Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

We're all aware of the need for physical security. Everytihng from locks on doors to locking your computer when you leave it.

I'm having trouble with some people leaving their stations up as they head away from it. I can mess with settings like timeouts but then it sometimes times out while they're reading etc... Any suggestions for a way to make these stations know when the users (HR Manager, President, Manufacturing director....) get away from the terminal?

I saw Securing Windows 7 using Bluetooth ,but I've tried this and it doesn't work well and requires a headset connection to a device like your phone. Kludgy solution at best. Suggestions?

share|improve this question
add comment

3 Answers

You want a system which can somehow detect the difference between:

  1. The user is on the chair in front of his computer, looking intently at the screen (for "reading") but not otherwise making his presence known to the computer.

and:

  1. The user is on the chair in front of his computer, looking intently at the back of his eyelids, because he is taking a quick nap.

Said that way, it becomes rather obvious that the problem is hard. You could imagine plugging a Webcam to the computer, focused on the user's face and able to detect whether his eyes are shut or open... this seems kludgy. However, such a product is apparently on the market. You might want to give it a try -- not for automatic login (it is too easy to fool a face recognition system with a life-size photograph of the user), but for the automatic lock when the user leaves the room. Of course, this requires Webcams. Laptop computers have them.


The normal way to deal with unsolvable problems is to change the problem until it matches a solution. The common method, in this case, is to "empower" the users. This takes the form of a tradition of users jumping on each other's machines: if you find an unlocked workstation, then you send an email to the whole floor in the name of the workstation owner. The said user is then "forced" (through social pressure, not contractually -- it would probably be illegal) to pay for cookies or beers for everybody on the floor. If done properly, then the rate of unlocked workstations can significantly drop.

Unfortunately, this does not work well with people whose hierarchical level is higher than their sense of humour. The same people will also be uncooperative with any technological constraints. For instance, you could enforce smart card logon (with USB-token form factor, and automatic locking when the card is extracted) and have the users keep the smart card tethered to their wrist of belt at all times. It can be easily predicted that the users will not keep the USB token attached.

This issue is widespread. As an example, the French government just recently issued a reminder to its own ministers that they are not supposed to use "not approved" smartphones, and yet they do. Similarly, Barack Obama, upon becoming president, adamantly refused to let go of his phone, to the dismay of the Secret Service.

For people at the top management positions, the most practical method might be to simply hire an underling whose job is to type Win-L whenever his boss leaves the room. If that employee is decorative enough (which, in many cases, means that the employee is a she and is young) then such a plan will meet user approval, and be effective.

share|improve this answer
    
You have it somewhat right. I don't necessarily need them to be sitting with their eyes alert and on screen. The HR manager for instance often deals with alot of paperwork on a portion of her desk, and refers back to the screen after some time even if its just to make sure there is no new email. As to the social mechanisms, I've suggested solutions such as this. The administration isn't going for it. They don't want to create what they call "punishment by embarrasment" or distract from the busy work environment. –  PsychoData Sep 17 '13 at 20:11
    
There are recent Android phones that are supposed to turn off the screen to save power when the user isn't looking at it (apparently processing the camera data is sufficiently cheap that it's worth it). I think the Samsung S4 does it. I don't know how well it works. –  Gilles Sep 18 '13 at 1:09
    
it works fairly well, but its called smart stay. It's not designed to turn it on when you lookk at it, it keeps it on while you're looking at it. Like if you are reading something and looking at it it wont shut the screen off on you. –  PsychoData Sep 18 '13 at 4:57
add comment

Locking Hands-free:

  • Time-out of mouse and keyboard activity (risky as you mentioned)
  • Eyeball tracking (hard as Tom mentioned)
  • RFID/Bluetooth proximity out-of-range trigger (RFID proximity bubble could be 1m across; Bluetooth even larger).
  • Pressure pad. Lock on loss of pressure. See example.

Unlocking Hands-free:

  • Voice key. Not very secure; anyone can record a pretty convincing replica.
  • Fingerprint. Not really hands-free. Although contact-less fingerprint scanners are now on the market. So it depends on whether the staff member is carrying documents/cups of coffee or has a hand spare to poke at the scanner.
  • Near Field Communication (NFC) proximity. Tighter range and better security than RFID.

More details on NFC proximity unlocking:

NFC has a very short proximity range, which means that physical movement in a cubicle or office shouldn't accidentally unlock the computer. If the NFC dongle uses one-time-passwords, then you will gain more security with a password-free environment than if you kept using human passwords...

An example of NFC access control would be: Wristband + reader + configuring the operating system to use "smart card" proximity login. Further searching should find better product examples or configuration guides.

RFID access control could be an option if no decent NFC solutions are currently on the market, but RFID is not especially secure and has a wider triggering range unless calibrated.

share|improve this answer
    
hmm we do have RFID badges at work. Maybe I could get a reader to go on the bottom of the desk. or a spot on their desk to put their badge or something...but I'm really looking for something a bit less specific than that. It would either have to be a powered RFID tag or a very strong reader. –  PsychoData Sep 18 '13 at 4:59
    
Another option: Separate the lockdown and privacy screen behaviour. For lockdown use any of the options above; for privacy screening while staff are at their desk, have an app that starts slowly fading the screen to black after certain amount inactivity. When that happens, they can either tap any key or tap the desk to continue reading. This assumes that if a staffer is at their desk but not using the computer, the risk is lower than when they are away from their desk. –  LateralFractal Sep 18 '13 at 7:04
add comment

The e-motional.com company (sorry no enough reputation to post links, feel free to edit) is the producer of the only truly transparent Windows screensaver on the market. They also bundle the software with a proximity sensor that dialogs with their screensaver, locking the workstation when the user goes away. You may combine the two at your leisure. They seem to have lots of high profile clients. We only contacted them for the transparent screensaver, as luckily our employees are proficient enough to press a random key every 10 minutes.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.