Ann an employee is visiting Joe, an employee in the Human Resources Department. While talking
to Joe, Ann notices a spreadsheet open on Joe’s computer that lists the salaries of all employees
in her department. Which of the following forms of social engineering would BEST describe this
situation?

A.
Impersonation

B.
Dumpster diving

C.
Tailgating

D.
Shoulder surfing

Explanation:
Ann was able to see the Spreadsheet on Joe’s computer. This direct observation is known as
shoulder surfing.
Shoulder surfing is using direct observation techniques, such as looking over someone’s shoulder,
to get information. Shoulder surfing is an effective way to get information in crowded places
because it’s relatively easy to stand next to someone and watch as they fill out a form, enter a PIN
number at an ATM machine, or use a calling card at a public pay phone. Shoulder surfing can also
be done long distance with the aid of binoculars or other vision-enhancing devices. To prevent
shoulder surfing, experts recommend that you shield paperwork or your keypad from view by
using your body or cupping your hand.