Physical Security

The Physical Security section of the Operations module tracks data from physical penetration testing engagements, primarily through ATLAS imports. This includes field notes, points of interest, RFID cards, captured PINs, and magnetic stripe card data.

Physical Security Overview

Purpose

Physical security tracking in SPEAR serves to:

• Document field observations during physical assessments
• Track geographic points of interest with coordinates
• Record captured access control data (RFID, PINs, magstripe)
• Organize physical security data by project and engagement

Data Types

Physical security data is organized into these categories:

Type	Description	Key Data
Field Notes	Observations and documentation	Text, timestamps, locations
Points of Interest	Geographic locations	Coordinates, descriptions
RFID Cards	Captured card data	Facility codes, card numbers
Captured PINs	Access control PINs	PIN codes, associated cards
Magstripe Cards	Magnetic stripe data	Track data, card details

Project-Based Organization

Physical security data is organized by project:

• Each ATLAS import creates or updates a project
• All related data is scoped to that project
• Projects can contain multiple engagements
• Data can span multiple dates within an engagement

Current User Interface

🖥️ Project List View with ATLAS Data Screenshot

Project List View

The Physical Security page displays a searchable list of projects that contain ATLAS import data:

• Search: Filter projects by name or client name
• Project Cards: Each project shows client name, total asset count, and data type breakdown
• Statistics: Counts for notes, POIs, RFID cards, PINs, and magstripe cards
• Navigation: Click a project card to view its detailed data

Dashboard Statistics

When projects exist, the page displays aggregate statistics:

Metric	Description
Projects	Total projects with physical security data
Field Notes	Total count across all projects
RFID Cards	Total captured cards
Captured PINs	Total captured PINs
Magstripe Cards	Total magstripe records

Empty State

If no ATLAS imports exist, the page shows an empty state with a link to the Asset Import page where ATLAS files can be uploaded.

ATLAS Import

🖥️ ATLAS File Import Process Screenshot

Overview

ATLAS is a physical security data collection tool. SPEAR supports importing ATLAS export files to centralize physical security data with other assessment information.

Import Process

ATLAS imports are initiated through the Operations > Assets page using the standard import flow:

1. Navigate: Go to Operations > Assets and click Import
2. Select File: Choose an ATLAS export JSON file
3. Automatic Detection: System identifies the ATLAS format automatically
4. Data Extraction: Parses all physical security data from the export
5. Asset Creation: Creates appropriate asset records for each data type
6. Confirmation: Displays import results with counts

After import, the data will appear in the Physical Security section.

Automatic Detection

The import system automatically detects ATLAS format by checking for:

• ATLAS-specific JSON structure
• Presence of physical security data types
• ATLAS metadata fields

Data Extraction

The ATLAS importer extracts:

• Notes: Field observations with timestamps
• POIs: Geographic points with coordinates and descriptions
• RFID Cards: Card data with facility codes and card numbers
• PINs: Captured PIN codes (derived from card data)
• Magstripes: Magnetic stripe track data

Asset Type Creation

For each data type, specialized asset types are created:

ATLAS Data	Asset Type Created
Notes	Field Note
POIs	Point of Interest
RFID Cards	RFID Card
PINs	Captured PIN
Magstripes	Magstripe Card

Metadata Preservation

ATLAS metadata is preserved including:

• Client name
• Engagement start date
• Engagement stop date
• Project identifier
• Additional ATLAS-specific fields

Physical Security Data Types

Field Notes

Field notes capture observations made during physical assessments:

• Content: Text description of the observation
• Timestamp: When the note was recorded
• Location: Where the observation was made
• Context: Related engagement or activity

Points of Interest (POIs)

POIs mark significant geographic locations:

• Coordinates: Latitude and longitude
• Description: What makes this location significant
• Category: Type of POI (entry point, camera, etc.)
• Photos: Associated images (if captured)

RFID Cards

RFID card records include:

• Facility Code: The facility code from the card
• Card Number: The unique card number
• Format: Card format (e.g., H10301, H10302)
• Raw Data: Hex representation of card data
• Capture Method: How the card was captured

Captured PINs

PIN records track:

• PIN Code: The captured PIN
• Associated Card: Link to related RFID card (if applicable)
• Location: Where the PIN was captured
• Timestamp: When the PIN was captured

Magstripe Cards

Magnetic stripe records contain:

• Track 1: Primary account number and cardholder name
• Track 2: Account number and expiration date
• Track 3: Additional data (if present)
• Card Type: Type of card (access, credit, etc.)

Project Detail View

🖥️ Project Detail View with Organized Asset Types Screenshot

Clicking on a project from the list navigates to a detailed view showing:

• All imported assets organized by type
• Individual asset details and metadata
• Engagement date range information
• Client information from the ATLAS export

Future Features (Planned)

The following visualization features are planned for future releases:

• Physical Security Map: Geographic visualization of POIs with interactive markers
• Card Gallery: Visual display of captured card images with lightbox viewing
• Engagement Timeline: Chronological view of physical security activities
• Advanced Filtering: Filter by date range, data type, and location

Integration with Operations

Asset Inventory

Physical security assets appear in the main Operations asset inventory:

• Listed alongside network assets
• Filterable by asset type
• Support for tags and metadata
• Standard CRUD operations

Relationship Tracking

Physical security assets can be related to:

• Other assets (e.g., badge to building address)
• Projects and components
• Findings in reports

Tags and Metadata

Physical security assets support:

• Custom tags for categorization
• Metadata for additional context
• Notes for analyst observations

Best Practices

Data Organization

• Use consistent project naming for engagements
• Tag physical security assets appropriately
• Link related assets (cards to locations, PINs to cards)
• Document context in field notes

Import Workflow

1. Complete field work with ATLAS data collection
2. Export ATLAS data to JSON format
3. Navigate to Operations > Assets in SPEAR
4. Import the ATLAS JSON file through the asset import modal
5. Review imported data in the Physical Security section
6. Add additional context through notes and tags
7. Link to findings in assessment reports

Data Security

• Physical security data is sensitive - maintain access controls
• PINs and card data should be handled according to engagement rules
• Consider data retention policies for captured credentials
• Document chain of custody for physical evidence

Reporting Integration

• Link physical security findings to report sections
• Include relevant evidence in finding documentation
• Reference POI locations in physical security narratives
• Aggregate card capture statistics in executive summaries