Difficulty: Introductory | Prerequisites: Basic understanding of cybersecurity principles, familiarity with the CIA triad (confidentiality, integrity, availability).
Physical security is one of the most overlooked layers in information security, yet it remains one of the most exploited. This scenario sits within the broader CYB 200 curriculum on identifying and mitigating security threats across all domains, not just digital ones. You should already be comfortable with the CIA triad and have a basic grasp of threat identification. The scenario tests your ability to spot real-world physical security failures in a workplace setting and propose controls to address them.
A contracted security analyst observes a cleaning crew at a financial company engaging in suspicious behaviour: reading analysts' screens (shoulder surfing), retrieving documents from a "destroy" bin (dumpster diving), and hiding those documents on their cart. The scenario highlights failures in physical security controls, personnel awareness, and data disposal procedures within an organisation that handles sensitive financial data.
Shoulder surfing
The act of observing someone's screen, keyboard, or documents to obtain confidential information without authorisation.
In simple terms, this means looking over someone's shoulder (or from nearby) to steal what's on their screen or desk.
Dumpster diving
The practice of searching through discarded materials (rubbish bins, recycling, shredder bins) to recover sensitive or useful information.
Think of it as going through someone's bin to find passwords, account numbers, or internal documents that were thrown away instead of properly destroyed.
Clean desk policy
An organisational rule requiring employees to clear all sensitive documents, removable media, and visible information from their workspaces when unattended.
In simple terms, this means nothing confidential should be left out in the open when you leave your desk.
Physical security controls
Measures designed to prevent unauthorised physical access to facilities, equipment, and information. Examples include locked doors, badge access, security cameras, visitor logs, and escort requirements.
Think of it as the locks, cameras, and rules that keep the wrong people out of the right places.
Social engineering
The manipulation of people into performing actions or divulging confidential information, often by exploiting trust, authority, or routine.
In simple terms, this means tricking people rather than hacking systems.
Insider threat
A security risk originating from individuals who have legitimate access to an organisation's facilities or systems, including employees, contractors, and cleaning staff.
Think of it as the danger that comes from people who are already inside the building.
Data disposal / media sanitisation
The process of securely destroying or rendering unreadable any media or documents containing sensitive information, so that the data cannot be recovered.
In simple terms, this means making sure that when you throw something away, nobody can read it afterwards.
Personally identifiable information (PII)
Any data that could be used to identify a specific individual, such as names, addresses, account numbers, or financial records.
Think of it as any piece of information that points back to a real person.
Confidentiality (CIA triad)
The principle that information should be accessible only to those authorised to view it.
In simple terms, this means keeping secrets secret, and making sure only the right people can see sensitive data.
You are a security analyst at an IT firm, contracted as helpdesk support for a financial company
The financial company employs analysts who handle high-income client accounts
Analysts are contractually obligated not to share personal client information outside the company
Your on-site role: assisting with a printer security issue for the administrative assistant
The cleaning crew moves from office to office and cubicle to cubicle
They are observed taking "great notice" of the information displayed on analysts' screens
This constitutes shoulder surfing, a form of visual eavesdropping
The information on those screens likely includes PII and sensitive financial data belonging to high-income clients
Shoulder surfing is a passive reconnaissance technique: the attacker gathers information without interacting with any system
A cleaning crew member removes papers from the "destroy" bin
They then attempt to hide the papers on their cleaning cart
The "destroy" bin exists specifically because the documents contain information too sensitive for normal disposal
Removing documents from this bin is a textbook example of dumpster diving
The concealment behaviour (hiding papers on the cart) signals intent, not accident
Other employees in the office ignore the cleaning crew entirely
Nobody challenges the crew's behaviour or reports the document removal
This represents a failure of security awareness training
Employees have become desensitised to the presence of non-employee personnel
The cleaning crew's access appears unmonitored and unsupervised
The cleaning crew has unrestricted access to offices and cubicles
No escort or supervision protocol appears to be in place
Screens displaying sensitive information are visible to anyone walking past
The "destroy" bin is accessible to unauthorised personnel
No clean desk policy is enforced (screens are visible, documents are accessible)
No visitor or contractor escort policy is in place
No physical barriers protect the "destroy" bin from unauthorised access
Security awareness training is either absent or ineffective
No screen privacy filters are installed
No monitoring (CCTV or supervisory) covers the workspace areas
Financial institutions, law firms, and healthcare providers all face this exact problem: cleaning crews, maintenance workers, and other contractors move through sensitive areas after hours with minimal oversight. High-profile data breaches have originated from physical document theft rather than digital intrusion.
Privacy screen filters on monitors are a direct, low-cost countermeasure deployed in banks, trading floors, and government offices precisely because shoulder surfing is a known and common attack vector. Locked shredder bins with tamper-evident seals are standard in regulated industries for the same reason.
Students often think "dumpster diving" only applies to searching through external rubbish bins outside a building. It does not. Retrieving documents from any disposal container, including internal "destroy" bins, qualifies.
Students sometimes assume that physical security threats are less serious than digital ones. In practice, a single stolen document can contain credentials, account numbers, or personal data that enables a much larger digital breach.
Students often overlook the cleaning crew as a threat vector because they have "legitimate" access to the building. Legitimate physical access does not equal authorisation to view or take sensitive materials.
Students frequently think that having a "destroy" bin is sufficient. It is not. The bin itself must be secured (locked, tamper-evident) and the destruction process must be verified.
⚠️ Be prepared to identify multiple overlapping threats in a single scenario. This scenario contains at least four distinct security issues (shoulder surfing, dumpster diving, lack of awareness, inadequate access controls).
⚠️ Know the difference between a threat (the cleaning crew's behaviour), a vulnerability (unlocked destroy bins, visible screens, no escort policy), and a risk (potential exposure of client PII and financial data).
⚠️ Expect questions that ask you to recommend specific controls. For this scenario: privacy screen filters, locked shredder bins, escort policies for contractors, security awareness training, clean desk policies, and CCTV.
⚠️ Understand confidentiality obligations. The analysts are contractually bound not to share client information outside the company. A breach caused by physical security failures still constitutes a violation of that obligation.
⚠️ Know that the observer's role matters. You are a contracted security analyst, not an employee of the financial company. Your director would write the plan. Exam questions may test whether you understand the reporting chain and scope of your authority.
True or False: Shoulder surfing requires the attacker to physically touch or interact with the victim's computer.
Answer: False. Shoulder surfing is purely visual observation.
Fill in the blank: Retrieving sensitive documents from a disposal bin is an example of ________.
Answer: Dumpster diving.
True or False: Having a "destroy" bin in the office is sufficient to protect sensitive documents from physical theft.
Answer: False. The bin must be locked or otherwise secured, and the destruction process must be verified.
Fill in the blank: A policy requiring employees to remove all sensitive materials from their desks when unattended is called a ________ policy.
Answer: Clean desk policy.
True or False: Because the cleaning crew has authorised access to the building, their viewing of screen content is not a security concern.
Answer: False. Physical access to the building does not grant authorisation to view confidential information.
Q: Identify at least three physical security threats present in Scenario Two.
A: Shoulder surfing (cleaning crew observing analysts' screens), dumpster diving (removing documents from the "destroy" bin and hiding them), lack of employee security awareness (staff ignoring the cleaning crew's behaviour), and inadequate physical access controls (no escort policy, no locked bins, no screen privacy measures).
Q: What specific controls would you recommend to mitigate the shoulder surfing risk in this scenario?
A: Install privacy screen filters on all analyst monitors, enforce a clean desk policy requiring screens to be locked when unattended, implement a clear-screen policy (automatic screen lock after inactivity), and position monitors so they face away from high-traffic areas and doorways.
Q: Why is the cleaning crew's behaviour considered an insider threat rather than an external threat?
A: The cleaning crew has legitimate, authorised physical access to the facility. They are inside the security perimeter. An insider threat originates from anyone with authorised access, not just employees. Contractors, vendors, and service personnel all fall within the insider threat category.
Q: As a contracted security analyst, what should your immediate response be upon observing these behaviours?
A: Document your observations in detail, including what you saw, when, and where. Report your findings to your director at your IT firm, as they are responsible for writing the security plan for the client. Do not confront the cleaning crew directly, as you are a contracted helpdesk resource, not a security officer for the financial company.
Q: Explain how the scenario represents a breach of confidentiality, referencing the CIA triad.
A: Confidentiality requires that information is accessible only to authorised individuals. The cleaning crew is not authorised to view client financial data or access documents marked for destruction. Their shoulder surfing and document theft compromise the confidentiality of client PII and financial records, violating the analysts' contractual obligation to protect client information.
Q: What is the difference between the "destroy" bin being present and the "destroy" bin being effective as a security control?
A: The presence of a "destroy" bin shows the organisation recognises the need for secure disposal, but the bin is only effective if it is locked, tamper-evident, and its contents are verifiably destroyed through a controlled process (such as cross-cut shredding by an authorised vendor). An unlocked, unmonitored bin is a vulnerability, not a control.
This connects to access control models (CYB 200 earlier units) because the scenario illustrates what happens when physical access control is absent or poorly implemented. The principle of least privilege applies to physical spaces just as it does to digital systems: the cleaning crew needs access to clean, not to view screens or retrieve documents.
This also connects to risk assessment and security planning. Writing a security plan for this company (as your director would) requires identifying assets (client PII, financial data), threats (the cleaning crew's behaviour), vulnerabilities (unlocked bins, visible screens, untrained staff), and controls (the countermeasures you would recommend).
More broadly, this scenario connects to compliance and regulatory frameworks. Financial companies handling client data are subject to regulations such as the Gramm-Leach-Bliley Act (GLBA), which requires safeguarding customer financial information, including physical safeguards.
Physical security, shoulder surfing, visual eavesdropping, dumpster diving, trash diving, bin raiding, clean desk policy, clear screen policy, insider threat, insider risk, social engineering, physical access control, badge access, escort policy, visitor management, data disposal, media sanitisation, document shredding, secure destruction, PII, personally identifiable information, confidentiality, CIA triad, security awareness training, privacy screen filter, privacy filter, monitor filter, GLBA, Gramm-Leach-Bliley Act, financial data protection, contractor security, third-party risk, CYB 200, Project Three, Scenario Two, SNHU cybersecurity