Unlocked Workstations
An awake screen is a signed-in session with a name on it.
What Is Unlocked Workstations?
A screen left awake is not an idle monitor, it is a live session that will never ask for the password again. In this exercise a colleague steps out with his workstation signed in while the evening cleaner works at his desk, and a shared login sits on the team whiteboard where the whole room can read it. You practise locking someone else's machine, erasing the credential, and asking for the automatic lock that works on the evenings nobody is watching.
What You'll Learn in Unlocked Workstations
- Read an unlocked screen as an authenticated session rather than as a monitor that happens to be switched on
- Lock a colleague's unattended workstation and tell them, instead of deciding it is somebody else's business
- Separate the trustworthiness of the person standing there from the exposure of an open session on an empty floor
- Treat a shared credential written in a shared room as compromised, so it is changed as well as erased
- Ask for an automatic screen lock as the control that holds when nobody is there to notice
Unlocked Workstations — Training Steps
-
Ten To Seven
Thursday evening at Orrowdale Studios. Most of the floor went home at six, and Alice is finishing the last of the Halden artwork with the lights already half off. An email lands from Tom Ellerby, the art director, who sits across from her.
-
What He Left On
Tom's chair is pushed back and his coat is gone, but his monitor is still awake across the room. No lock screen, no password prompt, just his desktop where he left it. Behind Alice, the studio board still carries this week's jobs in marker.
-
The Floor Is Not Empty
A trolley comes through the door at the front of the studio. The cleaner works her way round the room, emptying bins and wiping down, and stops at the desk across from Alice. Tom's desk. With Tom's screen awake on it.
-
Who She Is
Worth looking at the card round her neck before anything else, because it answers the question most people would rather not ask out loud.
-
Tuesdays And Thursdays
She has been doing this floor twice a week since the spring, and she is entirely used to finding one person still at a desk at seven.
-
The Screen Beside Her
Nothing about Rosa is a threat, and treating her like one would be both rude and beside the point. The thing on the desk beside her is still Tom's open session, and it will still be open when she has gone upstairs and the lights are off and the floor belongs to whoever has a key.
-
Two Steps Across The Floor
Rosa says of course and rolls the trolley back into the middle of the floor so Alice can get to the desk. Alice locks Tom's machine. The whole thing takes about as long as saying it does, and the screen goes to his lock screen. Nothing of his is lost, and he will be back in front of it in ten minutes.
-
Down To The Far End
Rosa finishes the desks and moves down the studio with the trolley, towards the glass at the far end. Which puts her in front of the board.
-
Read The Board
Alice has walked past this board twice a day since March and stopped reading it months ago. Worth reading it now, the way somebody seeing it for the first time would: Halden Foods, packaging, artwork to print 2 Dec. A client by name and a date nobody outside the studio has. Verrow Gardens, rebrand, logo review Friday. A second client, and the fact that their identity is being redrawn. The shared login for the asset library, in red, between the two.
-
Wipe The Line
The jobs can stay. The line in the middle cannot: it is the password four freelancers and everyone in this room use to get at the artwork library, written out in marker at head height. Rosa is a metre away from it with a cloth, and has said herself that she never touches the writing.
Security Framework Coverage
CWE
- CWE-522 Insufficiently Protected Credentials
MITRE ATT&CK
- T1078 Valid Accounts
CIS Controls
- CIS 14.5 Train Workforce Members on Causes of Unintentional Data Exposure
- CIS 4 Secure Configuration of Enterprise Assets and Software
- CIS 14.3 Train Workforce Members on Authentication Best Practices
NIST CSF
- PR.AT-01 Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind
- PR.PS Platform Security