Tailgating, also called piggybacking, is a physical social-engineering attack in which an attacker enters a restricted area by following an authorized person through an access point. The attacker exploits courtesy or distraction, such as someone holding a door open. section 11.2.2
The technique relies on human social behavior rather than a technical vulnerability. Authority, likability, reciprocal favors, commitment, and urgency can make people comply without verifying authorization. section 11.2.2
Recognize tailgating as part of a broader physical-security program:
- Classify it as social engineering and as a potential precursor or facilitator to technical threats. section 11.2.2
- Use user awareness and training so individuals can recognize social-engineering attacks and respond appropriately. section 11.2.2 section 11.6
- Use physical access control, such as badge readers, to restrict entry to authorized users. section 11.6
