My manager constantly leaves his computer unlocked. The problem is that he's the IT director, and I'm the IT Systems Administrator, and I leave my computer locked whenever I'm not near it. How can I tell him to please lock his computer? It's not only him, other users also leave their computer unlocked.
-
1The scary thing is that we’re a security company 😀. I know I can have the computers locked automatically by pushing out a group policy. We’re a new IT department. We don’t have a company IT policy yet.– Matt DamozMay 8, 2019 at 13:16
-
17My old job we used to put my little pony desktop wallpaper for unlocked computers 😀– Matt DamozMay 8, 2019 at 13:18
-
2Does he keep anything on the computer worth securing? (I never did).– Harper - Reinstate MonicaMay 8, 2019 at 14:59
-
2Is this really a problem? Is the computer physically accessible to untrusted employees or members of the public?– Aaron FMay 8, 2019 at 15:20
-
2@SouravGhosh The best way to secure data is to not retain it. And having to log into your computer everytime you turn around has a cost. Like they say around here, "Security at the expense of usability is at the expense of security".– Harper - Reinstate MonicaMay 8, 2019 at 15:26
|
Show 5 more comments
12 Answers
Do you have a policy in the company to lock the computers? There should be periodically mails explaining why people need to lock them. Also, another way of making people to start understanding the problem is that whenever you leave the computer unlocked, someone else changes the wallpaper/screensaver. It won't harm and will make people start thinking about all the possible things that could happen if someone with bad intentions had access so easily.
-
15
It won't harm- I'd not be so sure.. there are certain cases where "unauthorized" use of computer system is taken as "offense". YMMV. May 8, 2019 at 14:09 -
14Our culture here is such that doing something to another's computer without express consent is unauthorized access. Instead, we leave post it notes on the monitors that say "You've been hacked." That's been sufficient motivation.– BenjaminMay 8, 2019 at 15:04
-
12The suggestion of changing the wallpaper is very dangerous and should be removed, particularly from an accepted answer.– JoeMay 8, 2019 at 15:15
-
5@Benjamin when among friends or colleagues we get along with, we usually send out mails to about 10 people saying that they're buying some desserts to everyone. People are much more careful now and we get to eat some desserts every once in a while :D May 8, 2019 at 15:18
-
2This could put someone under serious problem, depending on the type of organization and culture of the workplace. Someone could lose their job or even be sued. May 8, 2019 at 16:24
I disagree with the answers suggesting changing people's backgrounds / messing with emails / stealing mice. That sort of "pranking" is a snarky passive-aggressive part of "office culture" I can do without.
Thankfully it doesn't exist at my current workplace. Everyone locks their screens because we have a security-focused work culture and published security policies, enforced by technical means where practical.
If you don't even have an official security policy yet, work on that! You can worry about enforcing it once it's actually defined.
-
"enforced by technical means where practical." Are there any practical technical means at your company's disposal to remind/encourage people to lock their computers?– bvoyelrMay 8, 2019 at 17:46
-
1By "enforced" I mean things like pushing group policy that locks screens after X minutes of inactivity. The reminding/encouraging part is more of a social problem. I'm not part of the IT dept, but we have occasional web-training sessions covering general infosec stuff - lock your laptop, don't pick up random USB keys, etc. To be fair, we're a tech company and the nature of our work involves thinking about data security, so we do have an advantage here. May 8, 2019 at 18:17
Make the lock automatic
Windows has a setting to lock the workstation after x minutes of inactivitiy ...
That way, you might not need to educate anyone.
Make locking easier
By educating users about the keyboard shortcut to lock their workstation (on windows, that would be WINDOWS + L, where WINDOWS is the key with the windows icon).
Make them aware of why locking is important
By explaining the actual harm that could arise from not locking the workstation.
-
I would rephrase last part: show them how little time it takes to copy/email sensitive information. I read it somewhere in twitter May 8, 2019 at 15:07
-
8
That way, you don't need to educate anyone.I disagree. The auto lock after 15 mins of inactivity is a fallback. If you get up and leave the area, you should lock it immediately and not just let the auto lock kick in. Someone could easily get to your machine within that time and do Bad Things (tm). It's Windows+L... it's not hard.– JeffCMay 8, 2019 at 15:25
In my company we have this "game", where we open their Slack, Microsoft Teams, mail or whatever group message app we use and invite on their behalf for breakfast next day.
It might seem stupid but since management supports this action, it has increased awareness towards the importance of keeping your computer locked. Plus you get food for free
Also you have the legendary extension of (Nicolas Cage), beautiful
edit: as Sourav Ghosh said on comments, this action is highly dependant on the expected reaction of the person
-
2Yes! Best is when they use their own email on Chrome....we pushed all the Nic Cage extensions we could fine to all logged in devices for someone I work with....he knew he messed up and he was still at home :) May 8, 2019 at 13:03
-
12While it can be funny, it also involves somewhat "unethical" action. I'd not say this is "bad" idea, but unless exercised in a "controlled" environment, it can backfire. May 8, 2019 at 13:04
-
2In a culture that supports this sort of approach, it can be very effective. I used to work for an employer where if a manager saw someone's PC unlocked, they'd take their mouse and put it in a "timeout box" in the middle of the cube farm. The embarrassment of having your mouse go missing was enough to enforce the policy.– dwizumMay 8, 2019 at 13:29
-
4It should be emphasized, that this approach should only done with buy-in from management as as the example in the answer May 8, 2019 at 13:37
-
4I approve of the work email being used to invite the office to breakfast. Using a private email is going to far.– DonaldMay 8, 2019 at 14:29
As we can see that the problem is for more than one person, it'll not be useful to chase every individual and try to enlighten them individually.
Rather, as a first attempt, use a mailer list (e-mail distribution alias) to send e-mails about the problems and security issues that can arise due to leaving the workstation / laptop unlocked while being away from desk.
This is something that should be enforced / practiced [1] on a organization-wide level. Two suggested steps:
If you know this causes legal problem / breach of company policy / CoC etc. - take this up to your superior / manager (don't point out anyone, just mentioned you have noticed this "behavior" or "trend") and ask them to issue an official notice (rather than an informational email) to enforce the rule of locking the workstation.
If you feel this is something of a "best practice" level, send the informational mailer / ask to have InfoSec sessions / training for employees.
Note: This answer does not take into account the fact whether the auto-lock (lock the PC after inactivity of X amount of time) is enforced or not, as the question is about to educate the employees to not to wait for and rely on the auto-lock, rather manually lock the system before stepping away.
[1] : based on applicability.
EDIT:
After the edit:
We don’t have a company IT policy yet.
High time to get one setup and roll out. It gives you and the IT / InfoSec team a background and other employees a reference to follow.
answered May 8, 2019 at 12:59
-
Thanks for the fun ideas. I need to enforce a company wide rule to lock computers when the user is away May 8, 2019 at 14:06
-
@MattDamoz Ironically enough, this answer does not propose any "fun" ideas. May 8, 2019 at 14:07
You can't "enforce" anything on your manager - you don't have the authority.
What you can do is to go through the proper channels and propose good security policies.
You could always draft a proposed policy yourself (using whatever format your company uses for policies) and submit it for discussion/ decisions through whatever process your company uses.
The other tactic is the "question" or "I wonder" tactic - "ask" in various ways if there is a company policy on this. "I wonder if our company has a policy on employees locking their workstations when walking away? If not, I wonder if that would be a good idea?"
Is approaching him required? Could you leave a friendly anonymous note on his keyboard?
I worked in a place where if anyone from the IT department saw an unlocked computer and the user was nowhere in sight they left a post-it note saying:
Hi there!
You left your computer unlocked so I locked it for you!
You're welcome! Please lock your computer when you leave your desk in the future.
Thank you,
IT
It usually had the desired effect.
-
1I think this is a good approach in general, but it only works with the manager if they are on board with the general idea of locking. It sounds like they may not be.– JoeMay 8, 2019 at 15:28
There are two distinct problems here, I think:
- How to convince your manager to follow the practice
- How to convince the rest of the company
The way I would address it with your manager is to focus on the issue for the rest of the company, and not make it about your manager for now.
Go to your manager, and point out that there is a culture in your company of leaving workstations unattended, which leads to potential liability for the company.
Suggest that it becomes a priority for your company to push out a clear policy on workstation locking, and send out memos to the employees with some of the suggestions from the answers here - mostly, telling them why it's important and what the risks to the company are, and telling them how to do it.
Then, you and your manager should remind people you see with unlocked workstations to lock them. Locking your workstation is a habit - it's one that's easy to get into (windows key + L for a windows machine), and it just takes doing it a dozen times or so. Help people get in that habit, and maybe have a few others help you remind people.
The advantage here, for problem #1, is that it hopefully solves itself - once your manager is on board and reminding other people to lock their workstation, it's easy for them to also get in that habit. And if they fail to get into that habit naturally, well, once you're reminding others it's easy to say 'Hey boss, looks like I got you!'
Is this an actual problem?
If there is sensitive data on the computers that other co-workers must not access, it should be a company policy that every hire pledges to observe. With appropriate penalties. Push toward introducing such policy if you think it's necessary. This way you appear neutral, not aimed particularly against anyone.
If the company provides enough physical security that locking computers is not required, and there is nothing secret to other employees, laid back policy is a tangible boon. Taking it away from employees is outside of your competences.
Locking just for the sake of locking is pointless. Sure, it does train a good habit. But the habit is still of no real use. Employees will benefit from it only if they switch jobs. You don't want to train people for their next job.
BTW: You sound "I'm doing X, so others must do same". Be careful to never phrase anything this way. Make your argument about X, never about you (nor other people).
The answer to this highly depends on many factors....
The country this is happening in can be important. In the UK it is a breach of GDPR to leave the computer unlocked if the person is able to access someone else's data from it.
If it is a legal problem and you are responsible for monitoring this, then send out an email reminding people of the need of locking their screen.
If you are in a relaxed environment, then the best lesson is to simply "Cage" their computer, have them come back to a locked computer with Nic cage in the background. Something funny like that will probably teach them to be more careful.
-
Not just the country, but the company. In the US (no GDPR) when I worked in an office where hundreds of non-IT co-workers could wander in freely, and possibly some overflow from the public, we locked systematically. In this very small stable company without any unannounced outside visitors, we lock at night. Concentrating on the real possibilities gives better security results– user90842May 8, 2019 at 17:05
If you are a security company, it should be easy to make the case for hiring a penetration testing organisation to give your systems the once over. Make sure they include social engineering techniques. The results will probably scare your management so much that you won't have to worry about unlocked computers in the future
In one of my former workplaces we played this game, which I recommend as a deterrent to leaving a laptop unlocked:
If someone's laptop is spotted unlocked, someone sends an email from it to the whole team saying they will bring snacks, cookies, or something like that to the whole team.
People start locking their laptop and if they don't, they pay the price.
answered May 8, 2019 at 16:36
