Any ways to protect my user data on company computers?

Question

I have a desktop computer at work running Windows 8.1 Pro. For logging in I use a domain account and I have logged in with my Microsoft account to get access to my Onedrive and syncing of email accounts and such things. I'm the only one using the computer.

Everything works the way I want, but I'm wondering a bit about security in relation to my personal data. I assume for example that IT can log on with an administrator account and access all my files being synced via Onedrive (probably even though most of them are online-only?), and even though I don't think they will do that I would of course prefer if they couldn't. There's also the fact that when I stop working here at some point, someone might take over this computer and I don't trust them to wipe it first. I'll probably make an attempt to do it myself when that time comes, but still.

Are there ways I can protect my own user data on a company computer from snooping IT workers? Especially looking for solutions that come built-in with Windows and are as transparent as possible. And by transparent I mean that it shouldn't cause a lot of problems when I'm using it like messing up Windows in any way, having to enter special credentials a lot, etc.

I assume enabling BitLocker on the system drive is one thing one could do, but wouldn't really help against people logging on with other domain admin accounts?

Answer 1

Administrator is your God. You don't fight your God; you appease Him with offerings and grovelling worship.

Your potential attacker can perfectly install some keylogger/screenlogger on your machine, get everything you type, see everything you see, get a copy of everything you download or upload. Basically this is not your machine. Technically, the machine "belongs" to the Administrator, and you are just a guest. Don't try to fight him; he has all the technical power to defeat you utterly.

Of course there are regulations and laws against IT people snooping on people's files. However there probably are clauses in your employment contract that more or less directly allow the employer to scan your data, since the computer is the company's computer, not really yours. So while active snooping is improbable if the IT people are like most IT people (i.e. their natural nosiness is more than balanced by their inherent laziness), an industrious IT admin with loose morals and some Internet-fueled competence can perfectly eavesdrop on everything you do on that computer without you getting the slightest warning about it, and without leaving incriminating traces.

It would be safer for you to simply bring your own laptop, connected to the Internet through your smartphone, and accessing your personal data from that computer only.

---

This situation has an amusing twist. You are thinking of your computer as "yours" and trying to protect your personal data from the company that owns the hardware. You see the company as a potential attacker. Be assured that the reciprocal is true: most "IT security teams" see the user (i.e. you) as the attacker. When they tell you that such and such system or procedure is enforced "for security", don't be a fool: they mean "for security against the user himself".

While this shared mistrust is of course detrimental to actual security of the data (against outsiders), it is still widespread and, to a large extent, self-powered. IT security teams fight against users because they see users as troublemakers that will look for ways to evade their scrutiny and, for instance, use the company resources for personal usage, and indulge in non-work-related dangerous behaviours (like downloading malware-riddled applications). Users do that because they don't trust IT security teams, as your own question shows. Of course, both the users and the IT people think that the other party is a bunch of morons.