What is tailgating?
Tailgating is a social‑engineering technique where an intruder walks close behind authorized personnel to gain access to a secured area without proper credentials. The intruder waits near a door, times their approach, and uses speed or distraction to slip through before the door locks. Because many offices rely on badge readers or keypad locks that only check the first person through, tailgaters often go unnoticed.
What is piggybacking?
Piggybacking is similar to tailgating but involves explicit permission. The unauthorized person asks an employee to hold the door, claiming they forgot their access badge or their hands are full. Out of courtesy, the employee grants entry without verifying credentials. Unlike tailgating, piggybacking exploits a victim’s helpfulness rather than stealth.
Why these tactics work
- Human nature: People want to be helpful and avoid seeming rude. When someone asks for assistance, employees may not feel comfortable refusing.
- Assumed legitimacy: Attackers may dress professionally, carry props like delivery boxes or wear fake badges to appear trustworthy.
- Lack of training: Many organizations focus on digital security and underestimate the risk of physical intrusion. Without clear policies, staff may not know they should challenge strangers.
Real‑world examples
- Impersonating an auditor: A threat actor might pose as an external IT auditor and request access to the server room. If staff let them in, they can plant malware or steal equipment.
- Delivery ruse: An attacker carrying boxes asks to be buzzed in so they can "drop off supplies." Once inside, they wander into restricted areas.
How to prevent tailgating and piggybacking
- Educate employees: Train staff to politely challenge anyone entering behind them. Make it clear that it’s okay to ask for ID.
- Use physical controls: Install mantraps or turnstiles that allow only one person at a time. Require separate authentication for each entry.
- Implement escort policies: Require visitors to sign in and be escorted at all times. Provide temporary badges that expire.
- Encourage a culture of security: Remind employees that security isn’t rude. A quick challenge can prevent serious breaches.
- Combine with digital security: Use multi‑factor authentication for sensitive systems and monitor logs for suspicious activity. Physical intrusions often accompany data theft.
Final thoughts
Tailgating and piggybacking exploit our politeness and trust. By acknowledging these threats and training staff to verify identity and follow access protocols, organizations can close a major gap in their security posture. Protecting your network starts at the door.