5 ms·

Worst scenario: The intern is malevolent. Counter: Credentials should be given progressively as trust is built (and as lessons are learnt), and an intern can’t

Worst scenario: The intern is malevolent. Counter: Credentials should be given progressively as trust is built (and as lessons are learnt), and an intern can’t have access to production. I have an employee who I thought I could give more responsibilities, but he keeps not locking his computer when he walks away. He has very limited access to everything and it would impede his career if he didn’t also have the same attitude about other issues. (My question is, how do I make him diligent — It’s real potential wasted).

ethanwillis 6y ago
Have you explained this to him?
- marcus_holmes 6y ago
  Further, have you really listened to his explanation of why he isn't bothered about locking his computer? It might be that in your organisation this is a cargo-cult security practice that he's not bothered by because he knows it's not an effective practice. Or it could be that he knows he doesn't have enough permissions to do any damage, so he doesn't bother locking his computer. Trusting him with a little responsibility might change that.
monkeybutton 6y ago
This isn't a solution you can implement yourself since it sounds like you're in a position of power over the employee and it would be harassment. But having a culture where leaving computers unlocked and unattended is an open invitation to getting embarrassing YouTube videos opened on full screen by your peers works wonders for getting people to lock their computers. I wish I had an answer for the second part; it's hard to see someone with talent be the one to get laid off after months of asking them to be more diligent in their work.
- Judgmentality 6y ago
  > I wish I had an answer for the second part; it's hard to see someone with talent be the one to get laid off after months of asking them to be more diligent in their work. Oof, this hits close to home. I don't have an answer either.
- throwawayboise 6y ago
  How on earth is it harrassment to tell a subordinate that he needs to improve his security habits?
  - monkeybutton 6y ago
    The harassment would be the doing embarrassing things with the unlocked computer. A manager or team lead shouldn't be picking on their employees like that. It's something more OK for a peer to do. Ironically, it's the interns who I've seen get into it the most and make it a game. They really got a kick out catching the full timers.
    - NeutronStar 6y ago
      Harassment has to be a repeated and unwanted action against someone. If it's one time, it's not harassment. If you don't speak up against the perceived harassment, can it even be considered harassment? Also would you rather be fired instead? There's real life implications to not locking his computer.
    - SilasX 6y ago
      You were replying to laurent92, who didn't say anything like that (picking on employees or embarrassing them); that was this other comment, which was replying to laurent92: https://news.ycombinator.com/item?id=26286183 https://news.ycombinator.com/item?id=26286183
eat_veggies 6y ago
At a company I used to work for, if someone left their computer unlocked, we'd send the donut emoji into the #everyone channel on slack from their computer, and they'd have to buy donuts for the office
- monkeybutton 6y ago
  This too but with croissants. It even became a verb. To croissant someone or be croissant-ed! Edit: Also singing over the top praises of employees using the victim's account. "MonkeyButton is truly the best coworker I have ever had " All this fun has gone away now with Covid and remote working.
  - Kyro38 6y ago
    You're french right ?
- foobiekr 6y ago
  For us, it’s teapots. Inspired by the info set who noted his cube mate couldn’t learn to lock his screen and started sending, from his open laptop, “I’m a little teapot...” first to just him and then the wider org when he failed to adjust his behavior.
- vvanders 6y ago
  Oh! Story time! We had a similar thing at one gamedev place that I worked at where and email would go out to the team if you left your computer unlocked(I forget the exact phrase but it was fairly silly). We had shared offices and one of the programmers had the office right next to the kitchen. One day we all heard the senior programmer shout "WHAT THE FUCK!" and all ran over to see what had happened. It turns out one of our engineers had walked into the kitchen and left his computer unlocked. The senior developer seeing this had opened up outlook, started a new message and began typing in the subject. What he didn't know is the developer had hand-rolled a keylogger with a match pattern for the message that everyone would send and dispatched Windows+L via key injection to the main window loop. The trap was sprung and the machine locked right in front of him as he typed the last letter unable to send the email. There was all sorts of other shenanigans at that place(like a fake "April 2nd" firing, they got the person who did that back with an annoy-a-tron over a 6 month period) but that was one of the more memorable ones.
contravariant 6y ago
Well I've heard of one office that had an established rule that any unlocked laptop could be used to promise the rest of the team free cake on behalf of the person that forgot to lock their laptop. If nothing else at least it promotes awareness (and cake!).
akiselev 6y ago
Why is locking your computer at work a security concern? It's certainly another layer in the onion but a rather weak one and certainly not one worth losing someone over. If it's so big an issue, get him a smart watch that works with their OS of choice and enforce a bluetooth device locking policy. Physical access is considered game over, no?
- coffeefirst 6y ago
  Right. There are some intense security environments where they also deal in airgaps and the like, but this is insane behavior at a regular job.
- camjohnson26 6y ago
  I agree, I’m sure it helps but seems like if a malicious coworker wants access they can trivially steal your password with a keylogger or just watching you type it in. May prevent spontaneous acts I guess but feels like if those are really a risk you’ve hired the wrong people.
- josh3736 6y ago
  It's actually a legitimate concern, and it goes far beyond coworkers embarrassing you in slack. For example, posted yesterday: https://tailscale.com/blog/rotate-ssh-keys/ https://tailscale.com/blog/rotate-ssh-keys/ (https://news.ycombinator.com/item?id=26249380 https://news.ycombinator.com/item?id=26249380) > One company had an employee they fired for bad behaviour. A few months later all their production servers got wiped out. ... A month later, it happened again! Everything gone. > What happened was that the rogue employee, months before they were fired, had waited until everyone went to lunch, walked around from one PC to the next, and collected the ssh private keys from any of them that weren’t locked. ... Then, a while after getting fired, he used a co-worker’s ssh key to login and destroy everything. Of course, screen locking would not prevent a determined, disgruntled (or desperate) employee from pulling off something like this, but it would stop the casual collection of secrets while everyone is at lunch. Add full disk encryption to PCs and you have a reasonable chance at defending. Oh, and if you're doing anything with credit cards, PCI DSS requires you to enforce a workstation locking policy. Failing to do so opens you up to massive liability in the event of a breach.
kordlessagain 6y ago
It's too bad you are on here disparaging a current employee.
staysaasy 6y ago
I strongly recommend just sitting him or her down and explaining why this is a problem (you've articulated it well here). Either they get more diligent (great) they can't get more diligent (not great) or they refuse to be more diligent (really not great). I think that there's sometimes a tendency to overthink management topics - there's no need to overthink this one.
ukj 6y ago
2-factor authentication allows you to bias yourself towards suspecting malevolence. It's reasonably believable that they leaked their password because. Interns. And the second factor?

ethanwillis 6y ago

Have you explained this to him?

marcus_holmes 6y ago
Further, have you really listened to his explanation of why he isn't bothered about locking his computer? It might be that in your organisation this is a cargo-cult security practice that he's not bothered by because he knows it's not an effective practice. Or it could be that he knows he doesn't have enough permissions to do any damage, so he doesn't bother locking his computer. Trusting him with a little responsibility might change that.

monkeybutton 6y ago

This isn't a solution you can implement yourself since it sounds like you're in a position of power over the employee and it would be harassment. But having a culture where leaving computers unlocked and unattended is an open invitation to getting embarrassing YouTube videos opened on full screen by your peers works wonders for getting people to lock their computers. I wish I had an answer for the second part; it's hard to see someone with talent be the one to get laid off after months of asking them to be more diligent in their work.

Judgmentality 6y ago
> I wish I had an answer for the second part; it's hard to see someone with talent be the one to get laid off after months of asking them to be more diligent in their work. Oof, this hits close to home. I don't have an answer either.
throwawayboise 6y ago
How on earth is it harrassment to tell a subordinate that he needs to improve his security habits?
- monkeybutton 6y ago
  The harassment would be the doing embarrassing things with the unlocked computer. A manager or team lead shouldn't be picking on their employees like that. It's something more OK for a peer to do. Ironically, it's the interns who I've seen get into it the most and make it a game. They really got a kick out catching the full timers.
  - NeutronStar 6y ago
    Harassment has to be a repeated and unwanted action against someone. If it's one time, it's not harassment. If you don't speak up against the perceived harassment, can it even be considered harassment? Also would you rather be fired instead? There's real life implications to not locking his computer.
  - SilasX 6y ago
    You were replying to laurent92, who didn't say anything like that (picking on employees or embarrassing them); that was this other comment, which was replying to laurent92: https://news.ycombinator.com/item?id=26286183 https://news.ycombinator.com/item?id=26286183

eat_veggies 6y ago

At a company I used to work for, if someone left their computer unlocked, we'd send the donut emoji into the #everyone channel on slack from their computer, and they'd have to buy donuts for the office

monkeybutton 6y ago
This too but with croissants. It even became a verb. To croissant someone or be croissant-ed! Edit: Also singing over the top praises of employees using the victim's account. "MonkeyButton is truly the best coworker I have ever had " All this fun has gone away now with Covid and remote working.
- Kyro38 6y ago
  You're french right ?
foobiekr 6y ago
For us, it’s teapots. Inspired by the info set who noted his cube mate couldn’t learn to lock his screen and started sending, from his open laptop, “I’m a little teapot...” first to just him and then the wider org when he failed to adjust his behavior.
vvanders 6y ago
Oh! Story time! We had a similar thing at one gamedev place that I worked at where and email would go out to the team if you left your computer unlocked(I forget the exact phrase but it was fairly silly). We had shared offices and one of the programmers had the office right next to the kitchen. One day we all heard the senior programmer shout "WHAT THE FUCK!" and all ran over to see what had happened. It turns out one of our engineers had walked into the kitchen and left his computer unlocked. The senior developer seeing this had opened up outlook, started a new message and began typing in the subject. What he didn't know is the developer had hand-rolled a keylogger with a match pattern for the message that everyone would send and dispatched Windows+L via key injection to the main window loop. The trap was sprung and the machine locked right in front of him as he typed the last letter unable to send the email. There was all sorts of other shenanigans at that place(like a fake "April 2nd" firing, they got the person who did that back with an annoy-a-tron over a 6 month period) but that was one of the more memorable ones.

contravariant 6y ago

Well I've heard of one office that had an established rule that any unlocked laptop could be used to promise the rest of the team free cake on behalf of the person that forgot to lock their laptop. If nothing else at least it promotes awareness (and cake!).

akiselev 6y ago

Why is locking your computer at work a security concern? It's certainly another layer in the onion but a rather weak one and certainly not one worth losing someone over. If it's so big an issue, get him a smart watch that works with their OS of choice and enforce a bluetooth device locking policy. Physical access is considered game over, no?

coffeefirst 6y ago
Right. There are some intense security environments where they also deal in airgaps and the like, but this is insane behavior at a regular job.
camjohnson26 6y ago
I agree, I’m sure it helps but seems like if a malicious coworker wants access they can trivially steal your password with a keylogger or just watching you type it in. May prevent spontaneous acts I guess but feels like if those are really a risk you’ve hired the wrong people.
josh3736 6y ago
It's actually a legitimate concern, and it goes far beyond coworkers embarrassing you in slack. For example, posted yesterday: https://tailscale.com/blog/rotate-ssh-keys/ https://tailscale.com/blog/rotate-ssh-keys/ (https://news.ycombinator.com/item?id=26249380 https://news.ycombinator.com/item?id=26249380) > One company had an employee they fired for bad behaviour. A few months later all their production servers got wiped out. ... A month later, it happened again! Everything gone. > What happened was that the rogue employee, months before they were fired, had waited until everyone went to lunch, walked around from one PC to the next, and collected the ssh private keys from any of them that weren’t locked. ... Then, a while after getting fired, he used a co-worker’s ssh key to login and destroy everything. Of course, screen locking would not prevent a determined, disgruntled (or desperate) employee from pulling off something like this, but it would stop the casual collection of secrets while everyone is at lunch. Add full disk encryption to PCs and you have a reasonable chance at defending. Oh, and if you're doing anything with credit cards, PCI DSS requires you to enforce a workstation locking policy. Failing to do so opens you up to massive liability in the event of a breach.

kordlessagain 6y ago

It's too bad you are on here disparaging a current employee.

staysaasy 6y ago

I strongly recommend just sitting him or her down and explaining why this is a problem (you've articulated it well here). Either they get more diligent (great) they can't get more diligent (not great) or they refuse to be more diligent (really not great). I think that there's sometimes a tendency to overthink management topics - there's no need to overthink this one.

ukj 6y ago

2-factor authentication allows you to bias yourself towards suspecting malevolence. It's reasonably believable that they leaked their password because. Interns. And the second factor?