That's pretty terrible opsec. It presents a risk to separation of roles / compartmentalization if a coworker can walk over to your workstation and have access to it, to say nothing of malicious access by somebody who shouldn't be in the office in the first place.

If locking your computer in the office is required opsec, then you have already lost. First, you shouldn't have random people walking around the office. Once someone has physical access the battle is already over. Second, rogue employees are still rogue employees, and an unlocked computer is the least of your worries.

With that said, I always lock my computer out of habit.

Not sure what size company you're working in nor what the requirements for opsec are their nor your privilege levels but it certainly does not mean you have already lost.

Security requires a threat model to rise above theatre. If there are operations threats to your organization, then you need opsec to mitigate those threats. Is China or someone else trying to steal your trade secrets?

If so, I would hope the responsibility for setting opsec policy isn't resting in one sysadmin.

> Is China or someone else trying to steal your trade secrets?

Or more prosaically, do you have any semi-confidential e-mail on your machine, that a coworker might fancy reading?

If you can't trust your coworkers not to go snooping on your machine while you're not there, then you should find a better job. Threat models balloon in complexity when you can't use tools like zones of trust and choke points.

I'd argue that the coworkers that are the most dangerous are the ones you do trust. :)

Then why have it lock at all? You must never have access to critical things like a bank account, source code, internal documentation of business ongoings. So basically if you have no sensitive information, by all means!

Sure I have. And so did everyone else in my group. If you can't trust the people who you work with... In the middle of the day someone will notice someone else using your computer. If no one does then the camera overhead will.

That's passive vs. active security. You can always go back and figure something out, but why allow for the potential at all? It's this type of attitude that continues to have developers ignore basic best practices around security when writing code.

It's all a series of defenses, the last one you should ever rely on is piecing together what happened by video camera... what happens when they install a root user, or ssh authorized key on your system and then do whatever they want at some other time?

"I don't lock my computer."

This is a fire-able offense where I work.

That's a metric I use to know when it's time to change jobs: if I can't trust the people around me not to mess with my computer (or there's too many people to trust the environment) then it's time to move on.

This seems like an insane metric. For any large enough organization that is difficult to identify who actually works for $company and who is there on "business" - and given that its rare for every developer to have a locked door, you can easily have a situation where a "guest" (maybe a software vendor, or partner, or friend of coworker) is on their way to the bathroom and decides to poke around on your machine.

Barring myself from working at an company with more than ~150 people (Dunbar's number) because I'm too pompous to lock my laptop doesn't seem like a metric one would be wise to follow.

> This seems like an insane metric. For any large enough organization that is difficult to identify who actually works for $company and who is there on "business" - and given that its rare for every developer to have a locked door, you can easily have a situation where a "guest" (maybe a software vendor, or partner, or friend of coworker) is on their way to the bathroom and decides to poke around on your machine.

This is like bricking up all your windows against thieves when you live in sleepy, low-crime suburbia.

Site security needs to have a balance between paranoia and practicality. For public-facing code, history has shown us that it's impossible to be too paranoid. If you work in national security, or your industry is known to be a target for industrial espionage, then certainly strong precautions are in order.

But if you're just building social media sites or whatever, and you're firing people because they failed to stand ever vigilant against the possibility that Bob the visiting vendor rep might stalk the corridors waiting for you to take a bathroom break so he can rifle through your code for exploits to sell to teh haxxorz, you are being absurd.

I agree. If you cannot trust your co-workers/employees to the point where every computer has to be locked when someone leaves their desk then it is time to move on. If there are rogue employees then the battle is already lost and a locked computer isn't going to slow anyone down.

I always make sure to change the operating system language to Chinese whenever somebody leaves the computer unlocked so that employees like you either leave the company or learn the basis of security.

That's a also metric I use when I choose service providers. If every employee is allowed to abuse any other employee's credentials to access my private data, move on.

On my team, you would surely say many things about ponies in our internal chat.

Seems like a harmless prank to me.