8

My company's infosec policy contains a statement to the effect that I am encouraged to bring my laptop home with me to that it never leaves my possession/control.

This doesn't seem useful, from a security perspective (I can't think of any pros, other than being able to say that it decreases the average distance between me and my laptop...), and has definite cons:

  • The company has no knowledge of or control over the physical security of my home
  • There's no guarantee that when I go home, I keep my laptop with me (I could leave it in the car, or leave it at home while I went somewhere else)
  • Many (most?) employees use public transit to get to and from work, introducing lots of potential places where theft could occur

Is there anything to this that I'm missing, or is this just bad security practice?

  • 3
    Have you tried asking someone at your company responsible for the infosec policy? – Sjoerd Jun 19 '18 at 17:40
  • @Sjoerd I did, and got more or less the tldr from Robert. I'm not convinced it's much more than something to make people feel better, but I suppose there might be some benefit. – user11111 Jun 21 '18 at 0:47
  • I'd agree with your assessment. There's definite cons, and personally I doubt the average person's home is any more secure than the average office. Things like this are more often than not just simple judgement calls rather than based on any real evidence or strongly supported opinion. – Steve Sether Jun 25 '18 at 17:51
4

So here's the TL;DR:

It's easier for you to maintain a watchful eye on the laptop than it is an empty desk other people can access in a large area to either infect it, or walk away with it

It's basically the same reason you don't leave your laptop in a public place:

You don't know who has access to your laptop.

By bringing it home you've guaranteed you know who had access to the laptop. That's a big improvement when it gets compromised. Think of the conversation that would be had:

"What happened during the time your laptop was compromised?"
'I left it unattended on my desk overnight and possible thousand of people could have touched it.'

Or

"What happened during the time your laptop was compromised?"
'I watched a video on Youtube with it and it started acting funny'

The top situation is a 'I left it unattended' and the bottom is a 'We have a direct vector to investigate first as it was being used at the time of infection'. I know I'd always would rather deal with the second situation than the first if I were your IT department. Especially for the following reasons:

  1. It was monitored
  2. Anyone who could have had access to it must have had personal access to you and where you were
  3. Your group of friends who would have access to it would be much smaller than a company(basically anyone who asked, and you'd remember them)

Those three reasons alone are a huge consideration besides the theft deterrent of an unattended laptop and why many companies decide to adopt similar practices.

  • 1
    To further stress this point, I have worked at a couple different companies where there where incidents where "someone" on the overnight janitorial staff walked off with hardware left in people's offices/cubicles, including laptops. – YLearn Jun 19 '18 at 19:45
  • If I had a desktop, should I also be encouraged to take that home? Is the risk to a desktop left at the office somehow less than the risk to a laptop left at the same office? – user11111 Jun 19 '18 at 19:46
  • Desktops left at offices are usually under lock and key unless the company has no idea what they're doing, or are physically secured to something to also prevent theft if it's not considered a 'desirable attack vector'. This is also why companies are running to laptops if at all possible. – Robert Mennell Jun 19 '18 at 19:48
  • However this question was specifically about laptops, so that is the answer I gave – Robert Mennell Jun 19 '18 at 19:50
  • 1
    @user11111, laptops are designed to be portable (connections tend to be easy/quick to disconnect, etc). Desktops are not, so they aren't a natural thought as a quick/easy grab for a thief. Additionally, where there is a concern of theft, often desktops are physically secured to something (like a desk or wall). – YLearn Jun 19 '18 at 19:50
0

Physical access to any computer is typically a large security risk. Unless your system is locked down with defenses such as FDE, secure boot enablement, an admin password set on the BIOS, etc it is typically a quick process to gain a system-level shell on a computer running either Mac or Windows when physical access is gained by making use of malware that hooks itself into the boot loading process, such as Konboot. Taking your computer home at night prevents the potential access to your computer, thus sensitive data if the office building were ever broken in to.

0

I see this differently, your organization transfers the physical security responsibility with you when it's recommended you to keep the possession of the device with you.

User is liable to ensure the physical security of the device (I suppose that's why you worried about the practice and start researching how you can secure it) in addition to organization's responsibility.

Further it's making sense not to keep the device on a place where you may not know who has physical access to it and to move it to an environment (your home) where you know who has access to it (and probably the cyber skills of people accessing at your home could be low compare to your office).

0

I can only understand that as a matter of responsability. If your company recommends that you leave your laptop in your office, they endorse the responsability of what could happen during the night. Common mitigation actions use physical locks. It is still a common practice, because an office normally contains a lot of sensitive/expensive goods or data and need to be secured anyway.

When you take your laptop at home, you are responsable for it at all moment. If it is stolen or broken, you will have to explain how your little boy could play with it, or why you have left it in a bus. Additionally, if you have to finish a report, you can work one hour more after dinner...

But depending on your organization and your office, I am not sure or where the risk of theft or compromission is higher, and I really do not think that this is the reason for that policy.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.