Encryption & Lock Discipline

Practice the habits that protect unattended devices.

What Is Encryption & Lock Discipline?

Device encryption converts your data into unreadable code that can only be unlocked with the correct credentials. Full disk encryption (using BitLocker on Windows or FileVault on macOS) protects everything on your hard drive. If a laptop is stolen or lost, an encrypted drive is essentially a brick to the thief. An unencrypted drive can be read by anyone with a $20 USB adapter and five minutes of free time. This simulation begins with a common situation: you step away from your desk to grab coffee, leaving your laptop open and unlocked in a shared workspace. The exercise fast-forwards through what an attacker can accomplish in the 90 seconds you are gone. Reading your email. Copying files to a USB drive. Installing a keylogger. Accessing your company VPN because your session is still active. It takes less time than you think. You will practice the habits that prevent both opportunistic theft and targeted attacks against your devices. The exercise covers configuring automatic screen lock timers (the recommended maximum is 5 minutes, but 1-2 minutes is better for shared environments), setting strong device passwords that differ from your network credentials, and verifying that full disk encryption is actually enabled on your machine. The simulation also addresses scenarios beyond the office. Working from a hotel lobby, leaving a phone in a rideshare, or having a bag stolen at an airport. Each scenario reinforces a simple principle: encryption protects data at rest, and screen locking protects data when you are nearby but not paying attention. Both are necessary. Neither is optional.

What You'll Learn in Encryption & Lock Discipline

Encryption & Lock Discipline — Training Steps

  1. A Busy Morning at Cascade Financial

    It's a busy Thursday morning — you're reviewing three client portfolios ahead of quarterly review meetings this afternoon.

  2. Reviewing Client Portfolios

    Alice opens the internal client portal to review the Henderson, Park, and Okafor accounts. She logs in and pulls up the portfolio dashboard.

  3. An Urgent Phone Call

    Alice's phone rings. It's David Chen from the Henderson account — he needs the Q3 performance summary urgently for a board meeting that was moved up to this afternoon. The physical file is in the records room down the hall.

  4. Rushing to the Records Room

    David needs that file NOW. Alice jumps up from her desk, grabbing her badge. In her rush, she completely forgets to lock her workstation. The client portfolio data — Henderson, Park, and Okafor accounts — remains fully visible on screen. Three client portfolios. Wide open. Anyone walking by can see everything.

  5. Back at Your Desk

    Alice returns with the Henderson file. Her screen is exactly as she left it — portfolios still visible, nothing seems disturbed. She doesn't think twice about it. She sends David the information he needs and continues her day.

  6. A Normal Week Passes

    One week later. Alice is starting her Monday morning when an email from IT Security stops her cold.

  7. The Incident Report

    The email is devastating. Three of Alice's clients — Henderson, Park, and Okafor — reported receiving targeted phishing emails containing their exact portfolio details. The data exposure was traced to Alice's workstation.

  8. What Happened While You Were Gone

    The incident report reveals exactly what happened during those 5 minutes Alice was away. Security camera footage and badge scan logs paint a clear picture.

  9. The Damage

    The impact assessment shows the full scope of the damage. What seemed like a harmless 5-minute absence has become a serious security incident.

  10. What Should Alice Have Done?

    Before continuing to remediation, let's reflect on what went wrong.