25 ms·

There is a OPSEC fairy at work who will rotate your desktop 90 or 180 degrees or some other benign reminder that you failed to secure your workstation before le

by black6 5y ago

There is a OPSEC fairy at work who will rotate your desktop 90 or 180 degrees or some other benign reminder that you failed to secure your workstation before leaving your desk.

4ggr0 5y ago
We would send a mail from their pc to the whole team with a text along the lines of "Hey together, I will buy croissants for everyone tomorrow." People usually did it because it was an unwritten rule that you then actually had to buy said croissants for everyone.
- gjvc 5y ago
  see, now that's more like it -- croissant supply pranks I can get behind; meddling (however slight) with tools, not so much.
  - 4ggr0 5y ago
    Well, we had both extremes, just to disclose that. The mild version was promising croissants with another mail account, but I also once came back to see that my wallpaper had been changed to a still from a gay porn movie. I think my visible confusion and slight shock was quite entertaining. Of course the second prank can only be done with co-workers you know well, otherwise you could probably end up having to talk to HR.
coldpie 5y ago
Secure from what? Do you have random people walking around your office?
- kevinmchugh 5y ago
  I've worked in offices big enough that the people who worked upstairs looked were total strangers to me. Social engineering into a building is often not that hard.
nostoc 5y ago
For anyone who reads this and think it's funny, it is, but do this in the wrong workplace and you'll be the unemployed OPSEC fairy.
- jtms 5y ago
  If someone is in OPSEC they generally have a broad license to actually, you know, do their job.
  - nostoc 5y ago
    The "OPSEC fairy" as referenced in previous post is typically a random coworker, so no, they generally not have a broad license do tinker with your workstation. An actual OPSEC person would not go and change your desktop's background, or send an email for free donuts to all your coworkers. An actual OPSEC person would just write you up for a security violation.
Moodles 5y ago
People did something similar to this at my previous job and I always thought it was security theatre. For one thing, there are card swipe in. Second, engineering was upstairs in a restricted area. So you're concerned about a tailgater who opportunistically puts malware on your laptop when you're 100 feet away for a couple minutes without anyone noticing? Or you're concerned about a colleague who's an insider threat... Who is already an insider threat? It's not like there was anything on my laptop which was more sensitive than any other engineer there anyway. It was classic busywork.
- kevinmchugh 5y ago
  It's often easier to build a norm for everyone than just the people it really needs to apply to. Managers, salespeople, corp dev, customer representatives all might have sensitive information on their machines. Information that even other employees aren't supposed to see. Rather than trying to enumerate who those people are and teach them, you might assume everyone will eventually have sensitive information, and encourage the mild prank.

by black6 5y ago

There is a OPSEC fairy at work who will rotate your desktop 90 or 180 degrees or some other benign reminder that you failed to secure your workstation before leaving your desk.

4ggr0 5y ago

We would send a mail from their pc to the whole team with a text along the lines of "Hey together, I will buy croissants for everyone tomorrow." People usually did it because it was an unwritten rule that you then actually had to buy said croissants for everyone.

gjvc 5y ago
see, now that's more like it -- croissant supply pranks I can get behind; meddling (however slight) with tools, not so much.
- 4ggr0 5y ago
  Well, we had both extremes, just to disclose that. The mild version was promising croissants with another mail account, but I also once came back to see that my wallpaper had been changed to a still from a gay porn movie. I think my visible confusion and slight shock was quite entertaining. Of course the second prank can only be done with co-workers you know well, otherwise you could probably end up having to talk to HR.

coldpie 5y ago

Secure from what? Do you have random people walking around your office?

kevinmchugh 5y ago
I've worked in offices big enough that the people who worked upstairs looked were total strangers to me. Social engineering into a building is often not that hard.

nostoc 5y ago

For anyone who reads this and think it's funny, it is, but do this in the wrong workplace and you'll be the unemployed OPSEC fairy.

jtms 5y ago
If someone is in OPSEC they generally have a broad license to actually, you know, do their job.
- nostoc 5y ago
  The "OPSEC fairy" as referenced in previous post is typically a random coworker, so no, they generally not have a broad license do tinker with your workstation. An actual OPSEC person would not go and change your desktop's background, or send an email for free donuts to all your coworkers. An actual OPSEC person would just write you up for a security violation.

Moodles 5y ago

People did something similar to this at my previous job and I always thought it was security theatre. For one thing, there are card swipe in. Second, engineering was upstairs in a restricted area. So you're concerned about a tailgater who opportunistically puts malware on your laptop when you're 100 feet away for a couple minutes without anyone noticing? Or you're concerned about a colleague who's an insider threat... Who is already an insider threat? It's not like there was anything on my laptop which was more sensitive than any other engineer there anyway. It was classic busywork.

kevinmchugh 5y ago
It's often easier to build a norm for everyone than just the people it really needs to apply to. Managers, salespeople, corp dev, customer representatives all might have sensitive information on their machines. Information that even other employees aren't supposed to see. Rather than trying to enumerate who those people are and teach them, you might assume everyone will eventually have sensitive information, and encourage the mild prank.