Why would taking my laptop home be encouraged for security reasons?

Question

My company's infosec policy contains a statement to the effect that I am encouraged to bring my laptop home with me to that it never leaves my possession/control.

This doesn't seem useful, from a security perspective (I can't think of any pros, other than being able to say that it decreases the average distance between me and my laptop...), and has definite cons:

• The company has no knowledge of or control over the physical security of my home
• There's no guarantee that when I go home, I keep my laptop with me (I could leave it in the car, or leave it at home while I went somewhere else)
• Many (most?) employees use public transit to get to and from work, introducing lots of potential places where theft could occur

Is there anything to this that I'm missing, or is this just bad security practice?

Answer 1

So here's the TL;DR:

It's easier for you to maintain a watchful eye on the laptop than it is an empty desk other people can access in a large area to either infect it, or walk away with it

It's basically the same reason you don't leave your laptop in a public place:

You don't know who has access to your laptop.

By bringing it home you've guaranteed you know who had access to the laptop. That's a big improvement when it gets compromised. Think of the conversation that would be had:

"What happened during the time your laptop was compromised?"
'I left it unattended on my desk overnight and possible thousand of people could have touched it.'

Or

"What happened during the time your laptop was compromised?"
'I watched a video on Youtube with it and it started acting funny'

The top situation is a 'I left it unattended' and the bottom is a 'We have a direct vector to investigate first as it was being used at the time of infection'. I know I'd always would rather deal with the second situation than the first if I were your IT department. Especially for the following reasons:

1. It was monitored
2. Anyone who could have had access to it must have had personal access to you and where you were
3. Your group of friends who would have access to it would be much smaller than a company(basically anyone who asked, and you'd remember them)

Those three reasons alone are a huge consideration besides the theft deterrent of an unattended laptop and why many companies decide to adopt similar practices.

Answer 2

Physical access to any computer is typically a large security risk. Unless your system is locked down with defenses such as FDE, secure boot enablement, an admin password set on the BIOS, etc it is typically a quick process to gain a system-level shell on a computer running either Mac or Windows when physical access is gained by making use of malware that hooks itself into the boot loading process, such as Konboot. Taking your computer home at night prevents the potential access to your computer, thus sensitive data if the office building were ever broken in to.

Answer 3

I see this differently, your organization transfers the physical security responsibility with you when it's recommended you to keep the possession of the device with you.

User is liable to ensure the physical security of the device (I suppose that's why you worried about the practice and start researching how you can secure it) in addition to organization's responsibility.

Further it's making sense not to keep the device on a place where you may not know who has physical access to it and to move it to an environment (your home) where you know who has access to it (and probably the cyber skills of people accessing at your home could be low compare to your office).

Answer 4

I can only understand that as a matter of responsability. If your company recommends that you leave your laptop in your office, they endorse the responsability of what could happen during the night. Common mitigation actions use physical locks. It is still a common practice, because an office normally contains a lot of sensitive/expensive goods or data and need to be secured anyway.

When you take your laptop at home, you are responsable for it at all moment. If it is stolen or broken, you will have to explain how your little boy could play with it, or why you have left it in a bus. Additionally, if you have to finish a report, you can work one hour more after dinner...

But depending on your organization and your office, I am not sure or where the risk of theft or compromission is higher, and I really do not think that this is the reason for that policy.