I have been recently hired as a security engineer on a company.
They provided me a MacBook Pro as a company laptop. As I always do in any computer in my possession - including in previous jobs - I rebooted in order to reinstall the operating system. I consider it to be good hygiene, since I don't know what's on the company's standard image, and by default I don't trust it. Besides, I expect to make my own choices regarding its initial configuration.
However, I noticed I am unable to enter the recovery screen because it is locked with a firmware password.
After requesting its removal, I was told by IT that this is a new company practice and they will not make any exceptions (other than laptops provided before this policy). The password will remain, and I am expected to use the base image only.
The way I see it, this is appropriate for non-tech-savvy users, but inappropriate in scenarios where autonomy is required, and employees are skilled, typically on technical teams.
I don't think any self-respecting security professional would be comfortable knowing that they do not have full control over their laptop, and that it was installed by someone else, with unknown defaults. Yes, it's the company's property and their decision, but as my main work tool, I should be able to use it anyway I need, including reinstalling the OS or booting from a live pen drive.
Effectively, I am being trusted to secure the company's business, but am not being trusted to secure my own laptop. This is a moral issue to me.
- Is my behavior unreasonable (or an overreaction)?
- Is locking down a computer in this way for a security engineer commonplace in industry?
- How do I resolve this without quitting?
I am perfectly aware that the company can choose anything they want, as it is their property, but security folk tend to be paranoid, and I am no exception.
I don't mean to turn this into a dispute, but I feel I will be so uncomfortable working like this that I am more likely to consider not remaining on this company.