Tailgating Through Physical Security Using Social Engineering Tactics

Researchers at Check Point outline various forms of tailgating attacks. These attacks can allow threat actors to bypass physical security measures via social engineering.

“Tailgating is a common form of social engineering attack,” the researchers write. “Social engineering attacks use trickery, deception, or coercion to induce someone to take actions that are not in the best interests of themselves or the organization. A tailgating attack can use various methods to provide the attacker with access to the secure area. The attacker might trick an employee into thinking that they have legitimate access, follow them through an open door without their knowledge, or use bribery or other coercion to get them to open the door.”

Threat actors can use the following methods to carry out tailgating attacks:

• “Lost/Forgotten ID: A tailgater may pretend to be an employee that has lost or forgotten their employee ID at home. They would then ask an employee entering the building to let them in as well, ‘just this once.’
• “Delivery Driver: The issue with masquerading as an employee is that the legitimate employee might not let in anyone that they don’t recognize. Another common pretext is to pretend to be a delivery driver carrying a load of packages.
• “Hands Full: Whether or not they’re pretending to be a delivery driver, a tailgater may deliberately have their hands full when approaching the door to the secure area. People are more likely to hold the door for someone who looks like they are struggling.
• “Open Doors: An employee might prop a door open for some reason. A tailgating attacker can take advantage of this to gain access to the secure area.
• “Copied ID: If an attacker can steal a user’s ID or device, they may be able to copy the credentials used to unlock the door to the secure area. This would allow the attacker to masquerade as a legitimate employee and gain access.”

New-school security awareness training can teach your employees to follow security best practices so they can avoid falling for social engineering attacks.