I work in a company that, to my understanding, handles very sensitive information on its network. The open space in which I am currently located accommodates roughly 20 people at most.
Since I arrived at my desk, I see some colleagues' computers unlocked for up to 30 minutes on a daily basis. This behaviour seems highly unprofessional and is, I think, a significant security vulnerability. So far, I have gone up to these unlocked computers multiple times to lock them via the ⊞ Win+L combination.
In an effort to bring awareness to one of the "worst offenders", I decided to leave a sticky note one evening on the keyboard of his (then unlocked for 20 minutes) laptop warning him that his computer wasn't locked and that he could remediate this by using ⊞ Win+L. I must note that I wrote the message as factually as possible to avoid any interpretation.
For a bit of context:
- I am a fairly new employee (of a few months). I do not have the authority to enforce any kind of donut/breakfast policy nor do I think it would be welcome or useful.
- All our computers are equipped with a card reader which encrypts the computer drives. Removing the card from the reader automatically locks the computer.
- When I wrote the note (or more generally when I interact with my colleagues' computers), there is either no one around to stop me, or no one actually questions me.
- Again, security in our company is, according to our security officer, a major topic and should be enforced as well as possible.
- The sticky note is now on a pen holder, but the computers are still regularly left unlocked and unmonitored.
- Was I unprofessional when leaving the note the way I did?
- Alternatively, is it okay for me to lock computers that aren't mine?
- Should I bring the issue up so that it is addressed by people with the right authority/knowledge? If possible, I'd like to avoid people getting in trouble.
I got in touch with one of my colleagues in charge of security/data protection. She told me that I should lock unattended computers when possible. In addition, she mentioned that I can discuss the matter with coworkers who aren't very careful about their laptop's security. Apparently, my bringing the issue up will lead to a reminder e-mail being sent to everyone.
To answer my own questions:
The note, while not exactly unprofessional, isn't the ideal way to convey the message. I do believe bringing the issue to the attention of my coworker was the right thing to do, but it might've been better to talk to him directly.
In my case, locking the computers is the right thing to do.
However, given the points made in the answers and comments, I strongly recommend not touching anything and contacting your manager and/or the person in charge of cybersecurity instead. They'll know how to handle the situation correctly.