As the name implies, physical approaches are those where the
attacker performs some form of physical action in order to
gather information on a future victim. This can range from
personal information (such as social security number, date of
birth) to valid credentials for a computer system. An oftenused
method is dumpster diving (Granger, 2001), i.e., searching
through an organization's trash. A dumpster can be a valuable
source of information for attackers, who may find personal
data about employees, manuals, memos and even print-outs
of sensitive information, such as user credentials. If an
114 journal of information security and applications 22 (2015) 113 e122
attacker can gain access to a targeted organization's offices e
e.g., in open-plan workspaces e they may find information
such as passwords written on Post-it notes. Less sophisticated
physical attacks involve theft or extortion to obtain information