How to encourage employees to lock their machines when they leave their desk?

Question

I manage a medium sized team of developers that have a tendency to leave their machines unlocked as they go throughout their day. Being developers they will often have browser windows open and I'm worried that it's sending the wrong image to stakeholders when they are often seeing what they would see as something other then work on my staffs screens whenever they pop by. I also want to encourage them to lock their machines if they are going to be away from their desks as that also adds a layer of security I see as beneficial.

I've brought this up in meetings but it doesn't seem to have changed anything. Should I take a more formal approach?

Answer 1

The Donuts game!

Facing similar challenges we adopted a solution in my workplace for this called the "donuts" game. Keep in mind that this does have a tendency to be somewhat distracting. For this reason we don't run this year round, only in December when the pressure is off and there's a lighter mood in the office that we want to foster heading into the Christmas break.

Rules

The game is quite simple - if you leave your computer unlocked and another team member notices then they have free reign to open your e-mail client and e-mail the team e-mail the word 'donuts' from your account. Each time somebody does this to you successfully that's one point against your name. The person at the end of the week that has the most points against their name has to buy donuts for the team for our SCRUM standup on Monday morning.

This has the benefit of challenging people to be the best they can be at locking their machines, and creates an informal penalty system for those that continue to fail in locking their machine.

But does it work for you?

Keep in in mind that this isn't for all work environments - we have a team it works really well for and we talked about it as a group to make sure everybody was on board before starting. I strongly advise considering your team and the personalities involved before putting something like this in place.

Also be sure to consider whether there are any issues with team members using another's machine, even to send an e-mail. The medical industry in many locales will specifically prevent this (either through regulation or a need for high privacy), the finance industry would in many cases be the same. If these aren't a barrier though - have fun!

Answer 2

I deal with this a lot from the Network Engineering side. Programmers here are normally given a bit of leeway and respect because in theory they're professionals and will follow security protocols without needing their hands held. So best policy is to try and get them to comply informally.

Methods for internal resolution are for the team to police each other as outlined in other answers by a system of small harmless punishments. But in my opinion better if the manager just makes it mandatory.

But when they're recalcitrant it's fairly easy to fix formally.

The solution was for the manager to tell the programmers that they either sort out their security themselves or the engineers will come and lock peoples machines down and enforce group policies... this usually did the trick pretty quickly. Usually it doesn't even have to be followed through with.

A non confrontational way which I use a lot is to get the Network Engineering Manager (in this example, me) to attend a meeting and spend a couple of minutes politely telling the programmers some home truths. This takes any uncomfortable issues off the Manager and coming from a third party who can actually enforce things is a good strategy. I just go in introduce myself, apologise for taking their time and outline simple network security policies that MUST be enforced as part of my role. Treat them like the professionals that they are. Ask if anyone needs to know how to lock their machine, take any questions they might have, thank them for their time and leave the meeting so they can sort out how they want to do it (I don't want to know about baggy pants or donuts or pizza). Even just an email to their Manager will be enough usually, he can then forward it to his team and discuss it at their meeting. The crux is having it come from the authorised third party.

I have only rarely needed to actually do it, this goes for any group of professionals or elites within a company, I have used this method with pilots, doctors and lawyers as well as programmers.

Answer 3

Where I work, it's an unofficial policy that anyone leaving their computer unlocked for long enough will have someone go to it and send an email offering to bring pizza, or pastries in for everyone the following day.

The result of this is that someone has to admit to leaving their computer unlocked and being a cheapass, or follow through and bring some grub in. Granted, occasionally bringing food/candy into the breakroom for everyone is also normal here.

The advantage of this is that other employees will enforce it for you.

Answer 4

None of the answers suggesting pranking or such are appropriate in a nominally secure environment.

A secure environment has a formal POLICY for security, a formal PROCESS for complying with that policy, and a formal PROCEDURE for addressing non-compliance. In all previous answers, the advocated procedure for addressing the lapse is itself a violation of the security policy AND process.

In other words, when a lazy user's desktop screen picture is changed to a David Hasselhoff bikini photo, or the user's email is used to send a "hacked donuts" email...from the standpoint of certification, you've not only had a POTENTIAL security breach, you've now had an ACTUAL security breach.

I'm assuming here that the issue of security isn't just some arbitrary requirement...like, there's customer PII floating around, and/or PCI or SAX70 compliance or other compliance certification is at stake. It is enough justification (IMHO) that clients are in the area, where they may see sensitive business information about other clients.

The proper way to deal with this is for the IT security staff to do sweeps of the office during their normal day's wandering around, and if they come aross an unlocked, unattended computer, they change the user password and lock the screen/computer, leaving a note for the user that they have to contact IT to re-enable their account. The IT staffer of course has to be using some kind of rotating "reset password" scheme, so that the changed password can't just be guessed by the returning user.

Answer 5

I've sometimes reminded colleagues who fail to lock by using a shortcut to rotate or flip their screen and then locking (Windows+L). The flip shortcut is dependent on the device but ALT+Arrow or CTRL+ALT+Arrow should work on many typical business computers and laptops.

The advantage of this approach is that it's a simple double keyboard shortcut so you don't spend any length of time actually on their unlocked system, with all the security implications that has, while still reminding them that they forgot to lock again. Notorious offenders can be left in the dark about the way to restore a flipped screen to drive the message home.

Because you don't actually have to use a colleague's unlocked system this will likely be a more acceptable solution than actually changing system settings or sending an email from their account, but there are still offices where even this would be crossing a line or where even minor pranks don't fit the culture so use with caution. You'll also want to actually be around when your colleague comes back when you do this the first few times in case he can't figure out a way to reverse it or, as Dan points out, runs to IT claiming his computer was hacked.

Answer 6

In my company we have the "goating" strategy.

If you leave your computer unlocked you might find your screensaver, background and any avatars all changed to various pictures of goats (then lock the PC).

It taught people pretty quickly to leave their PCs locked, as they didn't want the hassle of changing everything back again.

It was self-regulated by the dev team and, now we are ISO27001 certified, we don't risk anyone leaving their PCs unlocked.

Answer 7

The simple solution here is an automated screensaver, set up by default; showing something company-positive and neutral. If security is an issue, also lock the screen when the screensaver pops up. Suggest this to your company IT head. If they don't want to do this for all employees, then this is not your problem.

Set it up for yourself, and encourage other people who report to you to do the same. If a problem does arise at some point, you are protected, and can point out how to protect the other computers.

Don't humiliate, don't set up a "donuts" punishment culture, just make it easy for them to do the right thing.

Answer 8

Given your stated reason for the policy, I would not take it seriously at all; whether I followed it would be purely a function of how much I wanted to humor you or were afraid for my job.

If you want people to follow it, reconsider the motivations and have a reason they can take seriously! And if you can't, you might find another way to achieve the effect you want, such as not putting monitors in places where visitors can see what's on the screens. (that's probably a good idea anyways)

---

Just to be clear, I'm not trying to mock your situation; you may, in fact, have a very real problem that you're trying to solve.

But the important thing to how your employees behave is not the reality of the situation, but how they perceive the situation. The way its presented sounds like a knee-jerk reaction that might not even solve the problem that might not even exist.

And furthermore, you may not think you're asking much of them but little interruptions can be a serious disruption to a person's workflow, so they have real reasons not to just go along with things.

Thus, the need to reevaluate the motivations; to let your employees see that there is a real problem, this policy will actually fix it, and there isn't a better alternative that doesn't disrupt them as much, assuming these are all actually true.

Answer 9

You are their manager. They need to do what you say. Do not encourage them to lock their machine. Tell them they need to lock their machine. Briefly explain the security risks and potential for stakeholder disapproval, and make it clear that locking their machine is not optional.

If they do not comply with your directive, you have much bigger problems than unlocked screens. Professionals should be accustomed to receiving directives from their superior and following them. You should not have to resort to games, pranks or handholding to expect professionalism from your staff.

You mention that you've brought it up in meetings, but you don't say that you've made it clear it has to stop. Do what you would do for any other policy:

• Bring it up once again during your next weekly meeting with the crew.
• Keep an eye out for people who fail to follow through on your directive.
• Bring it up with them in your next one on one.
• If it comes up again, inform them that this is a directive they have to follow and continued failure to follow the directive will be noted on their next performance review.
• If it continues, note it on their next performance review.

This might sound harsh, but it doesn't need to be. I have always had a great relationship with my managers and subordinates, and it's easy to do that when everyone is following the rules. When someone doesn't follow the rules, you educate them on the reasons why it exists and instruct them once again to follow the rules. Document what they do that isn't within the rules. This is your job as a manager.

Whatever you do, do not encourage people to go on other people's computers for any reason.

Answer 10

What is the company policy? I can appreciate that you want them to lock their machines but is it really your responsibility to do so? Your role as a manager is to guide your employees in their decision making and tasks. If there isn't a corporate policy on this then potentially this isn't something you need to be enforcing.

I also would look into their browsing habits. If it's happening as often as you say it is then I think it is worth considering if maybe it's happening too much. Customers will be looking at their screens when they visit - not just when the machine is locked.

Answer 11

Baggy Pantsing: the original and still the best!

[Georgia Tech] A “baggy pantsing” is used to reprimand hackers who incautiously leave their terminals unlocked. The affected user will come back to find a post from them on internal newsgroups discussing exactly how baggy their pants are, an accepted stand-in for “unattentive user who left their work unprotected in the clusters”. A properly-done baggy pantsing is highly mocking and humorous. It is considered bad form to post a baggy pantsing to off-campus newsgroups or the more technical, serious groups. A particularly nice baggy pantsing may be “claimed” by immediately quoting the message in full, followed by your sig block; this has the added benefit of keeping the embarassed victim from being able to delete the post. Interesting baggy-pantsings have been done involving adding commands to login scripts to repost the message every time the unlucky user logs in; Unix boxes on the residential network, when cracked, oftentimes have their homepages replaced (after being politely backed-up to another file) with a baggy-pants message; .plan files are also occasionally targeted. Usage: “Prof. Greenlee fell asleep in the Solaris cluster again; we baggy-pantsed him to git.cc.class.2430.flame.”

Source: http://www.catb.org/jargon/html/B/baggy-pantsing.html

Answer 12

You could use NFC tags to trigger locking / unlocking (depending how strict is your security policy, you might have to keep passwords as a way to unlock the machine) of the workstation.

Put the tag on the mobile phone (usually people have tendency to grab their phone when they are leaving the desk). Company issued phones with NFC module could themselves be used as an ID tags. Alternatively, tags could be attached to key-chains. This, of course, is not bullet proof solution and from my experience you will still have people just stepping away from the desk in a hurry without taking their phones and leaving the PC unlocked. However, the user behavior can not be changed over night, and this could help a lot with the issue of leaving the workstations unlocked. Think of this as a easy and effective short-term fix. Proper employee training and security awareness is always the best solution long-term.

Answer 13

On the completely other end of the spectrum, Microsoft has a fire on the spot policy if they catch you with your computer unlocked.

You can always let them know that they will get fired/reprimanded if they leave their computer unlocked. If you feel the situation is justified (which it might not be in this case) enforcing a company policy where there are severe consequences is always another option which tends to get results.

Answer 14

Often the biggest hurdle is that locking takes too much thought.

• IT professionals often forget that most people have a lot of difficulty remembering where an option is, let alone a keyboard shortcut - and will, as a result, quickly give up when they perceive something as too difficult.

Print this as a sticker and stick it to the bottom of people's monitor:

Obviously you may need different versions if people are on different OSes, etc.

Answer 15

First I think you should explain to your team the importance why they need to do it. As mentioned in other answers, visitors seeing open browser tabs aren't the biggest risk, compromising your systems is much greater risk. Only if people understand why, implementing some of the suggested office games makes sense, to help them create the good habit of locking their screens.

There are also technical solutions. There are applications, such as BlueProximity that lock a screen once a user's BlueTooth device is further than some threshold. This could be either a phone, or if people don't carry their phones around, a BlueTooth beacon to keep in a pocket.

Answer 16

First offence

I usually just open Notepad (not email client or anything like that - I don't want to see that) and leave a polite reminder that they should lock their computer before leaving their desk in order to comply with the security policy, and then lock their computer for them so they have the note to see after they login again.

Later offences

If I encounter it a second or third time I will lockout their password so it needs to be reset (we have a small friendly team here so it's not a hassle).

Pretty quickly they learn that it's quick and easy to lock their machine and is less hassle than having to make a short phone call to unlock their account.

Answer 17

Our company has a really effective way of stopping this. If someone from IT sees your computer unlocked, they will change your wallpaper or screensaver to something silly. This way everyone can tell that they left their computer unlocked once. So it's humorous while still providing some penalty. IT informs everyone of this on the first day of work so it's no surprise to whoever this happens to.

Answer 18

Set the password policy to a sane balance between security and the ability to memorize and type it quickly. If it is too complicated or people have to think what their current password is this week, they're tempted to leave the computer open. Consider biometric sensors on the keyboard, if people are comfortable with it.

Then remind the programmers that you have security policies for a good reason, and that they are paid to follow them.

Answer 19

A partial answer:

In one of my previous jobs, we were allowed to go on Facebook, reddit, or farmville, but we had to do it from a separate public Chrome Box workstation (a Chrome Box is just like a Chromebook, but in a desktop form). The same went for personal phone calls, there was a specific area for that. There was a clear separation between work and personal stuff.

Using a Chromebook/ChromeBox for that purpose was great. One could just login into his/her gmail account, and all the personal tabs one had set up from last time would just pop up. Or if one was in a hurry, one could just login using incognito mode and look up something super quickly.

The same went for night janitors and security guards. They were allowed to use those Chrome stations, but if they were caught using any other workstation, it would have been a serious security breach.

And please don't get me wrong, what I am suggesting is again only a partial answer to the original question. Good security comes with many layers. And this separation of personal vs. work is only one additional layer a company could use in addition to some of the other security measures already suggested as answers.

Answer 20

You and the company have to decide if this is a "serious" issue or not. If it isn't then the best you can do is ask and hope your developers show you some respect on this issue. I suppose you can downgrade their performance reviews for being repeat violators. That should convert a few of the non-conformists once they realize you are serious in your request and will follow through with consequences for not adhering.

If you believe this is a serious issue then you should treat it as such. Many companies consider this a security risk and treat it that way. In that regard, people whose terminals are discovered unlocked receive a "security violation" write-up. In companies which require "clearances", a few of these and your clearance will be revoked. Those type of companies are required to self-report, so it really isn't an option to not report the violation. This revoking of clearance usually would go hand in hand with being laid off because without the clearance there's not a lot of use for the person. If that sounds too extreme for your situation then simply disconnecting the person's computer from the network because of their blatant disregard for security and the vulnerability they create for network users would also go a long way in changing behavior.

One last thing, I have to laugh at how many of these posts recommend to do something to the "offender's" computer or impersonate that user. Most Security Policies strictly forbid doing any of these types of things and those acts are actually worse offenses than leaving the screen unlocked. So rather than have one relatively minor security violation, let's step it up and commit some far more serious security violations. What a great idea.