79

I manage a medium sized team of developers that have a tendency to leave their machines unlocked as they go throughout their day. Being developers they will often have browser windows open and I'm worried that it's sending the wrong image to stakeholders when they are often seeing what they would see as something other then work on my staffs screens whenever they pop by. I also want to encourage them to lock their machines if they are going to be away from their desks as that also adds a layer of security I see as beneficial.

I've brought this up in meetings but it doesn't seem to have changed anything. Should I take a more formal approach?

  • 86
    So, you're worried about what's on their screens, but not the huge security risk of leaving a machine logged in and unattended? As a stakeholder, I would care a lot more about someone being able to untraceably compromise the work than a developer having a couple browser windows open. – ColleenV Nov 3 '15 at 3:21
  • 15
    Why not just make the machines auto-lock after a small timeout window? – Caleb Nov 3 '15 at 8:12
  • 30
    @Caleb Because a small timeout is annoying especially if you are reading something. Personally I just press Win-L (or whatever shortcut the operating system uses). The combination to lock the screen should be easy to press and easy to remember. To unlock it, you must enter your password. – Brandin Nov 3 '15 at 8:26
  • 33
    Do you know why people don't lock their machines? I for one used to lock my machine every time but broke that habbit when started working in an environment that made it far to easy to get my account locked and far to difficult to get it unlocked again. – Lieven Keersmaekers Nov 3 '15 at 11:21
  • Can't the machines be set to turn off the monitor or something if left alone for too long? – user8365 Nov 3 '15 at 13:40

20 Answers 20

127

The Donuts game!

Facing similar challenges we adopted a solution in my workplace for this called the "donuts" game. Keep in mind that this does have a tendency to be somewhat distracting. For this reason we don't run this year round, only in December when the pressure is off and there's a lighter mood in the office that we want to foster heading into the Christmas break.

Rules

The game is quite simple - if you leave your computer unlocked and another team member notices then they have free reign to open your e-mail client and e-mail the team e-mail the word 'donuts' from your account. Each time somebody does this to you successfully that's one point against your name. The person at the end of the week that has the most points against their name has to buy donuts for the team for our SCRUM standup on Monday morning.

This has the benefit of challenging people to be the best they can be at locking their machines, and creates an informal penalty system for those that continue to fail in locking their machine.

But does it work for you?

Keep in in mind that this isn't for all work environments - we have a team it works really well for and we talked about it as a group to make sure everybody was on board before starting. I strongly advise considering your team and the personalities involved before putting something like this in place.

Also be sure to consider whether there are any issues with team members using another's machine, even to send an e-mail. The medical industry in many locales will specifically prevent this (either through regulation or a need for high privacy), the finance industry would in many cases be the same. If these aren't a barrier though - have fun!

  • 55
    Oooh, oooh, do spoofed emails through SMTP count? Because I can totally win this game. Super easy to send emails as anyone. So I can pick anyone to lose. I guess the downside is maybe getting fired. But at least I'll have donuts! – enderland Nov 3 '15 at 13:40
  • 8
    @enderland Sounds like the perfect excuse to implement PGP. I'd consider the ability to spoof emails a security issue worth addressing. – Ajedi32 Nov 3 '15 at 14:46
  • 101
    No. This is a terrible, terrible idea. It encourages people to 1) go on other's machines, 2) go IN THEIR EMAIL client, and 3) gives them an easy out if they were to do something nefarious "Oh I was just giving him the donuts, haha he left his machine unlocked". Please never encourage anyone to go on someone else's machine. – corsiKa Nov 3 '15 at 15:16
  • 55
    @corsiKa if they are not bothering to lock their machine to prevent access then you can't treat machines as sacred to a user. If pranky stuff happens when machines are unlocked they soon start locking them. Not only is it a pita but a reminder of the realworld security risk. – JamesRyan Nov 3 '15 at 15:22
  • 16
    I want to add a suggestion : If everyone has 0 points (everyone did good!), then THE MANAGER brings donuts. :) – Zaenille Nov 5 '15 at 8:14
51

I deal with this a lot from the Network Engineering side. Programmers here are normally given a bit of leeway and respect because in theory they're professionals and will follow security protocols without needing their hands held. So best policy is to try and get them to comply informally.

Methods for internal resolution are for the team to police each other as outlined in other answers by a system of small harmless punishments. But in my opinion better if the manager just makes it mandatory.

But when they're recalcitrant it's fairly easy to fix formally.

The solution was for the manager to tell the programmers that they either sort out their security themselves or the engineers will come and lock peoples machines down and enforce group policies... this usually did the trick pretty quickly. Usually it doesn't even have to be followed through with.

A non confrontational way which I use a lot is to get the Network Engineering Manager (in this example, me) to attend a meeting and spend a couple of minutes politely telling the programmers some home truths. This takes any uncomfortable issues off the Manager and coming from a third party who can actually enforce things is a good strategy. I just go in introduce myself, apologise for taking their time and outline simple network security policies that MUST be enforced as part of my role. Treat them like the professionals that they are. Ask if anyone needs to know how to lock their machine, take any questions they might have, thank them for their time and leave the meeting so they can sort out how they want to do it (I don't want to know about baggy pants or donuts or pizza). Even just an email to their Manager will be enough usually, he can then forward it to his team and discuss it at their meeting. The crux is having it come from the authorised third party.

I have only rarely needed to actually do it, this goes for any group of professionals or elites within a company, I have used this method with pilots, doctors and lawyers as well as programmers.

  • Locking down group policies against engineers is how you find out that group policies can be subverted. – Joshua Nov 3 '15 at 17:53
  • 5
    If I locked down your machine you would not be subverting it without getting caught pretty quickly, only an incompetent engineering manager would not monitor programmers after such a move. They would be expecting exactly that, and actively looking for someone to make an example of. Engaging in a war with Network admin is not something you can win, they control all the ammo including your machine. It's not something you should be even attempting, because it could cost you your job. At the very least it will get you reprimanded. – Kilisi Nov 3 '15 at 18:03
  • 3
    Never underestimate the kernel debugger. – Joshua Nov 3 '15 at 18:09
  • 19
    @Joshua xkcd.com/538 is relevant to your ingenuity here. "Oh, he's cunningly got around our reasonable security setup using kernel hacking on company computers! However shall we beat this l33t haxx0r?" checks IT policy "Oh, right, we can just fire him." – deworde Nov 4 '15 at 9:25
37

Where I work, it's an unofficial policy that anyone leaving their computer unlocked for long enough will have someone go to it and send an email offering to bring pizza, or pastries in for everyone the following day.

The result of this is that someone has to admit to leaving their computer unlocked and being a cheapass, or follow through and bring some grub in. Granted, occasionally bringing food/candy into the breakroom for everyone is also normal here.

The advantage of this is that other employees will enforce it for you.

  • Same here; the "penalty" is immediate, and everyone is happy. – Matthieu M. Nov 3 '15 at 12:29
  • 7
    and is much simpler than counting points for donuts game. Also, new employees will get fair warning: if unlocked, somebody will send email "I am a bad boy, forgot to lock my keyboard" for first few offenses – Peter M. Nov 3 '15 at 21:42
  • @PeterMasiar Usually new people learn about it by seeing it happen, or being warned. You're also more likely to comply and bring the food in if you've been warned in advance. – paul sullivan Nov 4 '15 at 10:21
31

None of the answers suggesting pranking or such are appropriate in a nominally secure environment.

A secure environment has a formal POLICY for security, a formal PROCESS for complying with that policy, and a formal PROCEDURE for addressing non-compliance. In all previous answers, the advocated procedure for addressing the lapse is itself a violation of the security policy AND process.

In other words, when a lazy user's desktop screen picture is changed to a David Hasselhoff bikini photo, or the user's email is used to send a "hacked donuts" email...from the standpoint of certification, you've not only had a POTENTIAL security breach, you've now had an ACTUAL security breach.

I'm assuming here that the issue of security isn't just some arbitrary requirement...like, there's customer PII floating around, and/or PCI or SAX70 compliance or other compliance certification is at stake. It is enough justification (IMHO) that clients are in the area, where they may see sensitive business information about other clients.

The proper way to deal with this is for the IT security staff to do sweeps of the office during their normal day's wandering around, and if they come aross an unlocked, unattended computer, they change the user password and lock the screen/computer, leaving a note for the user that they have to contact IT to re-enable their account. The IT staffer of course has to be using some kind of rotating "reset password" scheme, so that the changed password can't just be guessed by the returning user.

  • 1
    +1 for pointing out the unprofessional aspects, although it's more a critique of other answers it makes an excellent point in terms of professionalism. I should have mentioned it in mine, although I did a bit in the comments. – Kilisi Nov 4 '15 at 0:38
  • 1
    You can also have IT just disable the account in the AD, or similar for non-Microsoft environments. All multi-user systems I've seen have a documented way of disabling a specific user account such that it can easily be re-enabled later (which normally requires administrative access). This way, "past passwords" rules set up do not get in the way of the user keeping their current account password. – a CVn Nov 4 '15 at 10:09
  • 5
    I was so disappointed that I had to scroll past a bunch of prank suggestion answers to finally get to this one that I logged in just to upvote it. This should be a caveat on all the other answers. – Adam Jensen Nov 5 '15 at 4:31
  • 3
    The first part of your answer looks like you're rephrasing the OP's problem. He already believes this is necessary. He's not drafting or introducing a new policy, he's trying to implement it and make his staff apply it. Turning it into a game is a pragmatic way to make people remember it without spending good will or HR resources. – DonkeyMaster Nov 5 '15 at 14:16
  • 3
    I also want to upvote this more - pranking is a good 'social feedback' way, but might actually be illegal - it is computer misuse (I assume you don't give carte blanche to re-use security credentials - if you do, you need to stop that too!). There are some potentially quite serious legal/contractual issues with insecure terminals. Data protection act or equivalent. Duty of care with company intellectual property. – Sobrique Nov 6 '15 at 9:19
24

I've sometimes reminded colleagues who fail to lock by using a shortcut to rotate or flip their screen and then locking (Windows+L). The flip shortcut is dependent on the device but ALT+Arrow or CTRL+ALT+Arrow should work on many typical business computers and laptops.

The advantage of this approach is that it's a simple double keyboard shortcut so you don't spend any length of time actually on their unlocked system, with all the security implications that has, while still reminding them that they forgot to lock again. Notorious offenders can be left in the dark about the way to restore a flipped screen to drive the message home.

Because you don't actually have to use a colleague's unlocked system this will likely be a more acceptable solution than actually changing system settings or sending an email from their account, but there are still offices where even this would be crossing a line or where even minor pranks don't fit the culture so use with caution. You'll also want to actually be around when your colleague comes back when you do this the first few times in case he can't figure out a way to reverse it or, as Dan points out, runs to IT claiming his computer was hacked.

  • 2
    There is also a shortcut for toggling the high visibility colour scheme. I don't recall what it is but it's also a very effective way of leaving a "note". – Mark Henderson Nov 3 '15 at 12:03
  • 3
    @MarkHendersonk It's Alt+LShift+PrintScreen. The downside of that one is that it seems to involve Theme changes as well (disabling Aero and reverting to Classic Windows) which can take a minute or so and Windows can sometimes bug out when switching themes. As I just discovered it can also screw up custom themes completely, requiring a restart. :) – Lilienthal Nov 3 '15 at 12:31
  • 1
    My biggest reservation with this sort of prank is that it is also the sort of screwing around that could cause a non-technical user to panic and think their computer has a virus. – Dan Neely Nov 3 '15 at 19:47
  • 1
    Good point @DanNeely, I've added a small word of caution to my post. Going this route is really all about knowing your audience. It will probably be fine among software developers or a bunch of junior consultants, but it almost certainly won't fly in a legal office or a government department. – Lilienthal Nov 3 '15 at 20:07
  • 3
    @OllieFord The idea was to reverse the flip for those colleagues quickly without letting them see the keyboard shortcut. Of course, smart colleagues will just look up how to do it once they're back in their system. The true genius of the plan is t̶h̶e̶ ̶f̶e̶a̶r̶ that once they've figured it out they'll try to do it to other people, resulting in a subtle form of social control. – Lilienthal Nov 3 '15 at 22:18
23

In my company we have the "goating" strategy.

If you leave your computer unlocked you might find your screensaver, background and any avatars all changed to various pictures of goats (then lock the PC).

It taught people pretty quickly to leave their PCs locked, as they didn't want the hassle of changing everything back again.

It was self-regulated by the dev team and, now we are ISO27001 certified, we don't risk anyone leaving their PCs unlocked.

  • 1
    We would do something similar, but usually e-mails to the group saying that they were a doofus. No foul language, just an incentive to catch someone leaving their computer unlocked and an incentive to remember to lock it. – Jonathan Fite Nov 3 '15 at 15:05
  • 6
    I worked at a little startup that did this, except it was goatse not goats. (WARNING: NSFW if you don't know of it!!!) that was a rude surprise that quickly got people to lock their screens. And then we got HR people... – Telastyn Nov 4 '15 at 3:17
  • My previous company had the "slugging" strategy. That is, images of slugs rather than pugilism. It worked until people started leaving their machines deliberately unlocked. – Ian Lewis Nov 4 '15 at 19:34
  • At my work we have done similar but always safe images. – James Khoury Nov 5 '15 at 4:32
  • 2
    ...and then we got HR people. I love that line. We do the same as doughnuts or pizza, but sometimes also openly ask for a raise (posing as the negligent victim) because we practice such good security. At a former, very secure employer, our laptop would be confiscated by building security, and we had to meet with our manager to get it back. Same for removable media. Safer than doughnuts (not accessing another's PC/email), but much more disruptive and far less encouraging. – dblanchard Nov 6 '15 at 10:36
21

The simple solution here is an automated screensaver, set up by default; showing something company-positive and neutral. If security is an issue, also lock the screen when the screensaver pops up. Suggest this to your company IT head. If they don't want to do this for all employees, then this is not your problem.

Set it up for yourself, and encourage other people who report to you to do the same. If a problem does arise at some point, you are protected, and can point out how to protect the other computers.

Don't humiliate, don't set up a "donuts" punishment culture, just make it easy for them to do the right thing.

  • 7
    +1 for just a screen saver without lock if it is not a security issue. That sounds like a great compromise. – Sumyrda Nov 3 '15 at 16:52
  • This is probably the best solution. If it's a business policy, let the technology handle it. – Adam Davis Nov 4 '15 at 17:39
  • 1
    For this solution to provide any security at all, you'll have to set the screensaver timeout to something very small (minutes). As a result people reading something technical will see the screensaver kick in in the middle of their read, which is very annoying. – Dmitry Grigoryev Nov 6 '15 at 9:24
  • 3
    The tweak I use, is to set the screen to go blank a minute or so before the lock. This means that when it kicks in while reading it's only very slightly annoying, I have to poke the mouse/keyboard rather than having to enter my password. If that's still too annoying, then it might be possible to set the machine to merely dim the monitor rather than blanking it, so reading is not interrupted at all. If someone both (a) leaves their machine unlocked despite instructions not to do so, (b) finds the technical fix for their poor memory unbearable, then unfortunately they kind of suck at security. – Steve Jessop Nov 7 '15 at 15:17
16

Given your stated reason for the policy, I would not take it seriously at all; whether I followed it would be purely a function of how much I wanted to humor you or were afraid for my job.

If you want people to follow it, reconsider the motivations and have a reason they can take seriously! And if you can't, you might find another way to achieve the effect you want, such as not putting monitors in places where visitors can see what's on the screens. (that's probably a good idea anyways)


Just to be clear, I'm not trying to mock your situation; you may, in fact, have a very real problem that you're trying to solve.

But the important thing to how your employees behave is not the reality of the situation, but how they perceive the situation. The way its presented sounds like a knee-jerk reaction that might not even solve the problem that might not even exist.

And furthermore, you may not think you're asking much of them but little interruptions can be a serious disruption to a person's workflow, so they have real reasons not to just go along with things.

Thus, the need to reevaluate the motivations; to let your employees see that there is a real problem, this policy will actually fix it, and there isn't a better alternative that doesn't disrupt them as much, assuming these are all actually true.

14

You are their manager. They need to do what you say. Do not encourage them to lock their machine. Tell them they need to lock their machine. Briefly explain the security risks and potential for stakeholder disapproval, and make it clear that locking their machine is not optional.

If they do not comply with your directive, you have much bigger problems than unlocked screens. Professionals should be accustomed to receiving directives from their superior and following them. You should not have to resort to games, pranks or handholding to expect professionalism from your staff.

You mention that you've brought it up in meetings, but you don't say that you've made it clear it has to stop. Do what you would do for any other policy:

  • Bring it up once again during your next weekly meeting with the crew.
  • Keep an eye out for people who fail to follow through on your directive.
  • Bring it up with them in your next one on one.
  • If it comes up again, inform them that this is a directive they have to follow and continued failure to follow the directive will be noted on their next performance review.
  • If it continues, note it on their next performance review.

This might sound harsh, but it doesn't need to be. I have always had a great relationship with my managers and subordinates, and it's easy to do that when everyone is following the rules. When someone doesn't follow the rules, you educate them on the reasons why it exists and instruct them once again to follow the rules. Document what they do that isn't within the rules. This is your job as a manager.

Whatever you do, do not encourage people to go on other people's computers for any reason.

6

What is the company policy? I can appreciate that you want them to lock their machines but is it really your responsibility to do so? Your role as a manager is to guide your employees in their decision making and tasks. If there isn't a corporate policy on this then potentially this isn't something you need to be enforcing.

I also would look into their browsing habits. If it's happening as often as you say it is then I think it is worth considering if maybe it's happening too much. Customers will be looking at their screens when they visit - not just when the machine is locked.

  • 2
    He said he's worried about sending the wrong image to stakeholders, and that is within the purview of a manager. Even if it were some other reason (like security), it's reasonable for a manager to go above and beyond company policy for his department, especially if his employees have privileged access that makes their computers more of a risk than others. Company policy is usually the minimum standard that needs to be followed. – Johnny Nov 4 '15 at 4:19
6

Baggy Pantsing: the original and still the best!

[Georgia Tech] A “baggy pantsing” is used to reprimand hackers who incautiously leave their terminals unlocked. The affected user will come back to find a post from them on internal newsgroups discussing exactly how baggy their pants are, an accepted stand-in for “unattentive user who left their work unprotected in the clusters”. A properly-done baggy pantsing is highly mocking and humorous. It is considered bad form to post a baggy pantsing to off-campus newsgroups or the more technical, serious groups. A particularly nice baggy pantsing may be “claimed” by immediately quoting the message in full, followed by your sig block; this has the added benefit of keeping the embarassed victim from being able to delete the post. Interesting baggy-pantsings have been done involving adding commands to login scripts to repost the message every time the unlucky user logs in; Unix boxes on the residential network, when cracked, oftentimes have their homepages replaced (after being politely backed-up to another file) with a baggy-pants message; .plan files are also occasionally targeted. Usage: “Prof. Greenlee fell asleep in the Solaris cluster again; we baggy-pantsed him to git.cc.class.2430.flame.”

Source: http://www.catb.org/jargon/html/B/baggy-pantsing.html

  • We invented a version of this back at school (20+ years ago) where if someone stepped away from their computer we'd insert "I love hamburgers" into their Word document, at a random location. The goal being that they wouldn't notice until they proof read it later or even not at all. I don't even know if windows (3.11 for Workgroups, perhaps) could lock back then. – fjw Oct 16 '17 at 21:37
6

You could use NFC tags to trigger locking / unlocking (depending how strict is your security policy, you might have to keep passwords as a way to unlock the machine) of the workstation.

Put the tag on the mobile phone (usually people have tendency to grab their phone when they are leaving the desk). Company issued phones with NFC module could themselves be used as an ID tags. Alternatively, tags could be attached to key-chains. This, of course, is not bullet proof solution and from my experience you will still have people just stepping away from the desk in a hurry without taking their phones and leaving the PC unlocked. However, the user behavior can not be changed over night, and this could help a lot with the issue of leaving the workstations unlocked. Think of this as a easy and effective short-term fix. Proper employee training and security awareness is always the best solution long-term.

  • A similar set up could be used with Bluetooth Low Power keychains, badges with magnetic stripes, or usb finger print scanners. Those measures wouldn't be full-proof, but combined with other security measures, they could make it very easy to lock or unlock each computer. And the easier something is to use, the more likely users will stick with it. – Stephan Branczyk Nov 3 '15 at 23:55
  • This is similar to how a lot of US Defense Department computers work: you must insert your ID card into the computer to log in, and removing the ID automatically locks the machine. It's much easier to remember that you should have your ID on you when leaving your desk than to remember a keyboard shortcut, and since you'd actually have the ID on your person you're less likely to think you locked the computer when you really didn't. – cpast May 27 '16 at 13:19
6

On the completely other end of the spectrum, Microsoft has a fire on the spot policy if they catch you with your computer unlocked.

You can always let them know that they will get fired/reprimanded if they leave their computer unlocked. If you feel the situation is justified (which it might not be in this case) enforcing a company policy where there are severe consequences is always another option which tends to get results.

  • 1
    many places do, certain sections of airlines and lawyers officers are the same – Kilisi Nov 5 '15 at 17:19
5

Often the biggest hurdle is that locking takes too much thought.

  • IT professionals often forget that most people have a lot of difficulty remembering where an option is, let alone a keyboard shortcut - and will, as a result, quickly give up when they perceive something as too difficult.

    Print this as a sticker and stick it to the bottom of people's monitor:

    Obviously you may need different versions if people are on different OSes, etc.

3

First offence

I usually just open Notepad (not email client or anything like that - I don't want to see that) and leave a polite reminder that they should lock their computer before leaving their desk in order to comply with the security policy, and then lock their computer for them so they have the note to see after they login again.

Later offences

If I encounter it a second or third time I will lockout their password so it needs to be reset (we have a small friendly team here so it's not a hassle).

Pretty quickly they learn that it's quick and easy to lock their machine and is less hassle than having to make a short phone call to unlock their account.

  • Whether or not the "first offence" measure described here is only done for the first offence, or for all offences, this seems like a much more social reaction than the pranks described in other answers. There is really no need for stepping on one's co-workers' dignitiy by means of a public shaming scheme - the co-workers know they are supposed to lock their screen, they don't do it, when they return, they notice someone caught them, and that's it. It was the method used when I studied at the university, and it never took long for students to get used to always lock their screens. – O. R. Mapper Nov 5 '15 at 15:02
  • Exactly - leaving a friendly (but serious) reminder is far more likely to encourage them than a prank of some sort. It's also more likely to remind them that it is a business requirement rather than just a suggestion. Almost every workstation has access to multiple network drives containing client information, they need to know that if I can access their workstation and leave a note, anyone could access it and read their emails, browse their files, connect to network drives, download company sensitive information, anything! – Lyall Nov 5 '15 at 15:14
  • It's also important to note that whatever approach you take, you need to LOCK THEIR COMPUTER when you've finished afterwards. Otherwise it's pointless. – Lyall Nov 5 '15 at 15:15
  • Sure - I was running out of comment length, so I didn't mention locking the computer again. Note, though, that the messages left were indeed not as serious as you suggest here; rather something like: "I will not leave my computer unlocked." – O. R. Mapper Nov 5 '15 at 15:22
  • 1
    Well it often depends on the person too - there's no harm in making the message light hearted as long as they know there's a reason behind the message... :) For example if I'm leaving a note for the MD (which I've done before - NOBODY is above the security policy) then it is strictly formal. If it's for a daily co-worker then it's not so formal. – Lyall Nov 5 '15 at 15:30
2

Our company has a really effective way of stopping this. If someone from IT sees your computer unlocked, they will change your wallpaper or screensaver to something silly. This way everyone can tell that they left their computer unlocked once. So it's humorous while still providing some penalty. IT informs everyone of this on the first day of work so it's no surprise to whoever this happens to.

2

You and the company have to decide if this is a "serious" issue or not. If it isn't then the best you can do is ask and hope your developers show you some respect on this issue. I suppose you can downgrade their performance reviews for being repeat violators. That should convert a few of the non-conformists once they realize you are serious in your request and will follow through with consequences for not adhering.

If you believe this is a serious issue then you should treat it as such. Many companies consider this a security risk and treat it that way. In that regard, people whose terminals are discovered unlocked receive a "security violation" write-up. In companies which require "clearances", a few of these and your clearance will be revoked. Those type of companies are required to self-report, so it really isn't an option to not report the violation. This revoking of clearance usually would go hand in hand with being laid off because without the clearance there's not a lot of use for the person. If that sounds too extreme for your situation then simply disconnecting the person's computer from the network because of their blatant disregard for security and the vulnerability they create for network users would also go a long way in changing behavior.

One last thing, I have to laugh at how many of these posts recommend to do something to the "offender's" computer or impersonate that user. Most Security Policies strictly forbid doing any of these types of things and those acts are actually worse offenses than leaving the screen unlocked. So rather than have one relatively minor security violation, let's step it up and commit some far more serious security violations. What a great idea.

2

Set the password policy to a sane balance between security and the ability to memorize and type it quickly. If it is too complicated or people have to think what their current password is this week, they're tempted to leave the computer open. Consider biometric sensors on the keyboard, if people are comfortable with it.

Then remind the programmers that you have security policies for a good reason, and that they are paid to follow them.

2

First I think you should explain to your team the importance why they need to do it. As mentioned in other answers, visitors seeing open browser tabs aren't the biggest risk, compromising your systems is much greater risk. Only if people understand why, implementing some of the suggested office games makes sense, to help them create the good habit of locking their screens.

There are also technical solutions. There are applications, such as BlueProximity that lock a screen once a user's BlueTooth device is further than some threshold. This could be either a phone, or if people don't carry their phones around, a BlueTooth beacon to keep in a pocket.

  • I tried blueproximity and it functioned well - but my 15 year old nokia's battery life dropped to only a week, but my android phone got barely three hours between charges. Not worth it, although its a cute solution – Criggie Nov 5 '15 at 9:19
  • 1
    You can do something similar with e.g. a work ID card. Card in slot -> terminal unlocked. Card removed, terminal locks. (Some hotels do something like this now). Works best in a building where you need to be wearing your card. – Sobrique Nov 6 '15 at 9:38
  • @Criggie, How long did their batteries last between charges before you installed blueproximity? – Stephan Branczyk Nov 9 '15 at 22:34
  • @StephanBranczyk roughly double, at the time. The nokia did 10-14 days, and the android phone did ~24 hours – Criggie Nov 9 '15 at 22:49
2

A partial answer:

In one of my previous jobs, we were allowed to go on Facebook, reddit, or farmville, but we had to do it from a separate public Chrome Box workstation (a Chrome Box is just like a Chromebook, but in a desktop form). The same went for personal phone calls, there was a specific area for that. There was a clear separation between work and personal stuff.

Using a Chromebook/ChromeBox for that purpose was great. One could just login into his/her gmail account, and all the personal tabs one had set up from last time would just pop up. Or if one was in a hurry, one could just login using incognito mode and look up something super quickly.

The same went for night janitors and security guards. They were allowed to use those Chrome stations, but if they were caught using any other workstation, it would have been a serious security breach.

And please don't get me wrong, what I am suggesting is again only a partial answer to the original question. Good security comes with many layers. And this separation of personal vs. work is only one additional layer a company could use in addition to some of the other security measures already suggested as answers.

  • With everyone using a shared machine, an attacker will have a much easier time stealing credentials using key loggers since they only need to get access to one box. – Benjamin Hubbard Nov 4 '15 at 20:47
  • 1
    With physical access to the machine, yes, they could add a key logger, but they'd be getting personal credentials, not work credentials. And like I said, good security comes with several layers. Implementing only one security measure is not enough. – Stephan Branczyk Nov 5 '15 at 5:59
  • absolutely, one layer is not sufficient, usually the weakest link is the one sitting behind the keyboard, even with experienced competent people who should know better. – Kilisi Nov 9 '15 at 1:19

protected by enderland Nov 5 '15 at 14:43

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.