9

My boss wants to force a game that when you leave your computer unlocked and walk away others will send an e-mail from you (saying something stupid; like free doughnuts tomorrow).

The impetus for this is that it encourages people to lock their computers and thus increase security.

Additionally the timeout for my screen saver is set for 30 seconds. So when I get up it locks. The bad side affect of this is when I am reading a long article or doing a code review (thus reading and thinking the screen saver kicks in).

Its not a huge issue just a pain in the butt to keep logging in.

But is there an argument against this silly ridiculous childish behavior that does not involve me calling my boss a child?

Added Context

I am pretty proactive at locking my computer.
If there is a chance for non company person to access my computer I have it locked.

But the game is escalating to the point if you turn your back people well send an e-mail.

I turned around to pull a book from my book shelf to show some example algorithms and the person I was helping was trying to send an e-mail.

I walked over to talk to my boss who sits by the door (so no intruder can get past me) to ask a question about a ticket and somebody was at my machine.

Sure. If I walk off to the toilet or go to lunch then I am fine with some stupidity. But we are at the point where it is ridiculous and productivity is now affected.

Improve this question
11
  • 10
    Setting your screensaver timeout is a choice, you could set it to 15 minutes and get into the habit of hitting win-L when leaving your computer
    – jmoreno
    Dec 12, 2017 at 22:36
  • 9
    We have a similar "game" here. I simply do not play it. When I see a system unlocked, I lock it for the person. I'm not a big fan of such public shaming, but that doesn't mean I don't laugh at some of the emails that come through.
    – Joel Etherton
    Dec 12, 2017 at 22:41
  • 7
    Encourage others to get on your computer and in your email is not good security. It is a license to snoop.
    – paparazzo
    Dec 12, 2017 at 22:46
  • 1
    I have played this game too, but we never took it so... "seriously". That seems like near of being toxic here. Question : does this happen specially to you (the mail when your taking a book just near) or to everyone ?
    – Walfrat
    Dec 13, 2017 at 8:26
  • 3
    @Snow While I agree with you about the importance of computer security, acceptable ways to encourage it fall far short of "anything".
    – Nuclear Hoagie
    Dec 13, 2017 at 19:44

7 Answers 7

Reset to default
16

TBH, I think you're both wrong. If your computer use policy is to lock your computer when you're not there, your responsibility is to manually lock your computer. If you're away from your computer and it's logged in and unlocked, for whatever reason, the computer's not the one accountable, you are, so make sure you're the one who ensures that doesn't happen.

That being said, that's a relatively widespread and--on its own--harmless office game, but your boss is making an irresponsible decision. He could well be putting himself and all of you at risk. First, he's encouraging behavior that doesn't reinforce good security standards, and that's a bad practice, regardless of the reason. But second, he's actually encouraging his subordinates to use the computers under someone else's identity, which is likely internally punishable by your company's policy and possibly, depending on your organization and your data, illegal. I don't know what you want to do with that information, but that's my viewpoint, based on experience.

Improve this answer
1
  • 3
    You should always, always, always lock your PC when you leave your desk period.
    – Neo
    Dec 15, 2017 at 14:19
12

Some rules to keep your workplace secure:

Rule 1: Lock your computer when you leave it.

Rule 2: Don’t touch someone’s computer when it’s left unlocked.

Rule 3: If you see someone touching someone else’s unlocked computer, stop them.

Your boss asks everyone to violate rule 2 and 3, making your company much less secure.

Here's a suggestion to remind people in a friendly way, without encouraging annoying pranks which cost the company money even in the best case, and without practically making sure that someone who wants to cause real damage can do so much easier without being challenged: Have an "unlocked computer stopwatch". Just a stopwatch, attached to a big bit of cardboard that can be put on a desk very visibly. If you see an unlocked computer, you take the "unlocked computer stopwatch", put it on the persons desk and start it, so people can see for how long that computer was in danger. No harm done, and a friendly but visible reminder to lock your computer.

Improve this answer
11

I see two choices here. One of them could have adverse affects for you:

  1. Lock your computer whenever you get up. When other people forget, either ignore it or lock the computer for them rather than playing the game.

  2. Escalate to the IT Department. At some companies, particularly larger ones, the IT department would be very opposed to users doing anything on a computer using another user's login (especially impersonating another user via email). They may call for an end to the 'game'. However if you haven't been locking your computer whenever you get up, IT is likely to become unhappy with you as well. Tread carefully.

Either way, lock your computer whenever you get up.

Improve this answer
4
  • 2
    The OP indicated it is not just when getting up, but even just turning around while working with someone.
    – Bill Leeper
    Dec 13, 2017 at 21:25
  • Thanks @BillLeeper. These details appear to have been added after I posted this answer. In this case, I think I'll narrow my answer to suggest escalating to IT. I'll edit my answer later.
    – djohnson10
    Dec 13, 2017 at 21:51
  • @BillLeeper: I find it hard to believe someone could jump on my computer and send an email while I'm "turning around".
    – NotMe
    Dec 15, 2017 at 1:15
  • @NotMe as I said, was going on what OP said. They made it a game and people have gotten aggressive about it. It has moved beyond the intended effect and is now affecting productivity it seems. The manager in this case is going to have his hands full with the childish behavior that he fostered.
    – Bill Leeper
    Dec 18, 2017 at 7:13
7

Having to enter your password each time you return to your desk would be the least of your worries if your company gets shut down for a compliance breach.

I worked at a place where, especially during its start-up days, this was practically encouraged as not locking your computer put the whole company in breach of PCI-DSS (and ultimately FCA) compliance.

Everyone was doing it to everyone, from the very top managers right down to the juniors and new starters. However, it naturally spiraled out of control and the innocent "free donuts" email turned in to submitting false resignations, setting pornographic wallpapers, and colleagues declaring their undying love for the CEO.

If your company can keep to the "free donuts", there's no harm in letting it continue. The victim will learn a lesson and, ocassionally, you'll get some free donuts.

Improve this answer
1
  • 4
    I also knew a company that look like you describe. Co-workers team up to trap another co-worker, like someone fake a fall, the victim will check on the fallen co-worker while another co-worker will send a email doughnuts in his back.
    – Tom Sawyer
    Dec 15, 2017 at 14:13
1

I am going to be the devil's advocate and take an opposing perspective.

Security is important. No matter if it is a mom and pop shop, or a multi-billion dollar company like Equifax...

You put your best efforts to secure your assets physically and digitally.

Treating security as a game would not invite the right attitude towards the situation. If your boss is serious, he or she needs to rethink his/her approach to what is potentially a major issue within the organization.

Keycard access, pressure sensitive seat sensors, are two mechanisms that minimize impact and ensure that there is an authenticated user when manning a workstation among other technological and behavioral (as Dark mentioned) solutions.

Don't call you boss a child, but instead frame it as a serious manner that requires serious solutions.

Improve this answer
1

You might suggest a hardware solution. Way back in the days of Windows 3.1 (!), I bought a $5 gadget on eBay. It was two parts, one which plugged into the PC and one which you clipped onto your belt, etc. If the two got more than about 3 feet apart, the one connected to the PC would lock Windows.

There are plenty of these around, I won't link to ebay as the links won't last, nor to AliExpress, where you will get them cheapest, in case your boss doesn't approve of that, but here is an example on Amazon.

That one is pricey at $48, but you/your boss can do your own searching. Also, I don't like that it stores passwords - what if you mislay it?

Personally, I would look for a< $10 device which will lock your PC when you move away, and which odes not store passwords. If your boss won't buy them for the department, ask if he objects to you buying and using one for yourself. If in doubt as to which, ask at https://hardwarerecs.stackexchange.com/ or https://security.stackexchange.com/

Of course, if you don't clip it to your clothing, you still have the same problem, but it helps to reduce the risk, if you do actually wear it.

Improve this answer
0

But is there an argument against this silly ridiculous childish behavior that does not involve me calling my boss a child?

I don't think this is a childish or ridiculous behavior.

It is in fact a really mild example of what someone seeking to damage your work or the company would do if they found an unlocked PC. Just that they will wipe your data, or steal knowledge, or leave a key-logger or some virus.

So I don't think there could be a counterargument that justifies that this "game" should be stopped. It is a kind reminder of the perils of leaving your PC unlocked.

I suggest you make it a habit to manually lock you PC when you leave your desk, so you don't have to play with screen-saver or automatic lock times.

Edit: If you still don't like this "game" you could try asking your boss something like this:

Hey boss, I have noted that when we leave our PC's unlocked it happens that ... Is there another way we could encourage people to lock their PC's instead of recurring to these joke emails?

This way you are not being disrespectful while asking for alternatives. You can then come to an agreement, or well decide that the current way is the way to go, but that would be now up to your boss (even if you don't like it).

Improve this answer
4
  • 2
    Sure, I acknowledge that is true. But when I have line of sight of my computer I don't expect to see malicious actors installing key loggers (this happens when I nip out for coffee). Now I turn my back for two seconds to pull something from my book shelf and somebody leaned over and sends an e-mail.
    – Martin York
    Dec 12, 2017 at 22:50
  • 1
    Its not the act of the e-mail sending its the perverse heights this game has been pushed too.
    – Martin York
    Dec 12, 2017 at 22:51
  • 2
    @LokiAstari yes, but this "game" wouldn't be there if you all did this and locked your screens. Enhanced answer with alternatives
    – DarkCygnus ♦
    Dec 12, 2017 at 23:00
  • 1
    @LokiAstari Try Win-key-L.
    – jfa
    Dec 12, 2017 at 23:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .