5 ms·

Regarding number 5, one company I worked for had the donut rule: if you left your computer unlocked, everyone was within their rights to send an email to the wh

by thom 3y ago

Regarding number 5, one company I worked for had the donut rule: if you left your computer unlocked, everyone was within their rights to send an email to the whole company offering to buy everybody donuts. It was expected that you would follow through (with whatever treats you deemed appropriate, didn't have to be sugary stuff). Of course this highlighted the security advantages of using a DVORAK layout on your keyboard and only sending email with Emacs which probably wasn't the intended effect, but every little helps.

deleted 3y ago
[deleted]
p_l 3y ago
At one specific team we replaced the wallpaper with photos of David Hasselhof and sent email about treats. One admin proactively put a Baywatch photo as wallpaper : - )
- tjpnz 3y ago
  The support manager put a pornstar on mine. Only had to be taught that lesson once.
- dijit 3y ago
  It's possible we worked together. We also "got Hoffed".
  - smithcoin 3y ago
    It’s possible we worked together as well- right across from the opera house?
  - embik 3y ago
    My experience is that the Hoff transcends company, language and country boundaries.
- yencabulator 3y ago
  My standard move was to change the background and set the screen to auto-lock after as little idle as the desktop environment would let me. The victim usually immediately saw the background, but the auto-lock change usually remained unnoticed and kept triggering for a few days... Hey, I'm just trying to prevent the problem from reoccurring!
MattPalmer1086 3y ago
Haha, had the same in my last place. At another place I worked, the devs took a screenshot of their desktop and made it the lock screen image, so it looked like it was unlocked, just to annoy security (i.e. me!).
- rft 3y ago
  Same, I even put a Thunderbird "New Message" window on mine just to be extra "attractive". Had an extra keybind for that, just in case I need to take my laptop to a customer. Overall the "buy treats for the office" rule helped to establish the habit even though I think we never followed through with it. We mostly just told newcomers that this is the rule and they locked their screen as expected. And ofc it turned "Hey, lock your screen!" into "Oh, you want to treat us?" which makes for a more cheerful way to remind people.
tallanvor 3y ago
To me that's kind of silly. Don't get me wrong, I lock my computer whenever I leave the room, but there should be a certain level of trust among coworkers assuming you aren't actually working on classified stuff (or if you have access to HR data).
- dijit 3y ago
  I couldn't possibly disagree more. You are legally liable for the messages you send; the access rights you have etc; This is why shared accounts are one of the first thing a CISO/CIO will try to kill. It makes liability lie with the company and not the individual. You will not be able to hide behind the fact you refuse or fail to secure your devices if someone sends a threatening message from your email account or if someone deletes the prod database. Where shared credentials are required there is usually an access log associated: which ties individual named accounts to shared access rights in the event of eDiscovery or forensics. Some trust is good, but if we really believed in trust then we wouldn't even both having access accounts with our names on them.
- joncp 3y ago
  You’re assuming that everyone in the office is a coworker. I recommend Deviant Ollam’s YouTube channel for an entertaining way to expand your assumptions
  - michaelt 3y ago
    Eh, if the physical security isn't good enough you'll have laptops going missing whether they're encrypted or not. There's a lot more opportunist thieves who'll snatch a laptop than there are industrial espionage spies rappelling down your elevator shaft or whatever. The real reason for the policy is so when some dumbass sends a dick pic from their work computer and gets fired for it, they can't claim "it wasn't me" and expect to keep their job.
guappa 3y ago
Your coworkers can just film you while you type the password to unlock the screen. And of course if the machine is running the decryption key for the disk is located in the RAM. If you can't trust your coworkers in the same office, you should absolutely have private rooms that get locked, and shut down your machine completely every time you leave it.
- daniel_iversen 3y ago
  It's not about trusting coworkers, it's about creating the right security habits so you don't leave your computer unlocked in situations where it is easily compromised. And it's about closing of the easiest attack vectors (open laptops, reused or simple passwords etc) not about nation-state level hacking possibilities :)
  - deleted 3y ago
    [deleted]
- lazide 3y ago
  Trusting co-workers has nothing to do with it. Any random person walking by could do it - cleaning staff, maintenance folks, a guest or visitor, someone ‘surfing’ in behind someone, etc. And it gives some incentive to everyone to watch each others backs and keep each other honest. Which is how actual trust gets built IMO. Knowing someone will catch and make sure you know you screwed up on something important before it became a bigger problem, rather than ignoring it and letting it fester. Higher stakes areas, but most military combat MOS, LEO, skydiving, and climbing groups do similar things - always check that everyone around you has their act together (and give them shit if they miss something) so that there isn’t something serious that gets missed and gets someone or the group killed. Or in this case, something serious gets missed and the company gets ‘killed’. Think of it as tough love. And if they can dish it out, they’d better be able to take it or that is a whole nother level of ribbing that’s coming.
  - guappa 3y ago
    > Trusting co-workers has nothing to do with it. Any random person walking by could do it - cleaning staff, maintenance folks, a guest or visitor, someone ‘surfing’ in behind someone, etc. Precisely. So if you want to be safe, shut down completely the machine. Then all of the people you listed can't access it.
michaelt 3y ago
> if you left your computer unlocked, everyone was within their rights to send an email to the whole company offering to buy everybody donuts. It was expected that you would follow through Ah yes, the excellent security practice that if you see someone messing with someone else's equipment that's completely normal - praiseworthy, even - and if you don't challenge them on it, you get donuts.
antman 3y ago
That is funny in my case the chief of security used my computer to send an invitation to everybody to buy farewell drinks because of my resignation, fun times. (no harm done we are fun people)
x0x0 3y ago
It's probably better to just install an MDM. This lets you do ongoing reporting re: is disk encryption active, how long is the timeout for screen locking, etc. And to remote lock the device.
cypherg 3y ago
it's the company's policy that should enforce automatic screen locks, not relying on an error prone human

by thom 3y ago

deleted 3y ago

[deleted]

p_l 3y ago

At one specific team we replaced the wallpaper with photos of David Hasselhof and sent email about treats. One admin proactively put a Baywatch photo as wallpaper : - )

tjpnz 3y ago
The support manager put a pornstar on mine. Only had to be taught that lesson once.
dijit 3y ago
It's possible we worked together. We also "got Hoffed".
- smithcoin 3y ago
  It’s possible we worked together as well- right across from the opera house?
- embik 3y ago
  My experience is that the Hoff transcends company, language and country boundaries.
yencabulator 3y ago
My standard move was to change the background and set the screen to auto-lock after as little idle as the desktop environment would let me. The victim usually immediately saw the background, but the auto-lock change usually remained unnoticed and kept triggering for a few days... Hey, I'm just trying to prevent the problem from reoccurring!

MattPalmer1086 3y ago

Haha, had the same in my last place. At another place I worked, the devs took a screenshot of their desktop and made it the lock screen image, so it looked like it was unlocked, just to annoy security (i.e. me!).

rft 3y ago
Same, I even put a Thunderbird "New Message" window on mine just to be extra "attractive". Had an extra keybind for that, just in case I need to take my laptop to a customer. Overall the "buy treats for the office" rule helped to establish the habit even though I think we never followed through with it. We mostly just told newcomers that this is the rule and they locked their screen as expected. And ofc it turned "Hey, lock your screen!" into "Oh, you want to treat us?" which makes for a more cheerful way to remind people.

tallanvor 3y ago

To me that's kind of silly. Don't get me wrong, I lock my computer whenever I leave the room, but there should be a certain level of trust among coworkers assuming you aren't actually working on classified stuff (or if you have access to HR data).

dijit 3y ago
I couldn't possibly disagree more. You are legally liable for the messages you send; the access rights you have etc; This is why shared accounts are one of the first thing a CISO/CIO will try to kill. It makes liability lie with the company and not the individual. You will not be able to hide behind the fact you refuse or fail to secure your devices if someone sends a threatening message from your email account or if someone deletes the prod database. Where shared credentials are required there is usually an access log associated: which ties individual named accounts to shared access rights in the event of eDiscovery or forensics. Some trust is good, but if we really believed in trust then we wouldn't even both having access accounts with our names on them.
joncp 3y ago
You’re assuming that everyone in the office is a coworker. I recommend Deviant Ollam’s YouTube channel for an entertaining way to expand your assumptions
- michaelt 3y ago
  Eh, if the physical security isn't good enough you'll have laptops going missing whether they're encrypted or not. There's a lot more opportunist thieves who'll snatch a laptop than there are industrial espionage spies rappelling down your elevator shaft or whatever. The real reason for the policy is so when some dumbass sends a dick pic from their work computer and gets fired for it, they can't claim "it wasn't me" and expect to keep their job.

guappa 3y ago

Your coworkers can just film you while you type the password to unlock the screen. And of course if the machine is running the decryption key for the disk is located in the RAM. If you can't trust your coworkers in the same office, you should absolutely have private rooms that get locked, and shut down your machine completely every time you leave it.

daniel_iversen 3y ago
It's not about trusting coworkers, it's about creating the right security habits so you don't leave your computer unlocked in situations where it is easily compromised. And it's about closing of the easiest attack vectors (open laptops, reused or simple passwords etc) not about nation-state level hacking possibilities :)
- deleted 3y ago
  [deleted]
lazide 3y ago
Trusting co-workers has nothing to do with it. Any random person walking by could do it - cleaning staff, maintenance folks, a guest or visitor, someone ‘surfing’ in behind someone, etc. And it gives some incentive to everyone to watch each others backs and keep each other honest. Which is how actual trust gets built IMO. Knowing someone will catch and make sure you know you screwed up on something important before it became a bigger problem, rather than ignoring it and letting it fester. Higher stakes areas, but most military combat MOS, LEO, skydiving, and climbing groups do similar things - always check that everyone around you has their act together (and give them shit if they miss something) so that there isn’t something serious that gets missed and gets someone or the group killed. Or in this case, something serious gets missed and the company gets ‘killed’. Think of it as tough love. And if they can dish it out, they’d better be able to take it or that is a whole nother level of ribbing that’s coming.
- guappa 3y ago
  > Trusting co-workers has nothing to do with it. Any random person walking by could do it - cleaning staff, maintenance folks, a guest or visitor, someone ‘surfing’ in behind someone, etc. Precisely. So if you want to be safe, shut down completely the machine. Then all of the people you listed can't access it.

michaelt 3y ago

> if you left your computer unlocked, everyone was within their rights to send an email to the whole company offering to buy everybody donuts. It was expected that you would follow through Ah yes, the excellent security practice that if you see someone messing with someone else's equipment that's completely normal - praiseworthy, even - and if you don't challenge them on it, you get donuts.

antman 3y ago

That is funny in my case the chief of security used my computer to send an invitation to everybody to buy farewell drinks because of my resignation, fun times. (no harm done we are fun people)

x0x0 3y ago

It's probably better to just install an MDM. This lets you do ongoing reporting re: is disk encryption active, how long is the timeout for screen locking, etc. And to remote lock the device.

cypherg 3y ago

it's the company's policy that should enforce automatic screen locks, not relying on an error prone human