Slideshow: Quiz: Separate Cyber Security Fact From Fiction

And it's one of the reasons I'm on the verge of deploying a group policy to enforce a password-protected screen lock on every device used to log into my company's domain. The high-profile impetus for this policy change was the laptop thefts that I wrote about a while back, but just as compelling for me is our move to an open workspace. Maybe security managers just see vulnerabilities wherever they look, but an open workspace looks like a security nightmare to me. I've already seen too many employees simply walk away from their workstations on the open floor, leaving their e-mail, work documents or personal information readily visible on their screens.

With this policy change, users will no longer be able to alter any settings related to the password-protected screen lock other than their choice of screen saver. We've decided to set the lockout at 15 minutes, which I know will increase the overall security posture of the company, because until now users have been able to turn off the lockout entirely -- and several have done so. We know this because we recently did a query of the PCs attached to our domain, in order to ascertain how lockout was configured on them. We found that more than 70% of our approximately 6,000 users had disabled both the password requirement and the screen saver.

But that query presented me with a quandary. That's because we also found that some 1,500 users had strengthened their lockout policies by decreasing the time limit to less than the 10 minutes that we had used as a baseline configuration. So the new policy will represent a more lenient security setting for those 1,500 people, who no longer will be able to choose a time of less than 15 minutes. What concerns me is the message we will be sending to those employees. They have shown the sort of awareness of security issues that I try to instill in the entire workforce, and now we're rolling out a policy that seems to say that their security consciousness was unnecessary. We'll have to make sure that isn't the message they take away from this change.