Social Engineering Attacks: Physical Tactics and Psychological Manipulation

Tailgating (Piggybacking) — an unauthorized person follows an authorized person into a restricted area. The attacker exploits politeness or uses an excuse (forgot badge). Mitigation: mantrap (two-door interlocking system), security awareness training, and policies requiring badge access only.

Shoulder Surfing — observing someone as they enter credentials or view sensitive information. Can be done from a distance using binoculars or cameras. Mitigation: privacy screens, awareness training, and positioning screens away from public view.

Dumpster Diving — retrieving information from discarded materials (paper documents, old hard drives, sticky notes). Mitigation: shredding policies, secure disposal, and degaussing/destroying storage media.

For the Security+ exam, recognize these as physical security vulnerabilities that require a combination of technical controls and user awareness.

Pretexting — fabricating a scenario to obtain information. The attacker creates a believable story (impersonating IT support, a vendor, or a government official) and asks targeted questions. More elaborate than phishing — may involve research and multiple interactions.

Baiting — offering something enticing to trick the victim. Examples: leaving infected USB drives labeled 'Confidential' in the parking lot, fake software downloads offering free tools, or tempting ads. The bait carries malware or leads to credential harvesting.

Quid Pro Quo — offering a service or benefit in exchange for information. Example: an attacker calls pretending to be a researcher offering a gift card in exchange for completing a survey that harvests security questions.

Watering Hole — compromising a website that the target group frequently visits. The attacker infects the trusted site to compromise visitors. Harder to detect than direct phishing because the victim visits a legitimate site.

Social engineers exploit psychological principles: Authority (impersonating executives, law enforcement, or IT admins who expect compliance), Urgency (creating time pressure to bypass critical thinking), Social Proof (claiming others have already complied), Scarcity (limited time offer or exclusive access), Likability (being friendly and helpful to lower defenses), and Fear (threatening consequences if information isn't provided).

For the Security+ exam, be able to identify which influence tactic is being used in a scenario. The combination of authority + urgency is particularly dangerous.

Security awareness training is the primary defense. Users should recognize red flags: unexpected requests for sensitive information, pressure to bypass normal procedures, unusual sender addresses, and requests that create urgency.

Technical controls: security policies (clear desk policy, visitor management), physical controls (mantraps, badge access, CCTV, privacy screens), and data controls (shredding bins, USB port blocking, DLP systems).

Verification procedures: always verify identity through a separate channel. If someone claims to be IT support calling about an issue, hang up and call the official IT support number. Never trust caller ID.