3 ms·

Oh totally... It's slightly surprising there's not an emergency evacuation procedure for people who work in the building that involves locking all devices that

Oh totally... It's slightly surprising there's not an emergency evacuation procedure for people who work in the building that involves locking all devices that remain in the building via a hot-key or hot-corner. Come to think of it, I wonder if a screen lock command is something that could be pushed from a Windows domain controller...and if so, why wasn't that used?

banana_giraffe 6y ago
Windows 10 can be setup to auto-lock if a bluetooth phone goes out of range, and there's a little eco system of third party companies that make keyfobs that do the same basic thing. Even if it's not a common feature, it's not like I'd be surprised to learn these computers are imaged with some custom software, one of which could be a lock on command (or loss of connectivity to home). I have no idea how important these machines were, of course.
- astrange 6y ago
  A government computer should be set to lock as soon as the CAC is removed, and staffers shouldn’t be leaving their CAC in the machine even if they’re fleeing, or else they’ll be locked out of the building. So something obviously went wrong there.
marvion 6y ago
I've seen "just WIN+L" on Twitter a lot... Relying on humans locking their PC in event of a terrorist attack isn't a IT-Security concept. Security consists of a threat model and many layers of security measures. Many many outer layers have failed here. I wouldn't blame an individual nor a department here. It's one of those events that probably wasn't in the scope. Additionally, roles/security clearance levels etc. still work regardless of the account beeing open to anyone. Things like Smartcards, Yubikeys, auto-lockscreen could have failed the same way. Maybe a GPO failed, or a windows update broke the auto-lock.... that's why all these many layers exist.
- 8note 6y ago
  It's kinda ridiculous that protest turns to riot and they break in wouldn't be in scope for a place with constant protests outside

banana_giraffe 6y ago

Windows 10 can be setup to auto-lock if a bluetooth phone goes out of range, and there's a little eco system of third party companies that make keyfobs that do the same basic thing. Even if it's not a common feature, it's not like I'd be surprised to learn these computers are imaged with some custom software, one of which could be a lock on command (or loss of connectivity to home). I have no idea how important these machines were, of course.

astrange 6y ago
A government computer should be set to lock as soon as the CAC is removed, and staffers shouldn’t be leaving their CAC in the machine even if they’re fleeing, or else they’ll be locked out of the building. So something obviously went wrong there.

marvion 6y ago

I've seen "just WIN+L" on Twitter a lot... Relying on humans locking their PC in event of a terrorist attack isn't a IT-Security concept. Security consists of a threat model and many layers of security measures. Many many outer layers have failed here. I wouldn't blame an individual nor a department here. It's one of those events that probably wasn't in the scope. Additionally, roles/security clearance levels etc. still work regardless of the account beeing open to anyone. Things like Smartcards, Yubikeys, auto-lockscreen could have failed the same way. Maybe a GPO failed, or a windows update broke the auto-lock.... that's why all these many layers exist.

8note 6y ago
It's kinda ridiculous that protest turns to riot and they break in wouldn't be in scope for a place with constant protests outside