Topic 2.2 Notes – Physical Vulnerabilities and Attacks
What Physical Vulnerabilities and Attacks Are
Cybersecurity is not only about code and networks. Your data lives on devices, those devices sit in rooms, people can touch them, and they all need power.
Here’s the risk model you need to keep straight:
- Asset = something valuable, like a server, laptop, badge, or customer data
- Threat = something that can cause harm, like an intruder or a flood
- Vulnerability = a weakness, like an unlocked room or exposed USB port
- Attack = the action a human adversary takes to exploit the weakness
- Risk = the chance the threat exploits the vulnerability and causes harm
- Impact = the damage caused
A big exam trap is mixing those up. An unlocked server room is a vulnerability. The intruder is the threat. Entering the room and plugging in malware is the attack.
Physical access matters because it can bypass technical controls. A password helps less if someone reaches an already logged-in computer.
The damage often lands in the CIA triad:
- Confidentiality when data is viewed, copied, or stolen
- Integrity when data or systems are changed
- Availability when devices or services are damaged or taken offline
Common Physical Attacks
Many of these attacks use social engineering, which means manipulating people through trust, urgency, or fake authority.
Piggybacking
This is when an authorized person knows another person is coming in and lets them in because they were tricked.
Badge-controlled entry
Common setups include:
- carrying big boxes so someone holds the door
- claiming a badge was forgotten
- pretending to be repair or maintenance staff
Tailgating
This is when the attacker slips in without the authorized person noticing.
That distinction gets tested a lot:
- Piggybacking = the victim is aware someone entered
- Tailgating = the victim does not realize it
Shoulder Surfing
This means watching someone access sensitive information so it can be used later.
Targets include:
- passwords or PINs
- door codes
- screen contents
- papers on a desk
A phone camera can turn this into recorded evidence for later review.
Dumpster Diving
This means searching trash for useful information.
Useful finds include printed documents, names, schedules, technical notes, and shipping labels. This often supports later recon or impersonation.
Card Cloning
This means copying someone’s access card. The real user may still have the original, which makes the later entry look like it came from the legitimate cardholder.
Common Physical Vulnerabilities and What They Enable
Common weaknesses include unlocked rooms, unattended devices, exposed ports, visible sensitive info, papers in normal trash, accessible electrical equipment, and critical systems exposed to floods or fire.
Those weaknesses can lead to:
- Unauthorized access to spaces or data
- Disruption of services
- Theft or destruction
- Unauthorized modification
If an attacker reaches sensitive information, they may steal or copy it. Copying still breaks confidentiality even when the original stays there.
If they reach a device or port, they may plug in:
- a keylogger to capture keystrokes
- an external drive with malware
- or just physically destroy the device
Power is part of this too. Damaging breakers, cables, substations, or transformers can make systems unavailable without touching the computer itself.
Human threats act on purpose. Natural threats like floods, fires, storms, and earthquakes can still exploit physical weaknesses and cause cyber consequences.
How to Assess and Document Physical Risk
Risk write-ups should connect the whole chain, not just name a weakness.
- Identify the asset and why it matters.
- Identify the threat.
- Identify the physical vulnerability.
- Explain how it would be exploited.
- State the likely CIA consequences.
- Judge likelihood and impact.
- Give the final risk rating.
A complete entry ties together asset, threat, vulnerability, exploitation, consequences, likelihood, impact, and rating. That’s the kind of thinking used on scenario MCQs and FRQs.
High, Moderate, and Low Physical Risk
High risk
A sensitive or critical asset is exposed in a poorly controlled space.
Example: a server with payroll data in an unlocked room off an unmonitored hallway. Easy access plus severe consequences gives you high risk.
Moderate risk
The exposed asset is not very sensitive by itself, but it can be a foothold.
Example: a reception computer with exposed USB ports connected to the internal network.
Low risk
The asset has low value and exploitation is unlikely.
Example: non-sensitive laptops left unattended inside a badge-controlled office.
Key Takeaways
Asset
Something valuable that must be protected, such as a device, data, facility, or service
Threat
A person, event, or condition capable of causing harm; physical threats include human adversaries and natural disasters
Physical Vulnerability
A weakness or flaw in a physical environment, facility, device, or information-handling practice that a threat could exploit
Risk
The possibility that a threat will exploit a vulnerability and compromise an asset
Attack
An action taken by a human adversary to exploit a vulnerability and compromise an asset
Likelihood
The chance that a threat will exploit a vulnerability
Impact
The damage that would result if a threat exploited a vulnerability, such as data loss, service disruption, or equipment destruction
Piggybacking
Using social engineering to manipulate an authorized person into granting access to a restricted area
Tailgating
Entering a restricted area by following close behind an authorized person without that person's awareness or knowledge
Shoulder Surfing
Watching or recording a user accessing sensitive information so it can be used later
Dumpster Diving
Searching a target's physical trash for information that can help achieve an attack objective
Card Cloning
Copying an authorized user's access card so the duplicate can access resources permitted to the original credential
Keylogger
A device attached to a computer that records a user’s keystrokes to capture credentials or other information
Physical Risk Assessment
Identify the asset, threat, vulnerability, exploitation method, consequences, likelihood, impact severity, and justified risk rating
High Physical Risk
Risk in which sensitive information or critical systems are physically exposed without sufficiently restricted and controlled access
Moderate Physical Risk
Risk in which an exposed noncritical or nonsensitive asset could provide a foothold for access to more valuable resources
Low Physical Risk
Risk in which the vulnerable asset has low value, exploitation is unlikely, and the resulting harm would be limited
Notes
Asset
Something valuable that must be protected, such as a device, data, facility, or service
Threat
A person, event, or condition capable of causing harm; physical threats include human adversaries and natural disasters
Physical Vulnerability
A weakness or flaw in a physical environment, facility, device, or information-handling practice that a threat could exploit
Risk
The possibility that a threat will exploit a vulnerability and compromise an asset
Attack
An action taken by a human adversary to exploit a vulnerability and compromise an asset
Likelihood
The chance that a threat will exploit a vulnerability
Impact
The damage that would result if a threat exploited a vulnerability, such as data loss, service disruption, or equipment destruction
Piggybacking
Using social engineering to manipulate an authorized person into granting access to a restricted area
Tailgating
Entering a restricted area by following close behind an authorized person without that person's awareness or knowledge
Shoulder Surfing
Watching or recording a user accessing sensitive information so it can be used later
Dumpster Diving
Searching a target's physical trash for information that can help achieve an attack objective
Card Cloning
Copying an authorized user's access card so the duplicate can access resources permitted to the original credential
Keylogger
A device attached to a computer that records a user’s keystrokes to capture credentials or other information
Physical Risk Assessment
Identify the asset, threat, vulnerability, exploitation method, consequences, likelihood, impact severity, and justified risk rating
High Physical Risk
Risk in which sensitive information or critical systems are physically exposed without sufficiently restricted and controlled access
Moderate Physical Risk
Risk in which an exposed noncritical or nonsensitive asset could provide a foothold for access to more valuable resources
Low Physical Risk
Risk in which the vulnerable asset has low value, exploitation is unlikely, and the resulting harm would be limited
