Physical tactics

Security is physical too

It is tempting to think of attacks as something that happens on a screen. But if someone can walk to your desk and read your password off a sticky note, your expensive firewall is useless. Physical security is cybersecurity, and social engineers are happy to use the real world when it is the easier route in.

Here are four common physical tactics and the simple habits that shut them down.

Tailgating: following you through the door

Tailgating, also called piggybacking, is when someone slips through a secure door behind an authorised person. They rarely force their way. They rely on your manners: arms full of boxes, a friendly "could you hold that for me?", a lanyard that looks close enough. Holding the door feels polite, and refusing feels rude, which is exactly the instinct being used.

In a building with controlled access, letting someone tap their own badge is not unfriendly, it is the professional thing to do. If you do not recognise someone, it is fair to ask, or to point them to reception.

Bin raiding: your rubbish is information

What gets thrown away can be a goldmine. Old invoices, printed emails, org charts, notes with usernames, a letter from the bank: sifting through discarded paper, sometimes called dumpster diving, hands an attacker the details that make a later phishing call sound convincing. Shred anything with names, account numbers or internal information before it leaves the building, rather than dropping it whole into a bin.

Sticky note passwords

Passwords written on a note under the keyboard, stuck to the monitor, or kept in a drawer labelled "passwords" are one of the oldest weaknesses, and still one of the most common. Anyone passing your desk, a visitor, cleaning staff, a curious colleague, can read it, and it takes only seconds to photograph. A password you can see is a password anyone can take. The next lesson covers the proper fix: a password manager remembers them so you do not have to write them anywhere.

Dropped USB sticks (baiting)

Baiting leaves something tempting where you will find it, most classically a USB stick in a car park, a lobby or on a desk, sometimes labelled "salaries" or "confidential" to spark curiosity. Plug it into your computer to see what is on it and it can quietly install malware. The rule is short: never plug in a USB device you did not buy or receive from a source you trust. Curiosity is the whole attack.

The common thread

Every one of these works by turning an ordinary courtesy or curiosity into an opening. The defence is not rudeness; it is a small set of firm habits: let people badge in themselves, destroy sensitive paper, never leave passwords in view, and never plug in unknown devices.