Navigation

Why do I have to log on?

Submitted by Kai on Wed, 2008-03-05 18:20.

I am having great fun when I train people. I ramble on with all the great stuff in the book (or in my world). If you've ever been to one of my workshops, you know I do the ramble - you do the work ;)

As happens with everyone giving some kind of lectures, you get to answer loads of questions. And today, I will share a couple. Keep in mind I am the one answering, so you might not agree. That is fine too - leave your comments :)

1. Why do I have to log on to my computer again every time I leave for a ... (insert tea, smoke, donut, coffee or just about anything).

Short A: To make sure you remember it!

Long A: This is the IT-security dept. idea of creating a secure work environment. They assume that when you leave for (insert whatever you leave for here), someone might pop by and use your computer. And they might be right.

To you, this is a hassle. You need to type in your password every time. That is hard work. (Seriously).

On the other hand, if someone would love to use your computer, they would most likely hide out in the neighboring cubicle, waiting for you to leave for your (insert whatever), and then pop into your seat the minute you leave. Because the log-on happens after a while - usually 10 minutes - of inactivity. Thus, it does not really make a sense IMO.

On the other hand, forcing you to type your password that often means you learn it, right? No more post-it notes.

My solution to these challenges is simple. Add biometrics, or smart card. Let the technology do the work, and take the hassle out of way. IT is designed by geeks, for geeks. We tend to forget that today (2008) most IT-users are human - not geeks.

We need to adopt IT to them - not try to make geeks out of ordinary people. That will never work.

But - until your employer implement smart cards or biometrics, you are stuck with the password.

 

2. What is this GHz, Gb, RAM, HD letters things?

Short A: Nothing you need to care about.

Long A: Look it up. They give you hints about a computers performance. The higher the numbers, the better. You need to be a geek to really care.

All new computers today will do everything most people with throw at them. Happily. Without hesitation. Only when you throw specialist applications (games, 3D, design tools, programming etc.), will you encounter a certain level of hesitation from your computer. But hey - did I just say specialist applications? That implies geek to me.

If you are doing specialist work with a computer, you already know the abbreviations above, and will be able to make the right choice.

If you are not a specialist, you do not need to care. Period.

 

3. My boss tells me that I am not allowed to use my computer for ... (insert whatever you'd like to do - porn, reading newspaper, buying stocks, banking etc.). Can he really do that???

Short A: Sure he can. He is your boss, and he just did. Suck it up and get back to work!

Long A: As an employee, you signed a contract. The contract states (perhaps a bit indulged) that you will give up some time (usually 8 hrs a day), where your employer (boss in other words) will decide where, what and how you are to spend your time (also called work). In exchange for your time, you get some cash.

This means that when you signed the contract, you signed away your rights to decide what to use the company computer for. Most companies today implement additions to the contract. These additions dictate what, how, when and where you should use the stuff your employer let you use (computer, PDA and phone). These additions, we call Policies. You may also call them laws, regulations, pain in a dark place and much more. The point is; when you signed the contract, you also accepted to follow these policies.

And as you just found out, some bosses actually know about those policies, and what they are about.

Perhaps you'd better get back to work now?

 

-------------------- Thats it for now, folks!

Hi Larko, you are right -

Hi Larko, you are right - they should tell you up front. And many do so. But many fail to do so too. And many makes new policies along the way, and fails to inform the employees in a functional way (they may send an email, but who reads that, right?).

Regarding the public WIFI, I would say that you should be careful with it - especially when you use your employers tools - they may claim you are avoiding the policies, and that might end up a reason to kick your but.

The challenge is to develop a technology that eases our job, while adopting policies that makes sense.

Regarding question number 3,

Regarding question number 3, about the contract, I agree that it may include limits as to what may or may not be done with the company computer during office hours. However, those limits should be transparent and presented to the employee prior to signing the contract. My former employer had a policy banning personnel reading personal e-mails but I only found out about that when I received a phone call saying that they had detected me doing so. How was I supposed to know that I should not log in to gmail.com when nobody told me so? Luckily there was also a public wifi in my office so I was free to use my own laptop to read my e-mail and do whatever I wanted and nobody complained about that.

Post new comment

The content of this field is kept private and will not be shown publicly.

Recent comments

Recent blog posts


The blogger is Kai Roer, a European Information security professional.

View Kai Roer's profile on LinkedIn

Resources

Explore Security Bloggers Network (a FeedBurner Network)