When it comes to data protection from threat actors, namely, in a cybersecurity context, we tend to think in terms of technology. Having a strong IDS (intrusion detection system), a properly configured firewall, up-to-date servers, and other defensive measures all are important in Information Security.
What often gets overlooked, however, are the other (namely physical) attack vectors. From social engineering attacks to bypassing security ID checks by following employees into a building, the physical security component is just as vital in protecting data.
One of the oldest and most effective methods of breaching security is shoulder surfing. It is a relatively simple concept. A threat actor, or perhaps a penetration tester hired by an organization, will seek to gain information that they can use to harm a target through this method. The original iteration of this attack was peering over someone’s shoulder when they were logging into their account, viewing the keystrokes, and logging the password entered. Another common variation was looking at sticky notes that employees wrote their passwords on. The sticky notes were usually placed on their monitor and were easily read by a malicious individual.
The attacks began mostly in offices during the 90s dotcom boom, and while these methods are still a threat, shoulder surfing has many more tactics available in the 21st Century. Much of this has to do with how the threat landscape has opened up. With the advent of smartphones, tablets, and other IoT (Internet of Things) devices, the possibilities for attacking are endless. So many individuals log into sensitive accounts in public with no awareness of how this can be used against them. From their social media accounts to mobile banking applications, shoulder surfing is more lucrative for cybercriminals than ever before.
Nowadays, to defend against shoulder surfing attacks, one must be cognizant of their environment at all times. Threat actors don’t just shoulder surf by standing behind you at an ATM, but also use video cameras, binoculars, and other image magnification methods. To mount a proper defense against shoulder surfing, try the following methods.