Physical Security at Work: Tailgating and Clean Desks
The strongest firewall does not help if someone can walk into your office and read a sticky note or slip through a secure door. Physical security is the everyday, in-person side of protecting information, and small habits make a big difference.
Tailgating and access control
Tailgating is when someone follows an authorized person through a secure door without badging in, often by looking friendly or carrying boxes so you hold the door. It is a common way intruders get inside.
- Do not hold secure doors for people you do not recognize, even if it feels rude.
- Everyone badges in individually.
- Politely challenge or report anyone without a visible badge in restricted areas.
Clean desk and screen habits
Protect what is in plain sight:
- Lock your screen whenever you step away.
- Do not leave passwords on sticky notes or sensitive documents on your desk.
- Store confidential papers and devices out of sight, and shred what you no longer need.
- Be mindful of "shoulder surfing" in public, use a privacy screen if needed.
Badges, devices, and visitors
A few more essentials:
- Keep your access badge secure and do not lend it out.
- Never leave laptops or phones unattended in public.
- Follow visitor procedures, escort guests and log them in.
How it plays out in the real world
Based on real, widely reported incident patterns; names and details are illustrative.
The man carrying boxes
A penetration tester arrived at a secure office in a courier uniform, arms full of boxes. At the badge door he slowed and looked helpless, and an employee held it open for him. Politeness beat the badge reader. Inside, he plugged a small device into a meeting-room network port and left the way he came.
The device gave his team remote access to the internal network. Total cost: a uniform, some boxes, and a smile.
- Tailgating weaponizes courtesy. Holding doors is kindness; at a badge door it is an access-control failure. "Everyone badges in" is the polite security rule.
- A stranger inside is everyone's business. Unescorted, unbadged visitors should be greeted and walked to reception. Challenging by helping feels natural and works.
- Network ports are doors too. Live ports in meeting rooms and lobbies deserve the same control as entrances. Unused jacks should be dead.
Test yourself
Test your physical security habits, free.
Frequently asked questions
What is tailgating in security?
Tailgating (or piggybacking) is when an unauthorized person follows someone through a secure entrance without badging in. It relies on politeness, holding the door, so the fix is to make sure everyone badges in individually.
Why does a "clean desk" matter for cybersecurity?
Sensitive information left in the open, passwords, documents, unlocked screens, can be read, photographed, or stolen by anyone passing by. A clean desk and a locked screen remove that easy opportunity.
Is it rude to challenge someone without a badge?
It is good security, and most workplaces expect it. You can be polite: offer to help them find reception or sign in. Attackers rely on people being too polite to ask.