Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 15 down vote favorite
3

Starting to study for Security+ using Darril Gibson's book I took the pre-exam and one of the latest questions is “What is the most security benefit of a clean desk policy?”

The choices are:

  • Prevent illnesses due to viruses and bacteria
  • Presents a positive image to customers
  • Ensures sensitive data and passwords are secured
  • Increases integrity of data

The bold one is the correct, and the author's explanation is: A clean desk policy requires users to organize their areas to reduce the risk of possible data theft and password compromise.

But I don't understand, why? What an organized desk has to do with security? I think this question only applies if the user stores his password in paper format.

share|improve this question
5  
Thought to link to the Clean desk policy/No one giving me clear answer when asking about security procedures thread. I realize it's been closed as too broad, but you might want to read it anyway ;) – TildalWave Mar 6 at 15:17

5 Answers

up vote 27 down vote accepted

Clean desks policies are quite literal. They don't mean that the papers on your desk need to be organized...They mean that you're not allowed to have papers on your desk at all. So, no papers left unlocked on a desk mean no papers with sensitive information for others to trawl through after hours.

Sensitive data doesn't only include password. Engineering designs, sensitive communications, financial information...There is lots of data that could be on paper that a company wouldn't want left around for just anyone to find.

share|improve this answer
up vote 22 down vote

Trevor Paglen's book about USA Department of Defense secrecy Blank Spots on the Map has an illuminating incident. During the Manhattan Project, a Los Alamos physicist got in trouble for leaving an orange on his desk after lunch. The Manhattan Project security people had a policy against leaving spherical objects out in the open, probably because the atom bomb had a spherical core, but who knows? The anti-spherical object policy arose so that guards did not have to make decisions about what's left out in the open.

A clean desk policy means that you don't have to have policy enforcers that are knowledgeable about whatever you want to keep concealed. Paglen also makes the point that like paperwork, secrecy expands to fill all available space.

share|improve this answer
5  
That Orange anecdote is even more amusing if you've read the section of Surely You're Joking Mr Feynman where he describes the flawed document storage systems used in the project: Initially locking filing cabinets with open backs; later combination lock safes which to be more user friendly only required trying 20 of the 100 values on the dial in an exhaustive search and for which 2 of the 3 values could be found by twiddling with the dial while it was open. – Dan Neely Mar 6 at 18:51
+1 for raising the point that, essentially the clean desk policy is to avoid assumptions. It's more secure to leave no clues in the policy itself. This both avoids leaking information in the policy and, in the simplest case, avoids making suggestions for possible insecure ways of storing sensitive information. – LordScree Mar 7 at 13:11
up vote 6 down vote

Because in an office environment, you will often see at least a couple users who will leave documents and notes all over their desk. These documents can contain anything from sensitive customer data to a sticky note with their Windows credentials on them.

This policy describes a best practice.

share|improve this answer
up vote 6 down vote

Sensitive Data does not just mean passwords or other logins. I work for a medical technology company and it is possible for us to have access to privileged patient information. According to HIPAA standards, any identifiable patient information could be a violation. Working with this every day, it's easy enough to leave it sitting out when going to lunch, for coffee, or so forth. Add in an open office floor plan and clients walking through on their way to training, and you've got a HIPAA violation waiting to happen.

share|improve this answer
up vote 2 down vote

Main pupose is to reduce the chance of lowest hanging fruit laying low for a possible compromise.

There is also no more approachable ,catchable and doable attack then removing the stickon from a data entry operator keyboard and reading the password. Has seen this happening so often in an organization i work in.

share|improve this answer
3  
This is an extremely generic sentence which could apply to half the security policies out there. Could you explain how this relates to a clean desk policy? – Gilles Mar 6 at 16:00
This is mildly amusing, "lowest hanging fruit" following an anecdote about an orange. – Iszi Mar 6 at 16:02
1  
Generic indeed so is the threat. – Saladin Mar 6 at 16:05

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.