Leaving a note regarding unlocked computer

Question

Yes, these questions/answers are related but do not answer my question.

---

I work in a company that, to my understanding, handles very sensitive information on its network. The open space in which I am currently located accommodates roughly 20 people at most.

Since I arrived at my desk, I see some colleagues' computers unlocked for up to 30 minutes on a daily basis. This behaviour seems highly unprofessional and is, I think, a significant security vulnerability.  So far, I have gone up to these unlocked computers multiple times to lock them via the ⊞ Win+L combination.

In an effort to bring awareness to one of the "worst offenders", I decided to leave a sticky note one evening on the keyboard of his (then unlocked for 20 minutes) laptop warning him that his computer wasn't locked and that he could remediate this by using ⊞ Win+L.  I must note that I wrote the message as factually as possible to avoid any interpretation.

---

For a bit of context:

• I am a fairly new employee (of a few months). I do not have the authority to enforce any kind of donut/breakfast policy nor do I think it would be welcome or useful.
• All our computers are equipped with a card reader which encrypts the computer drives. Removing the card from the reader automatically locks the computer.
• When I wrote the note (or more generally when I interact with my colleagues' computers), there is either no one around to stop me, or no one actually questions me.
• Again, security in our company is, according to our security officer, a major topic and should be enforced as well as possible.
• The sticky note is now on a pen holder, but the computers are still regularly left unlocked and unmonitored.

---

Questions:

• Was I unprofessional when leaving the note the way I did?
• Alternatively, is it okay for me to lock computers that aren't mine?
• Should I bring the issue up so that it is addressed by people with the right authority/knowledge? If possible, I'd like to avoid people getting in trouble.

---

Update:
I got in touch with one of my colleagues in charge of security/data protection. She told me that I should lock unattended computers when possible. In addition, she mentioned that I can discuss the matter with coworkers who aren't very careful about their laptop's security. Apparently, my bringing the issue up will lead to a reminder e-mail being sent to everyone.

---

To answer my own questions:
The note, while not exactly unprofessional, isn't the ideal way to convey the message. I do believe bringing the issue to the attention of my coworker was the right thing to do, but it might've been better to talk to him directly.
In my case, locking the computers is the right thing to do.
However, given the points made in the answers and comments, I strongly recommend not touching anything and contacting your manager and/or the person in charge of cybersecurity instead. They'll know how to handle the situation correctly.

Answer 1

I have worked in cybersecurity for 9 years and am currently in a management position.

What you are doing is only a band aid solution, temporarily addressing the symptoms rather than root cause: bypassing the proximity cards, used as a technical access control.

Was your conduct here unprofessional?

No, as long as your intent was right and that locking of unsecured endpoints was the only action you took.

Should you escalate the issue to security officer and management?

In my opinion working in cybersecurity, yes.

Good cybersecurity requires a community effort and holding each other accountable is a part of that effort. Moreover, a problematic security culture often does not get remediated until sufficient data exists to verify its truly a problem. Proactive employee reporting and suggestions play a big role to ensuring problem culture is noticed.

Now, the most important question you did not ask in my opinion: How can problematic behavior be curbed in future?

Assuming behavior of leaving endpoints unlocked is not deliberately malicious, employee security awareness training is key. Employees need to know why unlocked endpoints are a security risk in order to practice the desired behavior. Suggesting to security management renewed efforts in awareness training would be my recommendation.

• Data loss and exfiltration
• Loss of nonrepudiation in security audit logs
• Unauthorized access to sensitive data and potential subsequent misuse of such data

Answer 2

Was I unprofessional when leaving the note the way I did? Alternatively, is it okay for me to lock computers that aren't mine?

Tampering with other employees' computers/work area without their knowledge or consent for an apparent policy violation that you are not personally responsible for is unprofessional even if you believe that it is for a good reason.

Should I bring the issue up so that it is adressed by people with the right authority/knowledge? If possible, I'd like to avoid people getting in trouble.

Yes, you should bring it up to the security officer if security is indeed that important in your company. You will very quickly discover how important security actually is based on their follow up to your report and what actions they take. If other employees get in trouble, that is solely on them for not following what is supposedly a very important company policy.

Answer 3

I work in a company with sensitive military data.

Every company has its own culture about such issues, so what is considered professional or not can be wildly different. So that one is kind of tricky to answer.

For example: If somebody here leaves the room without locking the PC, it's kind of a tradition to use his unlocked account to open Notepad alerting him that he forgot to lock his PC with a date behind it. After that locking their PC, so nobody else can get to it. (The date is a date on which he has to treat the entire office on pie/cake as punishment for forgetting).

When it comes to "is it okay for me to lock computers that aren't mine?" if security is a high issue in the company then yes, but only after you did a small callout asking whose PC this is if you don't know it yourself...no response? Then the PC is unattended and should be locked.

The people in charge of such security have a lot on their plate, so bringing every small issue to their attention is a major strain on their time. So I would avoid it and talk to the person who made the mistake instead. (Of course do alert security when there is malicious intent like phishing, theft and so on.)

Answer 4

I understand your desire to do the right thing for your company. But when you state that

I am a fairly new employee (of a few months)

Should I bring the issue up so that it is addressed by people with the right authority/knowledge?

Then the first person you should be looking to for guidance is your immediate manager. They should be the one who knows how security issues should be addressed—either by agreeing with what you have done, or by supporting your desire to escalate this to security.

If your manager doesn't want to deal with this issue (for example, by saying things like "don't touch other peoples computers", or "it's really not a problem") then you could escalate it yourself to either a manager in IT/security or your manager's manager. Note however, if your manager doesn't want to deal with the issue, then going around them could be a "career-limiting move", resulting in you having to freshen up your resume.

I'd like to avoid people getting in trouble.

People have already broken the rules. They are the ones who will be responsible for getting themselves into trouble. You are just a witness to their "crimes".

Answer 5

You're acting on your feelings instead of company policy.

What you've said is indeed concerning, but you've failed to bring up the only important question: what does the company policy say about this?

Nothing else matters.

Was I unprofessional when leaving the note the way I did?

Yes, highly - because you did something instead of finding out if it could be done.

Alternatively, is it okay for me to lock computers that aren't mine?

It depends if the policy allows it. If it doesn't, in the worst case scenario, someone could try to push it as a criminal act. E.g. here where I live, there's "accessing a computer system by unauthorized person" law. Yeah, you've only locked it, but had that constituted "access"? Lawyers would love to argue.

Should I bring the issue up so that it is adressed by people with the right authority/knowledge? If possible, I'd like to avoid people getting in trouble.

What you should do is to find out if this is an issue at all.

Ask the people with the right authority what's the policy on leaving workstations unlocked. If the policy is getting broken on a daily basis, then bring up the issue of people leaving computers unlocked. If there's no policy, then bring up the issue of having no policy. If there is a very lenient policy, then bring up the issue of having a potential vulnerability.

At this point, you don't even know WHAT is the issue, and yet you're already fixing it.

I would focus more on leaving smartcards in the reader. Because locking is of no purpose if a mean to unlock is left in place. I know that smartcards usually come with passwords, but passwords with smartcards are usually weaker, because people trust smartcard providing the security. So smartcards unattended + weak passwords = locking pointless.

Answer 6

I would not go around locking other peoples' PCs. If the security aspect concerns you, you should say it to the security officer, and it is up to them to institute policies and enforce them.

On the other hand, by taking it upon yourself

• You are leaving yourself open to accusations if something happens to a colleague's PC and you were seen "messing with it".

• It's probably unlikely but there may have been a reason a specific PC was left unlocked.

• It could be considered bad manners. Although technically all the computers are owned by the Company and not the employees, people can still get upset or resentful of others messing with their stuff without permission, even if it's "for their own good" as it were.

Answer 7

The answer is really easy: You ask your manager what to do. And you do what he tells you to do. If you believe that your managers answer is a security risk, you ask the next person whose business is security.

Whatever you do because you just decided to do it and without any policy in place could get you into trouble. You don’t know what the consequences of your actions are, how they could be (mis)interpreted, and what the damages are.

Let’s say A forgets to lock his computer. Next day A notices that information has been stolen or destroyed. Security is called and I tell them that you sat down at A’s computer and started typing.

Answer 8

To add to the answers:

In one company I worked at, if you left your PC unlocked, someone would jump on it, send an email to all-staff with something mildly inflammatory and amusing. You typically only saw someone forgot to do it once or twice before the lesson was learned.

To answer your questions(s):

Was I unprofessional when leaving the note the way I did?

Some could view it as passive-aggressive and also there is a risk of 'This new upstart, what does he know?' - and whether it's unprofessional depends on your company culture to a large degree. However, as someone who works in IT - if your data is that sensitive, culture and passive-aggressiveness be damned.

Alternatively, is it okay for me to lock computers that aren't mine?

I would advise against this in a general sense. Firstly, it's creating a risk for you—if someone sees you at another's PC 'doing something' and then there's an issue—guess who is going to be the culprit?

In addition, it fosters an attitude of 'I don't need to worry about locking my PC—z3r0 will do it for me!' - which is very very bad.

Should I bring the issue up so that it is addressed by people with the right authority/knowledge? If possible, I'd like to avoid people getting in trouble.

Yes. You absolutely should bring up that issue—don't mention names—but do mention frequency and time exposed. Locking a PC when you are going to, say, a water cooler for 20 seconds and you still have visual confirmation of your PC is one thing, going off for lunch for 20 minutes is completely different.

However, if management is still not taking the issue seriously, you may need to talk with your IT team about it. One possibility would be to do a 'proof of concept' for management (with approval of IT of course) where by you get secure information from an unlocked PC to an insecure source, e.g., printing it out to show how critical this vulnerability is.

This is a high-risk endeavour though, and you'll need multiple layers of CYA emails.

Answer 9

My guess is that you are pretty new not only at this job, but in office work as well. Here are a few things to keep in mind, and a recommendation on what to do.

All companies have very sensitive information on their network. What information it is differs; it could be anything from their business idea and prices to defence information. For the individual company both of these are very sensitive information.

Your company doesn't worry about security. If they were, people wouldn't leave their computers without locking them. Sure they say they worry about security, but if the culture isn't one of security they really don't care that much.

Security officers always worries about security. That's their job. And when someone asks them about security they love to talk about it, and to suggest their interpretation of security. But the security officer isn't the company; it's only one person employed by the company.

I'm not saying any of the above is good or bad. I just want to make you aware of the things above.

Now for how you should handle it. I understand that you are aware of security, and that's a good thing. And you want to do what's right, another good thing. But you should think about your priorities. Your first priority should be to keep the job and get a good reference. Second is to get along with your coworkers. Third is to do your job. Or maybe second and third is the other way around. But you have no priority at all to manage other people or meddling in what they do.

In your situation I would send an email to your closest manager mentioning you have seen people not lock their computers, and asking what the rules are. Don't mention names. Then follow the rules yourself and don't worry about what other people do.

Answer 10

Your company surely has someone in the role of CISO (chief information security officer).

This person needs to be informed factually, e.g. "Hey $CISO, I often notice laptops which are unlocked for 30 minutes in the office."

You do not need to, and actually should not do anything else.

The CISO will take appropriate steps with the necessary authority. They could make your IT personnel configure mandatory screen locking (i.e., screens could lock after 1 minute of non-usage, or whatever time they decide). They could dispatch some security person to randomly go through the office and jot down the offending laptops for personal interventional measures. And so on and forth. Or they could decide that the status quo is not relevant either.

Answer 11

In a workplace that takes these things reasonably seriously, and if you've had a period of training where this kind of security was emphasised, then I don't think you've "overstepped".

What I mean by taking seriously is that if a local manager (not necessarily just the "security officer") saw an unlocked computer abandoned by its user, there would be something said.

However I would avoid chastising anyone with significantly more service than you, at a time when you only have a few months' service.

If there is a large (or unknown) disparity in experience, then it would be better to either let a manager judge the situation and the workplace norms, or (if there is no question of their likely opinion) then at least let them mediate the message.

Sometimes in some workplaces, staff may have seen a large number of different practices over the years, and may already be habituated to something less stringent, and the business has to balance the benefit to security against the cost of hassling experienced workers.

From the perspective of the business, long-serving staff may also be well-known quantities, and therefore if their terminal is misused, there may be far less ambiguity about their innocence than if a changing cast of trainees sitting close to each other habitually have access to each others' terminals.

It may seem strange, but I suspect the main risk of mischief is from those who misuse their own terminals but claim someone else did it, rather than the risk being from those who actually misuse the terminals of others.

Answer 12

I got in touch with one of my colleagues in charge of security/data protection. She told me that I should lock unattended computers when possible. In addition, she mentioned that I can discuss the matter with coworkers who aren't very careful about their laptop's security.

LOL, what?! Report her for not doing her job and offloading it on someone else.

STOP your actions immediately, stop pestering people, and focus on your actual job duties. The security/data officer doesn't care enough about the situation to be proactive. If they cared then they would implement an auto-lock after 5-10 minutes of inactivity.

Here's the jist of it. Don't touch other people's stuff, no one likes that and you won't be liked; career suicide is in your future.

It doesn't matter how noble your intentions are. Just wait till the day someone's stuff gets messed up due to something unrelated to Win+L and someone exclaims "Yeah, that weird new guy keeps going around touching people's computers." It doesn't matter if you did something wrong or not, this is the reputation which you have actively decided to build.

On a more serious note, one small slip and you miss the L and actually do trigger something destructive, now what?

Answer 13

You personally might not be able to institute this policy but as a suggestion to your manager you could propose the following.

• If someone leaves their computer unlocked
• And someone else manages to send an email from that computer to the manager informing them of this
• The offender has to buy the team doughnuts.

It's a lighthearted way of reminding people of what is actually a very serious issue and people are more likely to actually engage with this system of reporting if the result is that they get doughnuts.

A more heavy-handed policy of taking people down the disciplinary route if they forget to lock their computer is going to disincentivize people from engaging with reporting because they don't want to get their colleagues in significant trouble for what amounts to a very easy to make mistake.

The sending of the email also makes them realise "oh shit, they could've sent something far worse and it would've looked as though it came from me... Best not do that again".

---

As for your actual question, nah, that's perfectly reasonable.