Division of

Agricultural Sciences and Natural Resources

Story By: OSU Agriculture IT | dasnr_it@okstate.edu

On the topic of physical security, it’s important to be aware of the physical attacks hackers and bad actors can use to further their cyber goals. These attackers won’t always appear in your email spam or on your computer screen. Sometimes, they may take a more direct approach. A hacker might attempt to gain information or access business related files by tailgating, dumpster diving, or shoulder surfing.

Tailgating, in a cybersecurity sense, is much less fun than the outdoor version we are all familiar with at OSU. When a bad actor tailgates a target, they follow that person into a space where they should not be allowed. This can be as simple as a hacker asking, “Can you hold the door open for me?” when entering a building that requires an ID scan. Once inside, a bad actor can potentially gain access to data, equipment, or other resources that are meant for staff only.

To obtain this information, hackers may use dumpster diving or shoulder surfing. While we are all familiar with dumpster diving, the act of digging through trash in the hopes of finding important documents, passwords, or other sensitive information, shoulder surfing is a term more commonly associated with cybersecurity. Shoulder surfing occurs when an attacker gains information by looking at their target’s laptop, phone, or another device’s screen without the target realizing it. This is most often done in public places where an attacker can easily see someone’s screen and gather information, they should not have access to.

Being aware of these physical threats is an important part of cybersecurity. Something as simple as not holding a secure door open for a stranger, properly disposing of sensitive documents, or being mindful of who can see your screen can help prevent sensitive information from falling into the wrong hands.

• Below are several physical security practices that can help protect sensitive information in an office environment:
• Monitor office entrances: Ensure office entrances are visible to employees or reception staff to help deter unauthorized individuals from accessing restricted areas.
• Position monitors to prevent shoulder surfing: Place computer screens so visitors and unauthorized personnel cannot easily view sensitive information. Privacy screens can provide an additional layer of protection. Employees should also lock their computers whenever they step away from their workstations, even for a short period, as unattended devices can quickly become security risks.
• Keep sensitive documents secure: Avoid leaving printed reports, customer records, passwords, or other confidential materials on desks. Store sensitive information in locked drawers or cabinets and use secure shredding bins to dispose of documents that are no longer needed.
• Train employees on physical security procedures: Regularly reinforce physical security expectations through meetings, training sessions, and other communications. Ongoing awareness helps employees recognize risks and consistently follow security best practices.

Physical security is often overlooked, but it plays a critical role in protecting an organization’s data, systems, and reputation. Cybersecurity is not just about firewalls, antivirus software, and strong passwords. It also depends on the daily actions of employees and their awareness of the physical environment around them. By staying alert to threats such as tailgating, shoulder surfing, and dumpster diving, and by following established security practices, everyone can help create a safer workplace. Remember, protecting sensitive information starts with simple habits, and those small actions can make a significant difference in preventing security incidents.

Further Reading

• CISA - Physical Security
• Beyond Identity - Shoulder Surfing
• Identity Protection Authority - Dumpster Diving Identity Theft
• SecuriThings - Physical Security
  

For more information, visit our website.

Story By: OSU Agriculture IT | dasnr_it@okstate.edu