← WA Computer Science ATAR Unit 2

Physical social engineering: tailgating and baiting

Physical social engineering: tailgating follows an authorised person through a secure door, while baiting leaves an infected USB drive for someone to plug in.

Part of: WA Computer Science ATAR Year 11 — Cyber Security — Module 44

Understanding Physical social engineering: tailgating and baiting in WA Computer Science ATAR Unit 2

What it does: The attacker uses the employee's valid badge access to enter without being authorised, which is the defining feature of tailgating. The tempting label and the planted infected drive make this baiting. It relies on the victim's curiosity to run the malware. Both attacks happen in the physical world and rely on human behaviour, not on technical hacking over a network. Each person should authenticate for themselves. Holding the door open for strangers lets an attacker straight in. Baiting works by exploiting human curiosity, not a technical flaw in a firewall. Tailgating is physical social engineering that gets an attacker into a secure area by slipping in behind someone who is allowed in.

Common mistakes: More than one person through on a single badge scan signals tailgating, so the check should be count > 1. Using < 1 would never trigger for a real entry. An untrusted USB drive could be bait. It must be blocked, not run automatically, so the line should be block(drive).

Class: _____________________ · Name: _____________________ · Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Physical social engineering: tailgating and baiting to a class →

This module's key terms are also in a printable crossword (Modules 125–266) and word search (Modules 28–266).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning

Duo

A stranger walks closely behind an employee and slips through a secure door before it closes. What is this attack?

BaitingTailgating

Matches

Policy: hold the secure door open for anyone carrying boxes, because it is polite.

↓

Holding the door open for an unknown person allows tailgating. Each person should use their own badge, or be signed in by reception and escorted.

Applying

Meanings

Term

tailgating and baiting

Meaning

Physical social engineering: tailgating follows an authorised person through a secure door, while baiting leaves an infected USB drive for someone to plug in.

Practice

IF person_enters AND badge_scanned = FALSE THEN

Testing

Gaps

IF peopleIn badgesScanned THEN

Check Answer

Spots

3 return 'deny'

4 if count < 1:

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy

Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games

Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print

Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. A stranger walks closely behind an employee and slips through a secure door before it closes. What is this attack?

A. Tailgating ✓

B. Baiting

Tailgating means following an authorised person through a secure door without using your own credentials.

2. An attacker leaves a USB drive labelled 'Staff Salaries' in a school car park, hoping someone plugs it in. What is this attack?

A. Tailgating

B. Baiting ✓

Baiting uses a tempting item, such as an infected USB drive, to lure a victim into compromising their own device.

3. Which statement is true about tailgating and baiting?

A. Both are network attacks that only happen online

B. Both are physical social engineering that trick people rather than break code ✓

Both attacks happen in the physical world and rely on human behaviour, not on technical hacking over a network.

4. Which is the best way to stop tailgating?

A. Require everyone to tap their own access card and challenge unknown people ✓

B. Hold the door open for anyone carrying heavy boxes

Each person should authenticate for themselves. Holding the door open for strangers lets an attacker straight in.

5. You find an unknown USB drive on the ground at school. What should you do?

A. Hand it to IT staff without plugging it in ✓

B. Plug it into your laptop to find the owner

An infected USB drive can install malware as soon as it is plugged in, so unknown drives should go to IT staff.

Match the Pairs

tailgating → An attacker follows an authorised person through a secure door without using their own badge or key.

baiting → An attacker leaves an infected USB drive where someone will find it and plug it into a computer.

An attacker walks in behind an employee who has just tapped their badge, before the door closes. → tailgating: door opens for badge, attacker follows

An attacker leaves a USB drive labelled 'Staff Salaries' in a car park, hoping a curious worker plugs it in. → baiting: USB labelled Staff Salaries left in car park

Policy: hold the secure door open for anyone carrying boxes, because it is polite. → Holding the door open for an unknown person allows tailgating. Each person should use their own badge, or be signed in by reception and escorted.

Policy: plug any USB drive found in the office into your computer to find its owner. → Plugging in an unknown USB drive is the action a baiting attack wants. Found drives should be handed to IT security and never plugged in.

Key Term

tailgating and baiting

Physical social engineering: tailgating follows an authorised person through a secure door, while baiting leaves an infected USB drive for someone to plug in.

Fill in the Blanks

1. IF peopleIn > badgesScanned THEN OUTPUT "Possible tailgating" ENDIF

Hint: Type the comparison operator that is true when more people walked in than badges were scanned, a sign of tailgating.

2. IF NOT usbKnown THEN OUTPUT "Do not plug it in" ENDIF

Hint: Type the logical operator that reverses a Boolean, so an unrecognised USB drive left as bait is flagged.

3. IF badgeOK AND onePerson THEN OUTPUT "Door opens" ENDIF

Hint: Type the logical operator that needs both a valid badge and a single person entering, which stops tailgating.

4. OUTPUT "Do not plug in unknown USB"

Hint: Type the pseudocode keyword that displays a warning message to staff about baiting.

5. extra = peopleIn - badgesScanned

Hint: Type the arithmetic operator that works out how many people entered without scanning a badge.

Spot the Error

Question 1

A def check_door(card, count):

B if not valid(card):

C return 'deny'

D if count < 1:

E return 'alarm'

F return 'allow'

Line D — More than one person through on a single badge scan signals tailgating, so the check should be count > 1. Using < 1 would never trigger for a real entry.

Question 2

A def on_usb_plugged(drive):

B if not drive.trusted:

C autorun(drive)

D report_to_it()

Line C — An untrusted USB drive could be bait. It must be blocked, not run automatically, so the line should be block(drive).

Question 3

A badge_valid = scan(card)

B if badge_valid = True:

C unlock_door()

Line B — A single = assigns a value and is invalid in an if condition. Comparing needs ==, so the line should be if badge_valid == True:.

Question 4

A def let_in(person):

B if person.followed_in:

C return True

D return scan(person.badge)

Line C — Someone who followed another person in has not scanned their own badge, so they are a tailgater. They must be refused: return False.

Question 5

A def classify(method):

B if method == 'follow_in':

C return 'tailgating'

D if method == 'usb_left'

E return 'baiting'

F return 'other'

Line D — The if statement is missing its colon at the end. It should be if method == 'usb_left':.

Student with a class code? Join your class →