3 ms·

Why is locking your computer at work a security concern? It's certainly another layer in the onion but a rather weak one and certainly not one worth losing some

Why is locking your computer at work a security concern? It's certainly another layer in the onion but a rather weak one and certainly not one worth losing someone over. If it's so big an issue, get him a smart watch that works with their OS of choice and enforce a bluetooth device locking policy. Physical access is considered game over, no?

coffeefirst 6y ago
Right. There are some intense security environments where they also deal in airgaps and the like, but this is insane behavior at a regular job.
camjohnson26 6y ago
I agree, I’m sure it helps but seems like if a malicious coworker wants access they can trivially steal your password with a keylogger or just watching you type it in. May prevent spontaneous acts I guess but feels like if those are really a risk you’ve hired the wrong people.
josh3736 6y ago
It's actually a legitimate concern, and it goes far beyond coworkers embarrassing you in slack. For example, posted yesterday: https://tailscale.com/blog/rotate-ssh-keys/ https://tailscale.com/blog/rotate-ssh-keys/ (https://news.ycombinator.com/item?id=26249380 https://news.ycombinator.com/item?id=26249380) > One company had an employee they fired for bad behaviour. A few months later all their production servers got wiped out. ... A month later, it happened again! Everything gone. > What happened was that the rogue employee, months before they were fired, had waited until everyone went to lunch, walked around from one PC to the next, and collected the ssh private keys from any of them that weren’t locked. ... Then, a while after getting fired, he used a co-worker’s ssh key to login and destroy everything. Of course, screen locking would not prevent a determined, disgruntled (or desperate) employee from pulling off something like this, but it would stop the casual collection of secrets while everyone is at lunch. Add full disk encryption to PCs and you have a reasonable chance at defending. Oh, and if you're doing anything with credit cards, PCI DSS requires you to enforce a workstation locking policy. Failing to do so opens you up to massive liability in the event of a breach.

coffeefirst 6y ago

Right. There are some intense security environments where they also deal in airgaps and the like, but this is insane behavior at a regular job.

camjohnson26 6y ago

I agree, I’m sure it helps but seems like if a malicious coworker wants access they can trivially steal your password with a keylogger or just watching you type it in. May prevent spontaneous acts I guess but feels like if those are really a risk you’ve hired the wrong people.

josh3736 6y ago

It's actually a legitimate concern, and it goes far beyond coworkers embarrassing you in slack. For example, posted yesterday: https://tailscale.com/blog/rotate-ssh-keys/ https://tailscale.com/blog/rotate-ssh-keys/ (https://news.ycombinator.com/item?id=26249380 https://news.ycombinator.com/item?id=26249380) > One company had an employee they fired for bad behaviour. A few months later all their production servers got wiped out. ... A month later, it happened again! Everything gone. > What happened was that the rogue employee, months before they were fired, had waited until everyone went to lunch, walked around from one PC to the next, and collected the ssh private keys from any of them that weren’t locked. ... Then, a while after getting fired, he used a co-worker’s ssh key to login and destroy everything. Of course, screen locking would not prevent a determined, disgruntled (or desperate) employee from pulling off something like this, but it would stop the casual collection of secrets while everyone is at lunch. Add full disk encryption to PCs and you have a reasonable chance at defending. Oh, and if you're doing anything with credit cards, PCI DSS requires you to enforce a workstation locking policy. Failing to do so opens you up to massive liability in the event of a breach.