Tailgating Introduction
While it’s clear that cybersecurity teams spend most of their time identifying security risks within the digital landscape, there still exist vulnerabilities within the real world that can impact data security and confidentiality. Or in other words, the physical devices that contain data and confidential information may also be vectors of attack for cybercriminals.
Tailgating attacks are one such example of this kind of vulnerability, existing in both physical and virtual realms and usually with the end goal of entering restricted areas (physical and virtual) to steal sensitive information, disrupt operations, or cause other types of damage.
But what exactly is a tailgating attack, and how can you prevent tailgating in your organization? Here, we explore this complex topic, explain the difference between tailgating vs. piggybacking and look at what tailgating is in cybersecurity. Read on to learn more and how you can protect your organization.
What Is a Tailgating Attack?
Current tailgating definitions include security vulnerabilities where an unauthorized individual follows an authorized person into a restricted area without proper identification or clearance. This can happen in a physical setting, such as a building lobby or a parking garage, or in a virtual setting, such as a secure network or computer system.
Within the physical setting, the answer to “what is tailgating” is relatively simple. Tailgating occurs when an individual follows an authorized person through a door or gate without being stopped or questioned by security. This may happen because the authorized person holds the door open for the unauthorized individual or because security personnel fails to check the identification of the person entering the building.
This can have severe consequences, with cybercriminals either stealing important devices that contain sensitive data or installing malware on devices or servers that then give them backdoor entry at a later date.
When it comes to tailgating and cybersecurity, however, there are a few factors to consider. Tailgating occurs when an unauthorized individual gains access to a secure network or computer system by piggybacking on the access of an authorized person. This can happen when an authorized person unknowingly allows an unauthorized individual to use their computer or network credentials or when an unauthorized individual can intercept the credentials of an authorized person through a phishing attack or other means.
How Does Tailgating Work?
More often than not, tailgating relies on manipulating our sense of common courtesy so that potential attackers can gain access to restricted areas. Whether that’s holding open a door for someone carrying a heavy load or allowing unauthorized personnel to use your computer, the truth is, your organization's policy on allowing either physical or digital access to unauthorized personnel should be strict and followed by all employees to the letter.
Tailgating can cause harm in a variety of ways, from violence, vandalism, and corporate espionage; however, for the purposes of this article, we will concentrate on tailgating and cybersecurity. Generally sparking, this means that a tailgating attack will look to steal hardware (USB drives, SSDs, servers, laptops, and even computers) that contain sensitive information that can be used against the company. Alternatively, tailgating may occur when third-party contractors are on site and leave doors open for ventilation or other reasons.
Finally, virtual tailgating, which includes methods such as "phishing" and "vishing" among others, is an attack that uses digital means to gain unauthorized access to sensitive information. It is similar to physical tailgating in that the attacker is trying to gain access to a secure area, but instead of physically following someone through a door, the attacker uses digital means such as email, phone, or social media to trick the victim into providing access.
Tailgating Social Engineering
Tailgating is considered a form of social engineering as it attempts to take advantage of human error to gain access to sensitive areas. Commonly, the attacker may use various methods to blend in and appear as an authorized individual, such as pretending to be an employee, delivery person, or contractor.
In doing this, the attacker may then follow an authorized person through a security door or gate without using a key or proper authentication. The person being followed, who may be an employee or authorized individual, unknowingly grants access to the attacker.
On a virtual level, social engineering is also used to access login credentials from the user without understanding that they will be used nefariously. This can be achieved through social media or email exchanges, or even pharming methods that direct users to a malicious website.
Tailgating vs. Piggybacking
Tailgating and piggybacking are terms that are often used interchangeably to describe the same tactic. Tailgating refers to the act of following someone through a security door or gate without using a key or proper authentication. Piggybacking is a specific type of tailgating that refers to when the person being followed, who may be an employee or authorized individual, unknowingly grants access to the tailgater. The purpose of both tailgating and piggybacking is to gain unauthorized access to a secure area. Both are used in social engineering and can be a serious security threat.
Tailgating Attack Example
There are many different scenarios in which tailgating can occur; however, perhaps the most common example of tailgating is where an attacker follows an employee into a secure office building without using a key or proper authentication. The employee, unaware of the attacker's intentions, holds the door open for the attacker, allowing them to enter the building.
Once inside, the attacker can move freely throughout the building and potentially access sensitive information, steal assets, or cause other types of damage. In this example, the attacker may pretend to be an employee, delivery person, or contractor to blend in and avoid suspicion.
Virtual examples of tailgating may include the attacker sending an email to an employee of a company pretending to be from a legitimate source, such as the IT department, and asking the employee to click on a link or provide sensitive information. The employee, thinking the email is legitimate, clicks the link and enters their sensitive information.
It's important to keep in mind that tailgating attacks can be executed with different methods, and attackers can be very creative in their approach, but the goal is always to gain unauthorized access to sensitive information, financial assets, or other valuable resources.
Tailgating Detection
Detecting tailgating as it is happening can be tricky, as most cybercriminals will limit the time spent accessing sensitive resources in an effort to avoid detection. However, employee vigilance is key, and electronic IDs can play a big part in tailgating detection. If you suspect you have been the victim of a tailgating attack, many of the prevention measures (such as security cameras) below will allow you to identify the perpetrator and spot weaknesses in your existing security systems.
How to Prevent Tailgating
Once you’ve understood. Exactly what tailgating is and how it works, there are plenty of measures your organization can take to prevent it. These include:
- Implement security cameras: Place security cameras at entry and exit points to monitor the flow of individuals entering and exiting the building or secure area.
- Station security personnel: Station security personnel at entry points to visually check for proper identification and to observe the behavior of those entering the building.
- Implement electronic access systems: Use electronic access systems such as key cards or biometric authentication to ensure that only authorized individuals are granted access to the building or secure area.
- Use tailgating detection systems: Implement tailgating detection systems that use various technologies such as video analytics, motion sensors, and RFID to detect and alert security personnel when an unauthorized person is following an authorized individual.
- Provide employee training: Provide employee training on how to recognize and report suspicious behavior, as well as how to use proper security measures such as keeping doors closed and locked and not holding doors open for strangers.
- Use security signs: Put up security signs and notices in visible areas to remind employees and visitors of the security policies in place.
- Use security barriers: Use security barriers such as turnstiles or revolving doors to control entry into a secure area.
- Implement security protocols: Have strict security protocols in place for handling visitors or contractors and have a proper screening process to verify the identity of the person.
What to Do if You’ve Been Tailgated
If you suspect that you have been tailgated, or that an unauthorized individual has gained access to a secure area by following you through a security door or gate, it's important to take immediate action to protect the security of the building or area:
- Report the incident: Report the incident to security personnel, management, or the appropriate authority as soon as possible. Provide a detailed description of the individual, including clothing and physical features.
- Review security footage: Review security footage to confirm the incident and identify the individual.
- Change passwords: If you suspect that sensitive information may have been compromised, change your passwords immediately.
- Review access logs: Review access logs to see if the unauthorized individual has accessed sensitive information or areas.
- Notify other employees: Notify other employees of the incident, so they can be vigilant of suspicious activity and report any further incidents.
- Review and update security protocols: Review and update security protocols to ensure that staff is fully trained in security awareness.
- Conduct a security audit: Conduct a security audit and staff cybersecurity training to identify any vulnerabilities that may have allowed the tailgater to gain access and address them accordingly.
Conclusion: Tailgaiting
With the huge range of cybersecurity threats currently on the radar of cybersecurity teams, it's sometimes all too easy to overlook the things right in front of you! However, it's important to remember that tailgating can be a serious security threat, and it's essential to take prompt action to minimize any potential damage. For more information on how you can ensure your organization is prepared for such an attack, contact us today and explore our blog for insights on the cybersecurity landscape.
