3 ms·

So what you do is take a screenshot of whatever's open on their computer, close it, then set the screenshot as their desktop wallpaper. Also hide their icons fo

So what you do is take a screenshot of whatever's open on their computer, close it, then set the screenshot as their desktop wallpaper. Also hide their icons for good measure. This should start a cycle of escalation and retaliation that eventually gets the whole office locking their PCs.

ziddoap 6y ago
In the past, for me, this has caused needless friction and fostered an adversarial relationship between IT/security staff and everyone else. We weighed our options and decided that it was a battle we would rather not waste our effort and risk staff animosity with. When a more serious security incident occurs, or when we decide to implement something else that may require staff effort, we believe that our staff will be more willing to work with us towards a solution. Sometimes with security policy, a little give (proportional to risk analysis) can go a long way with non-technical staff. I'd rather work with staff to come up with processes that work for both the security staff and all other staff members than become so rigid in my security policy that I may inadvertently alienate the security staff - which has many risks itself.
- filoleg 6y ago
  It can be done in a bit less adversarial and nicer way than making them deal with an annoyance of "troubleshooting" their desktop. Which, I found, makes things much easier and more frictionless. In my old office, we had this team "tradition" that was supposed to encourage people to lock their desktops. If they left their office for whatever reason and left their desktop unlocked, anyone from the team jumps up to the machine. Then they send an email to the rest of the team on behalf of the person who left their desktop unlocked, saying that they are bringing cookies to share with the team tomorrow. It worked out well for quite a few years, with people being more mindful about locking their machines. And their "punishment" for not doing so was just sharing cookies with the rest of the team the day after and hearing a couple of jokes about the situation. Overall, very positive experience, no one got upset about anything, because their machines themselves weren't screwed with, their work productivity wasn't lost due to it, and everyone shared a moment and baked goods.

ziddoap 6y ago

In the past, for me, this has caused needless friction and fostered an adversarial relationship between IT/security staff and everyone else. We weighed our options and decided that it was a battle we would rather not waste our effort and risk staff animosity with. When a more serious security incident occurs, or when we decide to implement something else that may require staff effort, we believe that our staff will be more willing to work with us towards a solution. Sometimes with security policy, a little give (proportional to risk analysis) can go a long way with non-technical staff. I'd rather work with staff to come up with processes that work for both the security staff and all other staff members than become so rigid in my security policy that I may inadvertently alienate the security staff - which has many risks itself.

filoleg 6y ago
It can be done in a bit less adversarial and nicer way than making them deal with an annoyance of "troubleshooting" their desktop. Which, I found, makes things much easier and more frictionless. In my old office, we had this team "tradition" that was supposed to encourage people to lock their desktops. If they left their office for whatever reason and left their desktop unlocked, anyone from the team jumps up to the machine. Then they send an email to the rest of the team on behalf of the person who left their desktop unlocked, saying that they are bringing cookies to share with the team tomorrow. It worked out well for quite a few years, with people being more mindful about locking their machines. And their "punishment" for not doing so was just sharing cookies with the rest of the team the day after and hearing a couple of jokes about the situation. Overall, very positive experience, no one got upset about anything, because their machines themselves weren't screwed with, their work productivity wasn't lost due to it, and everyone shared a moment and baked goods.