In a retail back office, a person in the next chair watches a cashier type a password into the register and then uses that password. Which attack is the watching?
Select an answer to reveal the explanation.
Short Explanation
You can recognize shoulder surfing when someone watches you type a password and then uses it. Tailgating follows someone through a door without a badge, phishing uses a fake message, and vishing uses a phone call.
Full Explanation
Shoulder surfing is watching someone enter a secret and then reusing it. Here, the person in the next chair sees the cashier type the password, so the attack is shoulder surfing; no message or phone call is needed. Tailgating means following someone through a door without a badge, so it does not describe reading a password at the register. Phishing lures the cashier with a fake message rather than observing the keys. Vishing also aims to obtain information, but it uses a phone call, and no call occurred. Exam caveat: a privacy screen can reduce shoulder surfing, but it does not prevent a camera overhead or a password written on a note from exposing the secret. For a practical check, sit in the next chair during a sign-in and confirm the password is not readable; if it has been exposed, rotate it the same day. Then review the register log for a sign-in that followed the watching. A privacy screen is a useful follow-up control, but it does not change the name of the attack that already happened.