Security Manager's Journal: Better security for not quite everyone

Computerworld - It's scary to think how much sensitive or even valuable information can be gleaned from an untended PC, even one whose user just walked away for a few minutes. That's the sort of thing that security managers fret about but the rest of the world hardly notices.

And it's one of the reasons I'm on the verge of deploying a group policy to enforce a password-protected screen lock on every device used to log into my company's domain. The high-profile impetus for this policy change was the laptop thefts that I wrote about a while back, but just as compelling for me is our move to an open workspace. Maybe security managers just see vulnerabilities wherever they look, but an open workspace looks like a security nightmare to me. I've already seen too many employees simply walk away from their workstations on the open floor, leaving their e-mail, work documents or personal information readily visible on their screens.

With this policy change, users will no longer be able to alter any settings related to the password-protected screen lock other than their choice of screen saver. We've decided to set the lockout at 15 minutes, which I know will increase the overall security posture of the company, because until now users have been able to turn off the lockout entirely -- and several have done so. We know this because we recently did a query of the PCs attached to our domain, in order to ascertain how lockout was configured on them. We found that more than 70% of our approximately 6,000 users had disabled both the password requirement and the screen saver.

But that query presented me with a quandary. That's because we also found that some 1,500 users had strengthened their lockout policies by decreasing the time limit to less than the 10 minutes that we had used as a baseline configuration. So the new policy will represent a more lenient security setting for those 1,500 people, who no longer will be able to choose a time of less than 15 minutes. What concerns me is the message we will be sending to those employees. They have shown the sort of awareness of security issues that I try to instill in the entire workforce, and now we're rolling out a policy that seems to say that their security consciousness was unnecessary. We'll have to make sure that isn't the message they take away from this change.

Ahead of the Pack

When I proposed the change in our lockout policy to the CIO, he asked me to determine what other companies in our industry are doing. I have a pretty decent network of peers in this industry, so I asked them whether they enforce a screen lock -- and if so, what the timeout value is, and if not, what their policy regarding screen locks is. I was surprised by the results: Only one of the 20 companies in my survey enforces the screen lock. That wasn't the response I had anticipated, and it certainly wasn't what I wanted to report to the CIO. In the end, though, he agreed with me that this is one area where it's worth bucking the industry norm.

So we are moving forward, although I have agreed to allow certain exceptions to the policy. Employees eligible for exemptions include developers and users who frequently do presentations or hold online meetings. Exceptions will be executed by placing those users into a separate Active Directory group that won't have the screen lock policy applied.

Meanwhile, my efforts to educate the staff will continue. I will follow up the policy deployment by putting up posters to remind users that even though their screens now lock after 15 minutes of inactivity, they should still manually lock their screens whenever they step away from their PCs.

This week's journal is written by a real security manager, "Mathias Thurman," whose name and employer have been disguised for obvious reasons. Contact him at mathias_thurman@yahoo.com.

Join In

To join in the discussions about security, go to computerworld.com/blogs/security