Shoulder Surfing

What Is Shoulder Surfing?

Shoulder surfing needs no malware and no stolen password. Someone stands where they can read your screen, raises a phone, and walks out with data that no log will ever show leaving. In this exercise a booked visitor ends up behind your chair while a payroll export is open. You practise noticing who is in range of your screen, locking it before you do anything else, asking a visitor to wait somewhere sensible, and writing down what was visible so a record exists at all.

What You'll Learn in Shoulder Surfing

• Treat anything rendered on your screen as readable by everyone with a line of sight to it
• Lock the workstation as the first response to a stranger at your shoulder, ahead of any conversation
• Read a visitor badge as clearance to be in the building rather than clearance to see your work
• Ask someone to wait in a sensible place without turning it into an accusation
• Report what was on screen, because a photograph leaves no log and your account is the only record

Shoulder Surfing — Training Steps

1. Check The Payroll Run

   It is a quiet Tuesday morning on floor two of Merrowvale Health. The September payroll finished exporting a few minutes ago and sits in the queue until the bank file goes out at four. Ines Havelock, who manages People Services, sends the usual request.

2. Twelve Lines On A Screen

   The run opens exactly as Ines described it. Every line of it is somebody who works in this building, next to the number they take home and the tail of their account. It is an ordinary internal page, opened by somebody entitled to open it, and it will stay on screen for as long as the checking takes.

3. Someone Waiting For HR

   A man comes up the stairs and stops just inside the front of the floor. Lanyard on, phone in one hand, the slightly stranded look of somebody who was told to wait here and has run out of things to look at. His meeting is with People Services. Nobody has come down for him yet.

4. He Is At Your Shoulder

   Waiting turns into wandering. He walks the length of the floor, stops in the walkway behind Alice's chair, and lifts the phone to eye level. He is close enough to read the screen. The phone is pointed at it.

5. Look At Him

   Before saying anything, look at who this actually is. He is not hiding, he is not in a hurry, and he is wearing the pass the front desk printed for him this morning.

6. He Explains Himself

   He notices that he has been noticed. The phone does not move, and what he says is the sort of thing anybody might say, delivered without a trace of hurry. It explains the phone. It does not explain the two metres.

7. What Do You Say?

   Nothing about him is threatening and the excuse costs nothing to make, which is exactly why it settles nothing. There is no way to tell from here whether the phone was up for the clock or for the screen, and the payroll run is still on that screen in front of both of them.

8. Lock It First

   He steps back and starts to move off, which settles nothing. He has been there for some seconds already and there is no way to know what is on his phone. The screen is the only part of this Alice can still do something about, and it takes less than a second.

9. He Waits In The Middle

   He does not argue and he does not leave. He stops in the middle of the floor, phone down at his side now, and stands there waiting for whoever is coming to collect him. Nothing about him has changed. What changed is what he can see.

10. What Actually Went Wrong

    Take a moment on what the risk here really was.