX) Blind Activation

HIGH SEVERITY

Adversaries trigger interior Request-to-Exit PIR motion sensors through door threshold gaps using thermal aerosol plumes or reaching rods, forcing electronic mag-locks to unlock instantly.

Contractor Warranty Mitigation Specification (PHY-M1003)

Integrator must mount UL-listed directional deflector hoods over all REX motion detectors and install heavy-duty perimeter brush sweeps under warranty.

PHY-TAC-05: Interface & Tap

PHY-T1004: Unauthenticated Network Drop

HIGH SEVERITY

Publicly accessible wall jacks in lobbies and meeting rooms broadcast active Layer 1 PHY carrier signaling without port security, MAC filtering, or 802.1X Network Access Control.

Contractor Warranty Mitigation Specification (PHY-M1004)

Network integrator must administratively shut down unused switch ports at the patch panel and enforce 802.1X port isolation across all common area drops under warranty.

Executive Playbook

The CISO Invoice Retainage Workflow

How security executives use the 45-second triage findings to legally hold contractor retainage and enforce zero-cost rectification:

Phase 1

SOW Insertion: Incorporate the single-sentence passive assessment authorization into engagement agreements.

Phase 2

45s Site Walk: Assess credential encryption, door frame margins, and port pulse states.

Phase 3

Notice Delivery: Generate the formal CISO Non-Conformance Notice and transmit to the General Contractor.

Phase 4

Retainage Release: Conduct a 45-second verification walk to validate hardened remediation before releasing final milestone payment.