2.2 - Physical Vulnerabilities and Attacks
Common Physical Attacks
Physical attacks go after tangible assets and spaces rather than technical systems, and many rely on social engineering to manipulate people.
Piggybacking
Piggybacking is when an attacker uses social engineering to get an authorized person to knowingly let them into a restricted area, even if that person doesn't realize they're helping an attacker. Common tactics include carrying bulky items so someone holds the door for them, pretending to have forgotten their badge, or posing as a delivery person, contractor, or maintenance worker who "needs access."
Example: an attacker in a maintenance uniform carries a ladder and toolbox to a secured entrance. An employee sees them struggling and holds the door open to help. The attacker gets in without ever showing credentials, and the employee genuinely thought they were just being helpful.
This works because people want to be helpful, want to avoid awkward confrontation, and tend to assume anyone who looks official probably belongs there.
Tailgating
Tailgating is when an attacker slips in behind an authorized person without that person even noticing, unlike piggybacking, where the person consciously (if unknowingly) helps. The attacker just times it so they slip through a door before it closes.
Example: an employee badges into a secure server room, and while the door is closing, an attacker who'd been pretending to check their phone slips through right behind them. The employee never notices.
The difference is simple: with piggybacking the person is aware and helps, with tailgating they have no idea anyone followed them. This works because people are focused on their own tasks and don't constantly check who's behind them, especially in busy places.
Shoulder Surfing
Shoulder surfing means watching someone access sensitive info to steal credentials, PINs, or other confidential data, whether by looking directly, using a hidden camera, using binoculars from a distance, or even catching a reflection in a window or glasses.
Example: at a coffee shop, someone at the next table watches a target type their laptop password, then uses it later when the laptop's briefly unattended. Or an attacker stands behind someone at an ATM pretending to text while actually recording their PIN entry on video, reviewing it later in slow motion.
High-risk spots include airports, coffee shops, libraries, shared workspaces, public transit, and ATMs, basically anywhere a screen or keypad is visible to people nearby.
Dumpster Diving
Dumpster diving means digging through trash for information useful to an attack, since a lot of organizations and people don't properly destroy sensitive documents before tossing them.
This can turn up documents with credentials like sticky notes or printed emails, financial info like statements or receipts, personal info like employee lists, technical info like network diagrams or old hard drives, and business intelligence like strategic plans or client lists.
Example: an attacker searches a law firm's dumpster after hours and finds printed emails about an upcoming merger, a discarded employee phone list, client billing statements, and sticky notes with partial passwords. All of that combines into intelligence for a very convincing, targeted phishing attack. This works because most organizations don't have secure disposal procedures, and most people just don't think of their trash as a security risk.
Card Cloning
Card cloning means duplicating access badges or RFID credentials to get into anything the real cardholder can access. This can happen by physically stealing and copying a card before returning it, wirelessly skimming RFID data from a distance without even touching the card, bribing or coercing someone to hand over their card, or "finding" a lost card and copying it before returning it.
Example: an attacker with a concealed RFID reader stands close to someone in an elevator, capturing their badge data through their jacket pocket without them ever noticing. Later, they write that data onto a blank card and use it to get into restricted areas.
This works because a lot of RFID systems use older, weakly encrypted technology that can be read from several inches away, even through clothing, and people rarely notice this kind of proximity-based skimming happening.
Physical Threats and Vulnerabilities
Types of Threats
Human adversaries include external attackers, insider threats, organized criminals, and nation-states intentionally causing harm. Natural disasters like floods, fires, earthquakes, hurricanes, and extreme temperatures can also physically damage infrastructure and equipment even without any malicious intent.
Example: a hurricane knocks out power and floods a data center, backup generators fail, floodwater reaches ground-floor server rooms and destroys equipment, and services go completely down. Nothing malicious happened here, but the impact on availability is just as real.
Categories of Physical Vulnerabilities
These include unauthorized access to restricted spaces (unlocked doors, poor monitoring), unauthorized access to sensitive data (documents left out, unattended screens), service disruption (exposed power infrastructure, no redundancy), theft or destruction (unsecured equipment, no cable locks), and unauthorized data modification (physical server access, unattended active sessions).
A vulnerability is a weakness or flaw that could allow an asset to be compromised, and each of these compromises maps back to the CIA triad from Topic 2.1. Unauthorized access to data or spaces hurts confidentiality, unauthorized modification of data hurts integrity, and disruption of services or destruction of resources hurts availability. Theft can hit more than one at once: a stolen laptop is unavailable to its owner, and any data on it is now exposed.
How Threats Exploit Physical Vulnerabilities
Power Disruption
Cutting power to devices takes down their services directly, hitting availability. This can happen by disabling breakers or fuses, cutting power cables, or attacking substations, transformers, or generation facilities.
Example: an attacker gets into an unlocked, unmarked electrical room and flips the main breaker, knocking out power to an entire floor, including servers, networking gear, and security systems, for 3 hours. This one simple physical attack halts operations completely, and the cascading effects include immediate outages, security systems like cameras and badge readers failing too, possible data loss if systems weren't shut down properly, and a longer recovery as everything has to come back online carefully.
Access to Sensitive Information
Physical access to areas with sensitive info lets someone steal or copy data with zero technical hacking required, whether that's paper documents, whiteboards with meeting notes or network diagrams, visible open screens, or filing cabinets and archives.
Example: an attacker piggybacks onto an executive floor pretending to deliver packages, photographs whiteboards showing acquisition details and financial projections, and photographs documents left on a desk showing employee salaries and performance reviews. All of that stolen intelligence, obtained without ever touching a computer, is hugely useful for social engineering, corporate espionage, or extortion.
Physical Device Access
Direct physical access to a device lets an attacker skip past a lot of technical security entirely, through hardware keyloggers, malicious USB drives, booting from external media to bypass OS security, stealing components like hard drives, or just physically destroying equipment.
Example: during a piggybacking attack, someone plugs a USB device into an unattended workstation. It auto-runs, installs a backdoor, harvests saved browser and app credentials, exfiltrates files, and even removes itself from the USB history log, all in about 2 minutes while the employee's in a meeting. Physical access matters because it lets an attacker bypass firewalls entirely, skip network authentication, access data before it's even encrypted, install hardware invisible to software security tools, and read data straight off storage devices.
A keylogger records every key a user types, so the adversary can later collect passwords, messages, and anything else entered on that device. A hardware keylogger is a small device plugged in between the keyboard and the computer, so security software running on the computer usually can't detect it. Physical access also lets an adversary destroy a device outright, which makes the device, any data stored only on it, and any services it provides unavailable.
Assessing Physical Security Risks
Physical access can bypass a huge amount of technical security. Firewalls, network authentication, encryption, access logs, and MFA can all become irrelevant once someone's physically at the device, whether by capturing data before it's encrypted, stealing keys directly, erasing logs, or installing a keylogger that captures every authentication factor typed in.
Example: a company spends heavily on network security like enterprise firewalls and strong authentication, but an attacker walks into an unlocked server room, connects a laptop directly, boots from external media, and reads the entire hard drive, bypassing all of that network security completely because the physical door wasn't locked.
High Risk
High risk shows up when valuable or sensitive things are exposed with little to no access control, a high chance of exploitation, and severe consequences.
Example: a server holding customer payment data sits in an unlocked room accessed through a hallway that janitorial staff, contractors, and visitors all walk through freely. With extremely high asset value, no physical controls, high likelihood given the unrestricted access, and potentially severe impact (data breach, fines, reputation damage, possibly over $5,000,000), this rates as critical or high risk. All the technical security in the world doesn't matter if anyone can just walk up to the server.
Moderate Risk
Moderate risk shows up when lower-value assets are exposed in a way that could become a stepping stone toward something more valuable.
Example: a reception desk computer connects to the internal network and has exposed USB ports, sitting in an area anyone off the street can approach. The computer itself isn't very valuable, but the network access it provides is. An attacker could distract the receptionist, plug in a malicious USB drive, get an initial foothold, and then move laterally toward more valuable systems, which makes this more than just low risk despite the low value of the computer itself.
Low Risk
Low risk shows up when the exposed assets are low value and unlikely to actually be exploited.
Example: employees in a badge-access office leave laptops with no sensitive data unattended and unsecured during lunch when everyone leaves together. Since badge access limits who can even get in, there's no sensitive data at risk, theft would likely be noticed fast, and the financial loss would be small, this rates as low risk. That said, it's not zero risk, and cheap fixes like cable locks are still worth doing.
Documenting Physical Risk
A solid physical security risk assessment documents what assets exist and where, what physical weaknesses exist and how they could be exploited, who might exploit them and why, how likely exploitation actually is, what the impact would be, and a final risk rating.
Example: a server room door has a broken lock and gets propped open all day. It holds production database servers with 5 million customer records including payment info. Threats include outside attackers, insiders, and contractors with building access, and the exploitation method is as simple as walking through the open door and plugging into a server. Given the door being open for 8+ hours daily, low staff awareness, no camera coverage, and lots of foot traffic, the likelihood is high. The potential impact is severe, roughly $8,500,000 between fines, incident response, legal fees, customer notification, and reputational damage, plus regulatory violations and possible executive liability. That adds up to a critical risk rating requiring immediate action.
Recommended fixes might include installing a working lock with badge access, adding a camera on the door, enforcing a no-propping-doors policy, adding server rack locks as a backup, and setting up an alert if the door stays open too long, all for around $4,500 total. Spending $4,500 to address an $8,500,000 risk is about as cost-effective a fix as it gets, and documenting it this way makes it easy for leadership to see exactly why the investment matters.