Better Security for Not Quite Everyone
It's scary to think how much sensitive or even valuable information can be gleaned from an untended PC, even one whose user just walked away for a few minutes. That's the sort of thing that security managers fret about but the rest of the world hardly notices.
Mon, November 02, 2009
Computerworld — It's scary to think how much sensitive or even valuable information can be gleaned from an untended PC, even one whose user just walked away for a few minutes. That's the sort of thing that security managers fret about but the rest of the world hardly notices.
Slideshow: Quiz: Separate Cyber Security Fact From Fiction
And it's one of the reasons I'm on the verge of deploying a group policy to enforce a password-protected screen lock on every device used to log into my company's domain. The high-profile impetus for this policy change was the laptop thefts that I wrote about a while back, but just as compelling for me is our move to an open workspace. Maybe security managers just see vulnerabilities wherever they look, but an open workspace looks like a security nightmare to me. I've already seen too many employees simply walk away from their workstations on the open floor, leaving their e-mail, work documents or personal information readily visible on their screens.
With this policy change, users will no longer be able to alter any settings related to the password-protected screen lock other than their choice of screen saver. We've decided to set the lockout at 15 minutes, which I know will increase the overall security posture of the company, because until now users have been able to turn off the lockout entirely -- and several have done so. We know this because we recently did a query of the PCs attached to our domain, in order to ascertain how lockout was configured on them. We found that more than 70% of our approximately 6,000 users had disabled both the password requirement and the screen saver.
But that query presented me with a quandary. That's because we also found that some 1,500 users had strengthened their lockout policies by decreasing the time limit to less than the 10 minutes that we had used as a baseline configuration. So the new policy will represent a more lenient security setting for those 1,500 people, who no longer will be able to choose a time of less than 15 minutes. What concerns me is the message we will be sending to those employees. They have shown the sort of awareness of security issues that I try to instill in the entire workforce, and now we're rolling out a policy that seems to say that their security consciousness was unnecessary. We'll have to make sure that isn't the message they take away from this change.
