Better security for not quite everyone

Valuable information can be gleaned from an untended PC...

It's scary to think how much sensitive or even valuable information can be gleaned from an untended PC, even one whose user just walked away for a few minutes. That's the sort of thing that security managers fret about but the rest of the world hardly notices.

And it's one of the reasons I'm on the verge of deploying a group policy to enforce a password-protected screen lock on every device used to log into my company's domain. The high-profile impetus for this policy change was the laptop thefts that I wrote about a while back, but just as compelling for me is our move to an open workspace. Maybe security managers just see vulnerabilities wherever they look, but an open workspace looks like a security nightmare to me. I've already seen too many employees simply walk away from their workstations on the open floor, leaving their e-mail, work documents or personal information readily visible on their screens.

With this policy change, users will no longer be able to alter any settings related to the password-protected screen lock other than their choice of screen saver. We've decided to set the lockout at 15 minutes, which I know will increase the overall security posture of the company, because until now users have been able to turn off the lockout entirely -- and several have done so. We know this because we recently did a query of the PCs attached to our domain, in order to ascertain how lockout was configured on them. We found that more than 70% of our approximately 6,000 users had disabled both the password requirement and the screen saver.

But that query presented me with a quandary. That's because we also found that some 1,500 users had strengthened their lockout policies by decreasing the time limit to less than the 10 minutes that we had used as a baseline configuration. So the new policy will represent a more lenient security setting for those 1,500 people, who no longer will be able to choose a time of less than 15 minutes. What concerns me is the message we will be sending to those employees. They have shown the sort of awareness of security issues that I try to instill in the entire workforce, and now we're rolling out a policy that seems to say that their security consciousness was unnecessary. We'll have to make sure that isn't the message they take away from this change.

Ahead of the Pack

When I proposed the change in our lockout policy to the CIO, he asked me to determine what other companies in our industry are doing. I have a pretty decent network of peers in this industry, so I asked them whether they enforce a screen lock -- and if so, what the timeout value is, and if not, what their policy regarding screen locks is. I was surprised by the results: Only one of the 20 companies in my survey enforces the screen lock. That wasn't the response I had anticipated, and it certainly wasn't what I wanted to report to the CIO. In the end, though, he agreed with me that this is one area where it's worth bucking the industry norm.

So we are moving forward, although I have agreed to allow certain exceptions to the policy. Employees eligible for exemptions include developers and users who frequently do presentations or hold online meetings. Exceptions will be executed by placing those users into a separate Active Directory group that won't have the screen lock policy applied.

Meanwhile, my efforts to educate the staff will continue. I will follow up the policy deployment by putting up posters to remind users that even though their screens now lock after 15 minutes of inactivity, they should still manually lock their screens whenever they step away from their PCs.

Trouble Ticket

At issue: Most users have disabled timed screen lockouts.

Action plan: Take away the option of disabling the lockouts.

This week's journal is written by a real security manager, "Mathias Thurman," whose name and employer have been disguised for obvious reasons. Contact him at

Join the newsletter!


Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Mathias Thurman

Computerworld (US)
Show Comments





Back To Business Guide

Click for more ›

Most Popular Reviews

Latest Articles


PCW Evaluation Team

Christopher Low

Brother RJ-4230B

This small mobile printer is exactly what I need for invoicing and other jobs such as sending fellow tradesman details or step-by-step instructions that I can easily print off from my phone or the Web.

Aysha Strobbe

Microsoft Office 365/HP Spectre x360

Microsoft Office continues to make a student’s life that little bit easier by offering reliable, easy to use, time-saving functionality, while continuing to develop new features that further enhance what is already a formidable collection of applications

Michael Hargreaves

Microsoft Office 365/Dell XPS 15 2-in-1

I’d recommend a Dell XPS 15 2-in-1 and the new Windows 10 to anyone who needs to get serious work done (before you kick back on your couch with your favourite Netflix show.)

Maryellen Rose George

Brother PT-P750W

It’s useful for office tasks as well as pragmatic labelling of equipment and storage – just don’t get too excited and label everything in sight!

Cathy Giles

Brother MFC-L8900CDW

The Brother MFC-L8900CDW is an absolute stand out. I struggle to fault it.

Luke Hill


I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Featured Content

Product Launch Showcase

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?