Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I work at an IBM lab and there are some security policies that I do not understand the point of. When I ask why we do them my boss simply says it's policy and avoids answering the question.

  1. We must keep empty drawers locked
  2. When we leave work we must lock up writeable media
  3. We must lock any notes up and erase white boards. I don't get this one because someone during the day time could just as easily walk by and see something they are not supposed to.
  4. At meetings if we want to take notes, the notebooks have to be black and have hard covers.
  5. Health information is confidential to the extreme, for example even if a person's boss is sick they cannot give them any ETA on his/her return and can't even answer "is he/she getting better?"

I would really feel better given some reason, even if I don't necessarily agree with them. Any possible explanation is appreciated.

share|improve this question
10  
Requirements 1-4 fall into what's most commonly referred to as a clean desk policy. We already have some related questions answered here, so that could be your first source of information (What is the most security benefit of a clean desk policy? has some good answers, and also this answer on a closed question). #5 is probably as per requirements of The HIPAA Privacy Rule on disclosure of Protected Health Information (PHI). –  Noordung Jun 24 '13 at 5:43
    
With regards to #5 isn't it reasonable for me to inquire about when my boss is going to be back? I worked with him every day and it affects me greatly. –  hushhush Jun 24 '13 at 5:54
3  
I understand your concern, but you'd be free to inquire about one's health having their private contact information and that person having clear choice of deciding who to disclose what personal information to. Your employer isn't free to answer such questions, and this is covered in many laws they have to abide to under threat of litigation. You could, for example, ask your employer for information regarding the status of your project, or if a temp is planned to cover for personnel on leave, but they shouldn't respond to asking for personal and/or otherwise confidential information. –  Noordung Jun 24 '13 at 6:00
2  
Plead don't add more points to your question, that makes all answers that it already gathered less relevant to what is being asked. It already has not immediately related points in it, which would be better split in separate questions. You can always ask new question though, as long as they're on-topic, not a duplicate of already covered questions and of course in line with our FAQ and How to Ask guidelines. Thanks! –  Noordung Jun 24 '13 at 9:01
1  
I just suppose Google Glass is not allowed in there. –  jmendeth Jun 24 '13 at 11:23

6 Answers 6

Here are my thoughts on this:

  1. Somebody could hide something--a flashdrive with malicious content, for example--in an unlocked drawer. An employee could find that flashdrive and plug it in to his computer, putting the computer at risk of compromise. Also, it's easier to modify the locks of unlocked drawers than it is to modify the locks of locked drawers. By modifying a lock, a malicious individual could make it easier for themself to gain access to the drawer in the future.

  2. If the media is blank, somebody could put malicious contents on it. If the media's filesystem is "empty" but the media has been used in the past, somebody might be able to recover fragments of old data from it.

  3. It wouldn't be difficult for a janitor (or somebody posing as a janitor) on a night shift to take pictures of a white board, potentially stealing secrets. During the day, the white board is more likely to be surrounded by trusted individuals, making it more difficult to covertly take pictures of it or even get a decent look at it.

  4. Black notebooks are less noticeable than white notebooks. Hardcover notebooks are less likely to lose their covers than softcover notebooks. Covers are important for notebook security. They make it just a bit more difficult to quickly and covertly obtain information from a notebook. They also prevent notebooks from flailing open when they are dropped. Hard covers are better preventers of flailing than soft covers. Also, notebooks with soft covers may be more likely to get misplaced than notebooks with hard covers.

  5. Some sorts of health information are extremely valuable to social engineers. It is common for malicious social engineers to plan attack vectors around employees on leave. For example, if a certain employee is on sick leave, a social engineer might pose as a friend of the employee and gain access to the employee's office by telling somebody he has to bring his friend an item from the office.

share|improve this answer
23  
As an addition to #1: If only desk drawers with important content are locked, there is an easy test to find out whether a desk contains important info: Check whether it is locked. If all drawers are locked (rather than only the 1 in 3 that have confidential information) the thief or pen-tester now has to break open three times as many drawers to get to important info. It's a variation on the Purloined Letter stratety. –  medivh Jun 24 '13 at 7:03
    
@medivh Good answer but I slightly disagree and here's why. I didn't mention that we have clean desk policy so even things that are basically worthless (e.g. a test page from the printer) have to be locked up. So even if empty drawers were left unlocked an intruder is not guaranteed to find anything valuable in a locked drawer. –  hushhush Jun 24 '13 at 8:36
9  
Right, but he is definitely guaranteed to NOT find it in an UNLOCKED drawer. Turning all unlocked drawers into LOCKED drawers increases the search space, even if some (previously also) locked drawers contain unimportant things. It is the same principle with communications encryption - if you only encrypt sensitive emails, an attacker doesn't have to waste time decrypting your shopping list and can focus on your sensitive data. –  medivh Jun 24 '13 at 9:42
4  
<dwight>Also, if an industrial spy tries to assault you and take some company secrets by force, the hardcover notebook makes a better improvised weapon </dwight> –  Stephen Bachelor Jun 24 '13 at 12:03
6  
addition to #4. The choice of the color is arbitrary, they just want to unify the color of the notebooks to make it difficult to know which notebook was used in which meeting just by looking at it. we had similar policy. –  Green Fly Jun 24 '13 at 15:58

This is far-fetched, but non-obvious information leaks:

1. We must keep empty drawers locked

If someone knows that there is a regular meeting discussing secret project X every Tuesday and Friday; and noticed that the drawers are always empty and unlocked on Tuesday and Friday, but locked otherwise, then it's pretty clear indication that the content of that drawer is a secret related to project X.

2. When we leave work we must lock up writeable media

Other than concerns about someone swapping or putting malicious data into the media, locking up all writeable media ensures that nobody can tell apart a writeable media that contains secret and those that contains regular data.

4. At meetings if we want to take notes, the notebooks have to be black and have hard covers.

Also the same reason with writable media, if someone noticed that you use a Hello Kitty notebook to take notes in meetings for secret project X, and the Superman notebook for other projects; people could immediately recognize the Hello Kitty notebook if you forgot about it and leave it lying around. Also, whether or not you carry your Hello Kitty notebook when you go to places could give indication on what project X is about. A uniform notebook is less conspicuous.

Also, if you have lots of nonsense rules in your security policy, they would help to cover the truly odd 'no leaving "spherical object" on the desk' policy that might have leaked the information that that green massage ball you see the team lead carrying around the office was actually a core for a nuclear reactor.

There is also a possibility that it is a situation with five monkeys, a ladder, a banana, and a water spray.

share|improve this answer
    
What if I would use Pokemon notebook?:) –  Marek Jun 25 '13 at 0:33
    
Upvoted for the refs to Los Alamos and the monkey model of security. –  Deer Hunter Jun 25 '13 at 9:10

Items 1-4 in your question are parts of what are commonly referred to as a "clean desk policy". So I'll try to provide an answer why a clean desk policy is used in general. There are actually many reasons:

  • If clients visit the workspace (which I know happens at IBM) you want to create a positive image. Clients would not like to see documents detailing their specific needs or solutions lying about for anyone to grab.
  • The risk of a security incident where confidential documents get stolen is greatly reduced. If you leave your documents in the open, they can disappear, either from a cleaning lady or someone with malicious intent. Now trust me you do not want to be the person explaining to your client what happened to their < insert secret project >.
  • It forces you to keep things tidy, this means you will be more organized, being organized means you will be able to work a lot more efficiently
  • It also encourages reducing the amount of paper used within your company. Which, again, reduces the risk of documents being defrauded, simply because they aren't present.
  • Flex Desks are the future, if I come into your office and need a desk which is littered with papers I won't be able to work there. Hence a clean desk policy enforces that you take away all your belongings from your desk so that any employee can sit there.

Regarding the disclosure of health information (e.g.: reasons for, or duration of, sick leave): It's a necessity for compliance with certain privacy laws in certain countries. Personal information is considered highly confidential, especially when that information is about health care. If you do not comply with the rules set by this country and handle the data wrongly, you can be held legally liable.

In your case I can give you the following reasons:

  1. Drawers that are locked can't be accessed by unauthorized personnel, meaning confidential documents are physically secure. If it's your drawer, you still need to lock it, someone might take your locker OR someone might conclude: "Hey his locker is never locked except now, there must be something confidential in there!"
  2. The same goes with writable/readable media, you don't want documents to be altered, infected or leaked out.
  3. While white boards can be seen, they can't be photographed easily without someone noticing. Also note that there is always a trade-off between security and usability.
  4. Easily identifiable plus you can't press through it. You don't want to start writing your text and then note that it pressed through onto a table or paper which was already lying on the table.
  5. This is considered very private in some countries so it should be treated as such. If the boss wants to share when he will be back available he can communicate this if he wants, if he does not want to do that, then it's also not your problem.

Now another issue is that IBM is a global company, meaning many countries have different regulations. To have a manageable compliance policies around the world, they probably decided "one size fits all" and that would mean to have one policy which complies to the strictest rules across the globe and which has to be followed by every office in the world.

share|improve this answer
    
I'd like to point out when you say clients visit the office should see a positive image, I've never seen clients visit the office (likely they are in a different country) and if they did they would see the most unprofessional behaviour ranging from curse words being used easily to the most tasteless of dress attire. –  hushhush Jun 25 '13 at 8:22
    
I have a few of my friends working at IBM and they do get visits quite often. Like I said, one global policy needs to fit all :) –  Lucas Kauffman Jun 25 '13 at 8:24

Unlocked drawers can be removed completely, giving access to locked drawers below (and probably above too). Of course, desk locks are completely nominal anyway, but at least a locked drawer is "tamper evident".

share|improve this answer

Regarding #1, think of the rule as this:

  • keep all drawers locked, regardless if they are full or empty.

Then people don't have to continually think "should I lock this drawer or not?" and won't make the mistake of accidentally not locking a drawer that newly was not empty.

It also makes it simpler to enforce security rules: if a drawer is unlocked, that's a violation, without having to investigate if there are things in there.

For #2-#4, the same logic can apply: do some redundant work, so that you're not having to continually having to determine/remember if the rules apply in a particular case.

For #5, that's an HR issue; the company is not allowed to give out health status information on employees.

share|improve this answer
2  
I'm supposed to review this post and I honestly don't know what to think of it. Would you please address also all the other parts of the question and help me out with it? Otherwise it's 4/5 into the "not an answer" category. Cheers! –  Noordung Jun 24 '13 at 18:49
1  
@TildalWave Such is the way with questions like this. To best fit the SE format, it should have been broken into 5 separate questions. –  Iszi Jun 24 '13 at 19:03
    
@TidalWave, done! –  Mark Harrison Jun 25 '13 at 0:04
    
@Iszi I couldn't see #5 by itself being an appropriate fit for this site, but grouped with the rest it seems better. –  hushhush Jun 25 '13 at 8:20

Relating these to ideas from encryption:

  1. Encrypting only confidential information generally makes it easier for attackers to focus their efforts. Encrypting everything means more decryption work, and possibly much more trouble identifying exploitable information.
  2. Retrieving the ciphertext is a good first step of data retrieval, and usually a simple read can't be detected afterwards.
  3. An attacker reading the plaintext while the owner is using the storage is more likely to be discovered. Also, plaintext should exist only when absolutely necessary, to minimize attack surface (in both space and time).
  4. Making all plaintext "containers" identifiable should make it easier to ensure they are identified as security critical and treated as such.
  5. Unusual situations and corner cases are often easier to attack, since the protocol for handling them can be less well defined, or less well known/remembered.
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.