Cyber attacks don't always start with an email. Dropped USB drives, shoulder surfing in public spaces, tailgating into office buildings, and physical theft of unlocked devices are all documented attack techniques. Physical security and cyber security are the same discipline.
In 2023, the US Cybersecurity and Infrastructure Security Agency (CISA) documented multiple cases of attackers seeding business car parks and reception areas with USB drives containing malware. The drives were labelled in ways designed to provoke curiosity — "salary information Q3 2023," "redundancy list," "confidential — HR." Employees who plugged them in (more than they should have) executed the malware payload automatically. This is called a USB drop attack, and it works reliably enough that it remains in active use.
USB Drop Attacks
Modern Rubber Ducky and similar USB attack devices can be loaded with payloads that execute automatically on connection — appearing as an HID (Human Interface Device) keyboard and typing malicious commands at machine speed before the user has time to see what's happening. Even less sophisticated planted USB drives can contain autorun malware or executable files designed to be run by a curious employee who opens the drive to see what's on it.
Defence: Disable autorun for USB devices via Group Policy (Windows) or Intune (managed environments). Educate staff to never plug in an unknown USB device — plug anything found in the office into the IT team's test machine first, not their own computer. Enable USB port restrictions in Intune to block execution of code from USB devices on managed endpoints.
Shoulder Surfing and Public Spaces
Staff working with confidential data in public spaces — cafes, airports, co-working spaces — risk exposure through shoulder surfing (physical observation of a screen). Passwords typed in view of others, confidential documents visible on screen, and customer information displayed in a public space are all real risk scenarios. Privacy screen filters (physical screen overlays that restrict viewing angles) are a simple physical control for employees who regularly work in public. The more important control is awareness — understanding what should and shouldn't be worked on in a public space.
Device Theft
A laptop left on a café table while the owner gets a coffee, a phone forgotten in a rideshare — stolen devices with unencrypted storage and no screen lock provide complete access to business data. Device encryption (enforced by Intune on managed Windows and Mac endpoints) means that a stolen laptop's drive cannot be read without the Windows login password — the attacker needs the password, not just physical access to the drive. Remote wipe capability (available for both managed laptops via Intune and managed phones via Intune MAM) allows the business to wipe data from a stolen device as soon as the theft is reported.
Physical access to a device is the most powerful attack vector there is — it bypasses most digital security controls entirely. Encryption, screen lock, and device management don't prevent theft, but they prevent theft from becoming a data breach.
