Better security for not quite everyone

Valuable information can be gleaned from an untended PC...

It's scary to think how much sensitive or even valuable information can be gleaned from an untended PC, even one whose user just walked away for a few minutes. That's the sort of thing that security managers fret about but the rest of the world hardly notices.

And it's one of the reasons I'm on the verge of deploying a group policy to enforce a password-protected screen lock on every device used to log into my company's domain. The high-profile impetus for this policy change was the laptop thefts that I wrote about a while back, but just as compelling for me is our move to an open workspace. Maybe security managers just see vulnerabilities wherever they look, but an open workspace looks like a security nightmare to me. I've already seen too many employees simply walk away from their workstations on the open floor, leaving their e-mail, work documents or personal information readily visible on their screens.

With this policy change, users will no longer be able to alter any settings related to the password-protected screen lock other than their choice of screen saver. We've decided to set the lockout at 15 minutes, which I know will increase the overall security posture of the company, because until now users have been able to turn off the lockout entirely -- and several have done so. We know this because we recently did a query of the PCs attached to our domain, in order to ascertain how lockout was configured on them. We found that more than 70% of our approximately 6,000 users had disabled both the password requirement and the screen saver.

But that query presented me with a quandary. That's because we also found that some 1,500 users had strengthened their lockout policies by decreasing the time limit to less than the 10 minutes that we had used as a baseline configuration. So the new policy will represent a more lenient security setting for those 1,500 people, who no longer will be able to choose a time of less than 15 minutes. What concerns me is the message we will be sending to those employees. They have shown the sort of awareness of security issues that I try to instill in the entire workforce, and now we're rolling out a policy that seems to say that their security consciousness was unnecessary. We'll have to make sure that isn't the message they take away from this change.

Ahead of the Pack

When I proposed the change in our lockout policy to the CIO, he asked me to determine what other companies in our industry are doing. I have a pretty decent network of peers in this industry, so I asked them whether they enforce a screen lock -- and if so, what the timeout value is, and if not, what their policy regarding screen locks is. I was surprised by the results: Only one of the 20 companies in my survey enforces the screen lock. That wasn't the response I had anticipated, and it certainly wasn't what I wanted to report to the CIO. In the end, though, he agreed with me that this is one area where it's worth bucking the industry norm.

So we are moving forward, although I have agreed to allow certain exceptions to the policy. Employees eligible for exemptions include developers and users who frequently do presentations or hold online meetings. Exceptions will be executed by placing those users into a separate Active Directory group that won't have the screen lock policy applied.

Meanwhile, my efforts to educate the staff will continue. I will follow up the policy deployment by putting up posters to remind users that even though their screens now lock after 15 minutes of inactivity, they should still manually lock their screens whenever they step away from their PCs.

Trouble Ticket

At issue: Most users have disabled timed screen lockouts.

Action plan: Take away the option of disabling the lockouts.

This week's journal is written by a real security manager, "Mathias Thurman," whose name and employer have been disguised for obvious reasons. Contact him at

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection

Tags security

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Mathias Thurman

Computerworld (US)
Show Comments

Cool Tech

Breitling Superocean Heritage Chronographe 44

Learn more >

SanDisk MicroSDXC™ for Nintendo® Switch™

Learn more >

Toys for Boys

Family Friendly

Panasonic 4K UHD Blu-Ray Player and Full HD Recorder with Netflix - UBT1GL-K

Learn more >

Stocking Stuffer

Razer DeathAdder Expert Ergonomic Gaming Mouse

Learn more >

Christmas Gift Guide

Click for more ›

Most Popular Reviews

Latest Articles


PCW Evaluation Team

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?