Tailgating is following an authorized person into a secure area. The attacker does not break in. They walk in behind someone who has legitimate access. A friendly smile and a full armload of boxes helps. So does a uniform or a clipboard. The target holds the door out of politeness, and the attacker is inside. No alarm sounds. No lock is picked. The security control was bypassed by human courtesy.

Tailgating is a physical social engineering technique. It works in office buildings, data centers, and restricted manufacturing floors. The defense is procedural. Mantraps and turnstiles allow only one person through at a time. Badge readers on every door enforce access control. Security awareness training teaches employees to challenge unfamiliar faces. But challenges are awkward. Most people avoid confrontation. That is why tailgating works. The best defenses remove the decision from the employee. A mantrapping door that physically prevents two people from entering together solves the problem. A reception desk that requires all visitors to sign in and be escorted solves it too. Technology and process beat vigilance. Vigilance is unreliable.

Tailgating defenses

• Mantraps — interlocking doors that admit one person at a time
• Turnstiles — physical barriers requiring individual badges
• Reception desks — visitor sign-in and escort policies
• Training — teach employees to challenge unfamiliar people
• Badge enforcement — require visible badges at all times

Tailgating exploits politeness. The defense is a door that does not care about being polite.