Tailgating Through Physical Security Using Social Engineering Tactics
Researchers at Check Point outline various forms of tailgating attacks. These attacks can allow threat actors to bypass physical security measures via social engineering.
“Tailgating is a common form of social engineering attack,” the researchers write. “Social engineering attacks use trickery, deception, or coercion to induce someone to take actions that are not in the best interests of themselves or the organization. A tailgating attack can use various methods to provide the attacker with access to the secure area. The attacker might trick an employee into thinking that they have legitimate access, follow them through an open door without their knowledge, or use bribery or other coercion to get them to open the door.”
Threat actors can use the following methods to carry out tailgating attacks:
- “Lost/Forgotten ID: A tailgater may pretend to be an employee that has lost or forgotten their employee ID at home. They would then ask an employee entering the building to let them in as well, ‘just this once.’
- “Delivery Driver: The issue with masquerading as an employee is that the legitimate employee might not let in anyone that they don’t recognize. Another common pretext is to pretend to be a delivery driver carrying a load of packages.
- “Hands Full: Whether or not they’re pretending to be a delivery driver, a tailgater may deliberately have their hands full when approaching the door to the secure area. People are more likely to hold the door for someone who looks like they are struggling.
- “Open Doors: An employee might prop a door open for some reason. A tailgating attacker can take advantage of this to gain access to the secure area.
- “Copied ID: If an attacker can steal a user’s ID or device, they may be able to copy the credentials used to unlock the door to the secure area. This would allow the attacker to masquerade as a legitimate employee and gain access.”
New-school security awareness training can teach your employees to follow security best practices so they can avoid falling for social engineering attacks.
The world’s largest library of security awareness training content is now just a click away!
In your fight against phishing and social engineering you can now deploy the best-in-class simulated phishing platform combined with the world’s largest library of security awareness training content; including 1000+ interactive modules, videos, games, posters and newsletters.
You can now get access to our new ModStore Preview Portal to see our full library of security awareness content; you can browse, search by title, category, language or content topics.
The ModStore Preview includes:
- Interactive training modules
- Videos
- Trivia Games
- Posters and Artwork
- Newsletters and more!
PS: Don’t like to click on redirected buttons? Cut & Paste this link in your browser: https://info.knowbe4.com/one-on-one-demo-partners?partnerid=001a000001lWEoJAAW