During a physical security assessment, an attacker dressed as a delivery courier and carrying several large boxes approaches a badge-secured entrance behind an employee. The attacker asks the employee to hold the door open, claiming their hands are full and they cannot access their badge. The employee complies, and the attacker enters without ever presenting credentials. Which social engineering technique is illustrated?
- ATailgating using a pretext
- BBaiting
- CDumpster diving
- DVishing
Show answer & explanationAnswer & explanation
Correct answer: A. Tailgating using a pretext
Tailgating (also called piggybacking) involves following an authorized person through a secured entry point, and here it is combined with a pretext (the delivery courier cover story) to justify the request for assistance. Vishing involves phone-based social engineering, dumpster diving involves searching discarded materials for sensitive information, and baiting involves leaving an enticing physical or digital item to lure a victim into compromising themselves.
Why the other options are wrong
- B. Baiting lures a victim with an enticing item (like a USB drive) to trigger a compromise, not physical door access.
- C. Dumpster diving involves searching through discarded trash for sensitive information, not gaining building access.
- D. Vishing is a voice-based phishing technique conducted over phone calls, not physical entry.
Tailgating (Piggybacking) with Pretexting
A physical social engineering technique where an attacker follows an authorized person through a secured entry point, often using a fabricated pretext (cover story) to justify needing help or access.
- Commonly combined with a pretext like a delivery, maintenance, or forgotten badge story
- Exploits human courtesy norms around holding doors open
- Mitigated with mantraps, badge-in-badge-out enforcement, and security awareness training
Memory trick: Tailgating: sneak in on someone else's tail, with a good story