LockInCS

Topic 2.2 · Unit 2: Securing Spaces · 20 minute session

2.2 Physical Vulnerabilities and Attacks

Physical attacks often start with social engineering. The five to know are piggybacking, tailgating, shoulder surfing, dumpster diving and card cloning. Physical access lets adversaries steal information, cut power, plug in keyloggers or malware, or destroy devices, bypassing many technical controls, so physical risks are rated by the sensitivity or value of the asset, how exposed it is, and how likely it is to be exploited.

Big idea Physical access to devices can let adversaries bypass many technical controls and layers of security.

Course and exam description (CED) codes covered: 2.2.A.12.2.A.22.2.A.32.2.A.42.2.A.52.2.A.62.2.B.12.2.B.22.2.B.32.2.B.42.2.B.52.2.C.12.2.C.22.2.C.32.2.C.4

Last reviewed against the CED:

By the end of this session you can

  • 2.2.A Identify common physical attacks.
  • 2.2.B Explain how threats can exploit common physical vulnerabilities to cause loss, damage, disruption, or destruction to assets.
  • 2.2.C Assess and document risks from physical vulnerabilities.

Already know this? Jump to the checkpoint.

1. Five physical attacks (2.2.A)

Physical attacks often lean on social engineering 2.2.A.1.

Attack How it works
Piggybacking 2.2.A.2 The adversary manipulates an authorized person into granting access to a restricted area: carrying something bulky so they hold the door, “forgetting” a badge, or posing as a maintenance worker who needs to inspect something.
Tailgating 2.2.A.3 The adversary follows close behind an authorized person, without that person noticing.
Shoulder surfing 2.2.A.4 The adversary watches someone access sensitive information, sometimes recording it with a camera, to use it later.
Dumpster diving 2.2.A.5 The adversary searches the target’s physical trash for useful information.
Card cloning 2.2.A.6 The adversary copies an authorized user’s access card and gains everything that user can access.
Two panels. Piggybacking: the employee says I will get the door and knowingly lets the adversary in, tricked by boxes, a forgotten badge or a fake repair. Tailgating: the adversary follows close behind and the employee does not notice. Both are stopped by an access control vestibule or turnstile and detected by a door held open longer than normal.
Piggybacking vs tailgating: did the employee know?

2. How threats exploit physical vulnerabilities (2.2.B)

Threats include human adversaries and natural disasters, which can damage or destroy computers and data and disrupt digital services 2.2.B.1.

Vulnerabilities are weaknesses or flaws that could let an asset be compromised. Common results are unauthorized access to data or restricted spaces, disruption of services, theft or destruction of resources, and unauthorized modification of data 2.2.B.2.

What physical access gives an adversary:

  • Power disruption: damaging fuses or breakers, cutting or unplugging wiring, or damaging substations and transformers takes a device and its services offline 2.2.B.3.
  • Information theft: in a room with sensitive information, they can steal or copy it 2.2.B.4.
  • Device ports: plugging in a keylogger or a Universal Serial Bus (USB) drive with malware can capture what a user types or even take control of the device. They can also physically destroy the device, its data and its services 2.2.B.5.

3. Rating physical risk (2.2.C)

Physical access can bypass many technical controls and layers of security 2.2.C.1. Rate a physical risk by asking three questions in order: Is sensitive information or a sensitive system exposed without restricted, controlled access? (high) If not, is a noncritical part left unprotected so it could be a foothold to other resources? (moderate) If not, is the asset low value and the vulnerability unlikely to be exploited? (low)

Rating When Example
High 2.2.C.2 Sensitive information or systems sit in physical spaces without enough restricted, controlled access A clinic keeps patient records on a computer in an unlocked storage room next to the public waiting area.
Moderate 2.2.C.3 A noncritical, nonsensitive area is unprotected and could be a foothold to other resources A visitor kiosk in a lobby runs on the same network as staff computers and has no locked case.
Low 2.2.C.4 The asset has low value and the vulnerability is unlikely to be exploited A wall display in a staff kitchen shows only the weather and holds no logins.

Lock it in: memory hooks

One picture per idea. If you remember the hook, you can rebuild the details.

  • Piggybacking vs tailgatingA piggyback ride needs permission: the victim lets you on. A tailgater just follows.
  • Physical attacksDoor, eyes, trash, card: piggybacking and tailgating get through the door, shoulder surfing uses the eyes, dumpster diving the trash, card cloning the badge.
  • Physical accessHands on the device beats most passwords: physical access goes around technical controls.

Common misconceptions

  • "Piggybacking and tailgating are the same attack."

    Not quite. In piggybacking, the authorized person is manipulated into letting the adversary in. In tailgating, the adversary follows close behind without the authorized person knowing.

  • "Only people can be threats."

    Not quite. Natural disasters are threats too. They can damage computers and data and disrupt digital services.

  • "Strong passwords and encryption protect a device no matter what."

    Not quite. Physical access can bypass many technical controls: an adversary can plug in a keylogger, load malware from a drive, or simply destroy the device.

Exam traps

  • The word foothold signals moderate risk. Sensitive information plus uncontrolled access signals high.
  • "She let him in because he said he forgot his badge" is piggybacking: the employee knew.

By the numbers

Say each list out loud, then tap to check.

5 physical attacks Say them, then tap
4 compromises, 3 risk levels Say them, then tap
  • unauthorized access
  • disruption
  • theft or destruction
  • unauthorized modification
  • high
  • moderate
  • low

In 30 seconds

  1. Piggybacking: an authorized person is tricked into granting access. Tailgating: following in unnoticed. Shoulder surfing: watching or recording someone's screen or keypad. Dumpster diving: searching trash. Card cloning: copying an access card.
  2. Threats include human adversaries and natural disasters. Vulnerabilities lead to unauthorized access, disruption, theft or destruction, and unauthorized data changes.
  3. Physical access lets adversaries cut power, steal or copy information, plug in keyloggers or malware drives, or destroy devices.
  4. High risk: sensitive systems exposed without controlled access. Moderate: an unprotected noncritical spot that could be a foothold. Low: low-value assets unlikely to be exploited.

Cover this list, say the points out loud, then take the checkpoint without scrolling back up.

Checkpoint · 8 questions

Checkpoint: Physical Vulnerabilities and Attacks

Pick an answer to mark it. Every answer is explained, and you can try any question again. Your saved score counts first tries only, and stays in this browser.

  1. 1 An adversary carrying two large boxes waits by a secure door until an employee holds it open for them. Which attack is this? 2.2.A.2
    Show answer

    Answer: D. Piggybacking uses social engineering to get an authorized person to grant access, such as holding the door for someone carrying something large.

  2. 2 An adversary slips through a door right behind an employee who never notices. Which attack is this? 2.2.A.3
    Show answer

    Answer: C. Tailgating is following an authorized person into a restricted area without their awareness or knowledge.

  3. 3 Which attack involves making a copy of an authorized user's access card? 2.2.A.6
    Show answer

    Answer: C. Card cloning copies an access card so the adversary can access everything the user is authorized to access.

  4. 4 Which of these is a threat that is NOT a human adversary? 2.2.B.1
    Show answer

    Answer: B. Threats include natural disasters, which can damage computers and data and disrupt digital services.

  5. 5 A laptop has a strong password and full encryption. Why is an unattended laptop with open Universal Serial Bus (USB) ports still a risk? 2.2.B.5, 2.2.C.1
    Show answer

    Answer: A. Physical access to a device and its ports lets an adversary plug in a keylogger or malware drive, bypassing many technical controls.

  6. 6 A clinic's patient-records server sits in a supply closet that anyone in the public waiting area can open. How should this physical risk be rated? 2.2.C.2, 2.2.C.3, 2.2.C.4
    Show answer

    Answer: D. High risks arise when sensitive information or systems are exposed in physical spaces without sufficiently restricted and controlled access.

  7. 7 An adversary films a staff member typing a door code on a keypad so they can use it later. Which attack is this? 2.2.A.4
    Show answer

    Answer: B. Shoulder surfing is watching someone access sensitive information, sometimes recording it with a camera, to use it later.

  8. 8 An adversary searches an office recycling bin and finds printed staff lists. Which attack is this? 2.2.A.5
    Show answer

    Answer: C. Dumpster diving is going through a target's physical trash for information that helps the adversary reach their goal.

Key terms: flip the cards

Read the term, say the definition out loud, then flip to check. Struggling a little to remember is what makes it stick.

  • Piggybackingtap to flip

    A physical attack where the adversary uses social engineering to get an authorized person to let them into a restricted area.

    Example and CED codes
  • Tailgatingtap to flip

    A physical attack where the adversary follows close behind an authorized person into a restricted area without that person noticing.

    Example and CED codes
  • Shoulder surfingtap to flip

    A physical attack where the adversary watches, or records with a camera, someone accessing sensitive information to use it later.

    Example and CED codes
  • Dumpster divingtap to flip

    A physical attack where the adversary searches a target's trash for information that helps them reach their goal.

    Example and CED codes
  • Card cloningtap to flip

    A physical attack where the adversary copies an authorized user's access card to gain everything that user can access.

    Example and CED codes
  • Keyloggertap to flip

    A device or program that records every key a user types, which can capture passwords and messages.

    Example and CED codes
  • Threattap to flip

    Anything that could exploit a vulnerability to cause harm, including human adversaries and natural disasters.

    Example and CED codes
  • Vulnerabilitytap to flip

    A weakness or flaw that could allow an asset to be compromised.

    Example and CED codes

Questions students ask

What is the difference between piggybacking and tailgating?

Piggybacking uses social engineering to get an authorized person to let the adversary in, for example by carrying a large box so someone holds the door. Tailgating is following an authorized person through a door without their awareness.

What is card cloning?

Making a copy of an authorized user's access card so the adversary can get into everything that user is allowed to access.

Why is physical access such a big risk?

With physical access, an adversary can bypass many technical controls: plugging in a keylogger or malware drive, stealing information, cutting power, or destroying the device and its data.

↑ Top

Enlarged view of the selected figure