4 ms·
That's pretty terrible opsec. It presents a risk to separation of roles / compartmentalization if a coworker can walk over to your workstation and have access t
by akerl_ 11y ago
That's pretty terrible opsec. It presents a risk to separation of roles / compartmentalization if a coworker can walk over to your workstation and have access to it, to say nothing of malicious access by somebody who shouldn't be in the office in the first place.
- vinceguidry 11y agoSecurity requires a threat model to rise above theatre. If there are operations threats to your organization, then you need opsec to mitigate those threats. Is China or someone else trying to steal your trade secrets? If so, I would hope the responsibility for setting opsec policy isn't resting in one sysadmin.
- Angostura 11y ago> Is China or someone else trying to steal your trade secrets? Or more prosaically, do you have any semi-confidential e-mail on your machine, that a coworker might fancy reading?
- vinceguidry 11y agoIf you can't trust your coworkers not to go snooping on your machine while you're not there, then you should find a better job. Threat models balloon in complexity when you can't use tools like zones of trust and choke points.
- aclissold 11y agoI'd argue that the coworkers that are the most dangerous are the ones you do trust. :)
- matwood 11y agoIf locking your computer in the office is required opsec, then you have already lost. First, you shouldn't have random people walking around the office. Once someone has physical access the battle is already over. Second, rogue employees are still rogue employees, and an unlocked computer is the least of your worries. With that said, I always lock my computer out of habit.
- mentat 11y agoNot sure what size company you're working in nor what the requirements for opsec are their nor your privilege levels but it certainly does not mean you have already lost.
- deleted 11y ago[deleted]