Hacker News Reader

Comment by akerl_ | Hacker News Reader

That's pretty terrible opsec. It presents a risk to separation of roles / compartmentalization if a coworker can walk over to your workstation and have access to it, to say nothing of malicious access by somebody who shouldn't be in the office in the first place.

View on HN

If locking your computer in the office is required opsec, then you have already lost. First, you shouldn't have random people walking around the office. Once someone has physical access the battle is already over. Second, rogue employees are still rogue employees, and an unlocked computer is the least of your worries.

With that said, I always lock my computer out of habit.

Not sure what size company you're working in nor what the requirements for opsec are their nor your privilege levels but it certainly does not mean you have already lost.

Security requires a threat model to rise above theatre. If there are operations threats to your organization, then you need opsec to mitigate those threats. Is China or someone else trying to steal your trade secrets?

If so, I would hope the responsibility for setting opsec policy isn't resting in one sysadmin.

> Is China or someone else trying to steal your trade secrets?

Or more prosaically, do you have any semi-confidential e-mail on your machine, that a coworker might fancy reading?

If you can't trust your coworkers not to go snooping on your machine while you're not there, then you should find a better job. Threat models balloon in complexity when you can't use tools like zones of trust and choke points.

I'd argue that the coworkers that are the most dangerous are the ones you do trust. :)

Reply on news.ycombinator.com