At 8:52 on a Tuesday morning, a man in a courier jacket carrying three boxes reaches a side door just as an employee badges in. She holds the door for him. Twenty minutes later he walks out without the boxes, and a small device is plugged into a network jack under a desk in the finance office.
Physical attacks like this one skip every firewall rule in the building. On the CompTIA Security+ SY0-801 exam, objective 2.5 lists tailgating, shoulder surfing, skimming and forced entry as physical attacks. Because it is a scenario objective, you'll be expected to recognize each attack from its indicators and choose the control that stops it. This lesson covers how each attack works, the evidence it leaves, and the control that fits.
Physical attacks leave indicators in logs, footage, and people's memories
Physical attacks are harder to spot than network attacks because the best evidence often isn't in the SIEM. The indicators come from several sources, and investigators correlate them:
- Access control logs: door-forced-open and door-held-open alarms, denied badge attempts, and badge reads at odd hours or in impossible places.
- Surveillance footage: more people passing through a door than badge reads recorded, or someone without a visible badge in a secure area.
- Visitor logs and reception records: a visitor who never signed in, or one who signed in and was never escorted.
- People: employees reporting someone they didn't recognize, someone hovering behind them at a keypad, or a stranger asking them to hold a door.
- Equipment: pry marks, broken tamper seals, card readers that look different, unknown devices plugged into ports.
Some indicators tie a physical event to a digital one. A new device appearing on a switch port in a closet that was opened without a badge read, or a user's account signing in from a conference room PC while that user is on vacation, links the two. Treat a physical indicator as the possible start of a technical incident, not just a facilities problem.
Tailgating gets in without consent; piggybacking gets in with it
Tailgating is when an unauthorized person follows an authorized person through a controlled door without that person's knowledge. The intruder times their approach to catch the door before it closes, or follows closely through a gate or turnstile.
Piggybacking is the same entry with the authorized person's consent. The employee holds the door because the stranger is carrying boxes, wears a uniform, or says they left their badge at their desk. Piggybacking is a social engineering success as much as a physical one, since the attacker exploits courtesy and a plausible pretext.
Some sources use the two terms interchangeably, and objective 2.5 lists only tailgating. When both terms appear among the options, consent is the deciding detail. If piggybacking isn't offered, tailgating is the answer for any unauthorized person who follows someone in.
Indicators that someone got in this way:
- More people on camera than badge reads at a door.
- Door-held-open alarms, which fire when a door stays open longer than its configured time.
- Anti-passback violations, such as a badge used to leave an area it never entered, which suggests the holder came in behind someone else.
- A person in a secure area with no badge, or with a badge that isn't valid for that area.
The controls work on both the door and the people. Access vestibules and full-height turnstiles physically admit one person per authentication, and guards at entrances check everyone who passes. Security awareness training and a clear policy tell employees not to hold secure doors and to send visitors to reception, and a visible badge policy gives them a reason to challenge someone. Training matters most against piggybacking, because there the employee chose to open the door.