Learn APCAF
A practical, 15-minute introduction to adversarial physical-control assessment. Master the mental model, passive inspection boundaries, and core techniques without technical fluff.
The Problem: Why "Paper Existence" Fails
In traditional compliance audits (like ISO 27001 or PCI DSS), an assessor walks through a facility with a clipboard and checks: "Is there a physical lock on the server room door? [Yes / No]".
"The door has a lock" ≠ "The door resists known bypass techniques."
A conventional checklist audit might verify that an electronic lock is physically mounted, but if the installed frame gap measures 4.5mm without an astragal guard, the hardware presents an observable condition associated with mechanical latch manipulation. APCAF Base identifies this non-conforming physical condition without attempting a physical bypass.
Verifies whether hardware is physically mounted on the door. Assumes the control is satisfactory without evaluating physical tolerances or installation clearances.
Standardises non-invasive inspection procedures to determine whether installed hardware resists known bypass conditions through repeatable, passive checks.
The APCAF Model: The 6-Step Evaluation Chain
To replace arbitrary checklists with rigorous engineering, APCAF structures all physical assessments around a standardised 6-step evaluation chain:
APCAF Base identifies the physical condition and documents the finding. It does not perform active exploitation.
Tactics vs. Techniques: Understanding the Matrix
APCAF borrows MITRE ATT&CK's core behavioral separation:
- Tactic = What the attacker wants to achieve (Spatial or access objective).
- Technique = How the attacker attempts to achieve it (Specific physical/hardware mechanism).
APCAF organizes the entire physical attack surface into 5 Core Tactics:
Passive Assessment: The Non-Invasive Safety Boundary
This is the most critical distinction in APCAF:
APCAF does not require you to break or pick the control to assess it.
Many organizations avoid physical security testing because they believe it requires aggressive red-teaming: lockpicks, broken doors, or unauthorized trespassing. APCAF replaces destructive testing with non-invasive QA verification:
"Attempting to defeat the barrier."
Attempts to exploit the barrier using physical tools or manipulation. Carries operational risk, potential damage, and liability.
"Determining whether non-conforming conditions exist."
Uses pocket feeler gauges and passive RF listeners to inspect compliance with engineering standards (e.g. NFPA 80 3.2mm limit).
Because APCAF is completely passive and non-destructive, it can be executed during standard facility commissioning walks under a single-sentence SOW authorization.
The Four MVP Techniques in Plain English
Here are the four active baseline techniques evaluated during an APCAF walkthrough. We explain each in human terms before referencing the technical standard ID:
1. Wireless Badge Interception (RFID Harvesting)
PHY-T1001In Plain English: This credential technology broadcasts static identifiers without cryptographic challenge, allowing unauthorized replication under passive contactless interrogation.
2. Door Latch Manipulation (Latch Slip & UDT)
PHY-T1002In Plain English: Excessive frame clearance without an overlapping steel astragal leaves the latch bolt bevel physically exposed to mechanical manipulation.
3. Request-to-Exit Sensor Blind Activation
PHY-T1003In Plain English: An unshielded interior exit sensor can be activated through perimeter door gaps, causing electronic locks to release without authorization.
4. Exposed Active Physical Network Interface
PHY-T1004In Plain English: Publicly accessible network wall jacks maintain active Layer 1 link carrier without administrative port shutdown or 802.1X quarantine.
Run Your First APCAF Assessment
Put the fundamentals to work. Walk through a simulated inspection of "Acme Financial Data Center" and match each real-world observation to its corresponding APCAF technique:
You inspect an employee badge with a pocket interrogator. The screen immediately displays an unencrypted 125 kHz carrier transmitting a static 26-bit facility code in plaintext. Which APCAF technique applies?
You inspect the outward-opening server suite door. Inserting a pocket feeler gauge reveals a 4.5mm clearance gap between door edge and jamb with direct visibility to the latch bolt bevel and no steel astragal. Which APCAF technique applies?
Looking through the top door gap above the secure server room portal, the wide-angle PIR lens of the Request-to-Exit sensor is clearly visible without a directional shroud. Which APCAF technique applies?
You plug a passive zero-packet LED tester into an unmonitored wall RJ-45 jack in the visitor reception area. The Layer 1 PHY carrier light illuminates steady amber. Which APCAF technique applies?
Field Guide Fundamentals Completed
You have successfully completed the APCAF Fundamentals field scenarios. You understand the difference between nominal control presence and verified non-invasive resilience.