Stealing information by observing someone's screen, keyboard, or paperwork over their shoulder.
Shoulder surfing is the practice of stealing sensitive information by watching someone's screen, keyboard inputs, or paperwork. It can occur in offices, public spaces, on transport, or anywhere screens are visible. Attackers might observe passwords being typed, capture PIN entries, read confidential documents, or gather information displayed on screens. While low-tech, shoulder surfing provides valuable intelligence for further attacks.
Why It Matters
The DSC Perspective:
Shoulder surfing is easy and requires no technical skills. Privacy screens for laptops, awareness when working in public, and clean desk policies help reduce risk. Consider the visibility of sensitive information in open-plan offices.