🏢 Physical Attacks
Hackers don't always need a keyboard — physical access is access⏱ ~3 min
A $10,000 security system means nothing if an attacker can talk their way past the front desk. Physical attacks target the hardware, infrastructure, and physical spaces of an organization — not just software. Once an attacker has physical access to a device, they can bypass almost every software-based security control. That's why physical security is the foundation that all other security sits on.
What Are Physical Attacks?
Physical attacks are intentional, offensive actions used to destroy, expose, alter, disable, steal, or gain unauthorized access to an organization's infrastructure or physical hardware. They often work alongside digital attacks — the physical breach enables the digital one.
Six Common Physical Attack Types
| Attack | How It Works | Real Example |
|---|---|---|
| Tailgating / Piggybacking | Following an authorized person through a secured door without swiping a badge. Tailgating is without their knowledge; piggybacking is with their (misguided) help. | 'Can you hold the door? My hands are full of boxes.' Target: server room, data center, office. |
| Shoulder Surfing | Watching someone enter a PIN, password, or read sensitive data from a screen. | Standing behind someone at an ATM or coffee shop. Airport security lines are a prime location. |
| Dumpster Diving | Searching through trash for discarded documents, hardware, or media containing sensitive info. | Printed org charts, account statements, old hard drives, sticky notes with passwords — all common finds. |
| Card Cloning | Copying RFID/NFC data from access cards, credit cards, or ID badges using a concealed reader. | Attacker with a hidden card reader brushes past victim in a crowded elevator. Card data cloned in seconds. |
| USB Drop Attack | Leaving infected USB drives in parking lots or common areas, hoping curiosity makes someone plug it in. | 2010 Stuxnet spread partly via infected USB drives. Studies show 48% of dropped USBs get plugged in. |
| Impersonation / Hoax | Pretending to be IT staff, a delivery person, or an executive to gain physical access or extract information. | 'I'm here from corporate IT to update your workstation.' Victim steps aside, attacker installs malware. |
Why Physical Attacks Are So Effective
- •Physical access bypasses encryption — an attacker with physical access to a laptop can remove the hard drive and read it directly
- •Social norms work against security — holding doors open for people is polite; challenging strangers feels confrontational
- •Attacks happen in seconds — card cloning takes less than 2 seconds; plugging in a USB takes 5
- •No digital trace — physical intrusions often leave no logs unless surveillance is in place
- •One breach enables many — physical access to a server room = access to every system connected to it
Defenses Against Physical Attacks
- •Mantrap / Airlock — two-door entry requiring badge scan at each; prevents tailgating because second door won't open until first closes
- •Challenge protocol — train employees to politely challenge anyone without visible credentials: 'I don't recognize your badge, let me get someone to help you'
- •Clean desk policy — no sensitive documents, passwords, or devices left unattended; screens auto-lock after idle time
- •Shred everything — cross-cut shredders for all documents; degauss or physically destroy old hard drives
- •Cable locks — physical locks securing laptops and workstations to desks
- •Surveillance + access logging — cameras at entry points; electronic badge logs create an audit trail
- •Never plug in unknown USB devices — treat any USB found in a public place as hostile
A penetration tester is hired to assess a company's physical security. She puts on a hard hat and a vest with a fake contractor logo, carries a toolbox, and walks confidently to the server room door. As an employee exits, she holds the door with a smile and says 'Thanks!' Which physical attack technique is she demonstrating, and what defense would most directly prevent it?