How it works
Physical attacks often use ordinary behavior: following someone through a door, watching a code entry, borrowing an unlocked device, or plugging into an exposed port.
Use awareness, badges, clean-desk habits, screen locks, port control, and escort rules as layered defenses.
Common error
Do not focus only on burglars. A student, visitor, contractor, or former staff member can create physical risk.
Worked example
A visitor follows a student into a restricted lab and uses an unlocked workstation.
Evidence
Entry: no separate credential
Workstation: signed-in session
Visitor escort: absentThe scenario combines tailgating and access to an unattended session. Use a visitor verification and escort process, avoid holding controlled doors open for unverified entrants, and enforce screen locking. Respond through the approved process rather than assuming the visitor has permission.
Exercises
2.4.1
What behavior reduces shoulder-surfing risk at a public kiosk?
Show solution
Protect the view of sensitive entry, avoid displaying unnecessary personal information, and use an appropriate privacy screen or placement. Screen locking protects the session when the user leaves.
2.4.2
Write three rules for handing a shared tablet from one user to another.
Show solution
Sign out of the previous session, verify the next user through the approved checkout process, and record the handoff. Apply screen-lock and storage rules when it is not in active use.