Log huntUnit 2 · Topic 2.4
Spot piggybacking or tailgating in a badge reader log
Find piggybacking and tailgating in a door badge log.
New to this? Read the topic first: 2.4 Detecting Physical Attacks.
Simulation · [2.4.C.3]
Log hunt: spot piggybacking or tailgating in a badge reader log
Entry log for the server room door. The door normally closes about 5 seconds after a badge opens it. Tap every entry that suggests piggybacking or tailgating. There are 2.
-
Fine. A normal open time for one person walking through.
-
Fine. Normal.
-
Red flag. Open eight times longer than normal. Someone may have held the door for a second person (piggybacking) or a follower slipped in (tailgating).
-
Fine. The reader worked as designed and refused an unauthorized badge. Worth a glance, but the door never opened.
-
Fine. Within the normal range.
-
Red flag. Open 29 seconds, much longer than normal, right after the same badge already went in. Check the camera footage for this time.
Go to the topic: 2.4 Detecting Physical Attacks