Physical Attacks: Tailgating, Shoulder Surfing, Card Cloning | AP Cybersecurity
Physical Security Attacks: Tailgating, Shoulder Surfing & More
Many attacks skip digital defenses entirely by exploiting physical access. Topic 2.2 covers tailgating, shoulder surfing, dumpster diving, and card cloning, plus why physical access to a device is so dangerous.
Contents
The physical attacks
Tailgating is following an authorized person through a secure door without your own credentials. Shoulder surfing is watching someone enter a password or PIN. Dumpster diving is searching discarded materials for useful information. Card cloning copies an access card to impersonate a legitimate holder.
Adversaries often combine these with social engineering, for example holding a box so someone holds the door (tailgating plus a believable pretext).
A person carrying coffee in both hands smiles and an employee badges them through the door. What attack is this?
Reveal answer
Tailgating, aided by social engineering. The attacker used a believable reason (full hands) so an authorized employee opened the secure door for them.
Map the method to the attack: following through a door = tailgating, watching entry = shoulder surfing, searching trash = dumpster diving, copying a badge = card cloning.
Why physical access is dangerous
Physical access to a device can let an attacker bypass software controls entirely: they can disrupt power, plug in malicious hardware, or remove a drive. The framework rates many physical vulnerabilities as high risk for this reason.
This is why later topics add physical controls and detection: digital defenses alone do not stop someone standing at the machine.
Why is an unlocked, unattended server room a high physical risk?
Reveal answer
Physical access lets an attacker tamper with hardware, copy drives, or cut power, bypassing digital controls entirely. The asset and the access together make it high risk.
Red teams walk right in
Professional penetration testers routinely gain building access simply by carrying boxes and following staff through secure doors. A friendly pretext often beats a badge reader, which is why tailgating is taken seriously.
Physical access can bypass digital defenses entirely.
Key Terms
| Tailgating | Following an authorized person through a secure door. |
| Shoulder surfing | Watching someone enter a password or PIN. |
| Dumpster diving | Searching discarded materials for information. |
| Card cloning | Copying an access card to impersonate a holder. |
Match It Up
Common Mistakes
Confusing tailgating and shoulder surfing
Tailgating is following through a door; shoulder surfing is watching someone enter credentials.
Underrating dumpster diving
Discarded documents and devices can leak credentials and sensitive data.
Thinking digital defenses cover physical access
Physical access can bypass software controls entirely.
Ignoring social engineering in physical attacks
Tailgating usually relies on a believable pretext, not force.
Check for Understanding
Frequently Asked Questions
Get in Touch
Whether you're a student, parent, or teacher — I'd love to hear from you.
Just want free AP CS resources?
Enter your email below and check the subscribe box — no message needed. Students get daily practice questions and study tips. Teachers get curriculum resources and teaching strategies.
Message Sent!
Thanks for reaching out. I'll get back to you within 24 hours.
Prefer email? Reach me directly at [email protected]