26

I'm starting to study for Security+ using Darril Gibson's book. I took the pre-exam and one of the questions is “What is the most important security benefit of a clean desk policy?”

The choices are:

  • Prevent illnesses due to viruses and bacteria
  • Presents a positive image to customers
  • Ensures sensitive data and passwords are secured
  • Increases integrity of data

The bold answer is correct, and the author's explanation is: A clean desk policy requires users to organize their areas to reduce the risk of possible data theft and password compromise.

Can someone explain what an organized desk has to do with security? I think this question only applies if the user stores his password in paper format.

34

Clean desks policies are rather literal in the sense they don't mean that the papers on your desk need to be organized...They mean that you're not allowed to have papers on your desk at all. So, no papers left unlocked on a desk mean no papers with sensitive information for others to trawl through after hours.

Sensitive data doesn't only include password. Engineering designs, sensitive communications, financial information...There is lots of data that could be on paper that a company wouldn't want left around for just anyone to find.

  • @community please check my edit on the first sentence. – Celeritas May 9 '15 at 8:49
  • @Celeritas it was incorrect. The original was in fact what I intended. I've rolled it back. – Xander May 9 '15 at 12:01
  • out of curiosity could you explain your thinking? If it were literally a clean desk then it would be free of germs etc. For example in this context if an employee left crumbs from a sandwich on their desk, they would not be in violation of the clean desk policy (as it applies to security). – Celeritas May 9 '15 at 21:35
  • 1
    @Celeritas Your interpretation is too pedantic. Xander's definition of "clean desk" is more literal than the original question's, so "quite literal" is appropriate, while "not literal" certainly isn't. In any case, edits shouldn't attempt to change the intent of the original post, which yours certainly did. – Lily Chung May 12 '15 at 9:54
  • 1
    @Celeritas I don't disagree with your conclusion that the first sentence could be better worded. I do disagree with your specific interpretation. I'll have a think about how I can clarify. – Xander May 17 '15 at 2:49
32

Trevor Paglen's book about USA Department of Defense secrecy, Blank Spots on the Map, has an illuminating incident. During the Manhattan Project, a Los Alamos physicist got in trouble for leaving an orange on his desk after lunch. The Manhattan Project security people had a policy against leaving spherical objects out in the open, probably because the atom bomb had a spherical core, but who knows? The anti-spherical object policy arose so that guards did not have to make decisions about what's left out in the open.

A clean desk policy means that you don't have to have policy enforcers that are knowledgeable about whatever you want to keep concealed. Paglen also makes the point that, like paperwork, secrecy expands to fill all available space.

  • 8
    That Orange anecdote is even more amusing if you've read the section of Surely You're Joking Mr Feynman where he describes the flawed document storage systems used in the project: Initially locking filing cabinets with open backs; later combination lock safes which to be more user friendly only required trying 20 of the 100 values on the dial in an exhaustive search and for which 2 of the 3 values could be found by twiddling with the dial while it was open. – Dan Neely Mar 6 '13 at 18:51
  • 2
    +1 for raising the point that, essentially the clean desk policy is to avoid assumptions. It's more secure to leave no clues in the policy itself. This both avoids leaking information in the policy and, in the simplest case, avoids making suggestions for possible insecure ways of storing sensitive information. – oliver-clare Mar 7 '13 at 13:11
  • 2
    +1 This is perhaps the best explanation for many of the corporate Security Theatre policies I've seen. – Steve Sether May 8 '15 at 17:40
10

Sensitive Data does not just mean passwords or other logins. I work for a medical technology company and it is possible for us to have access to privileged patient information. According to HIPAA standards, any identifiable patient information could be a violation. Working with this every day, it's easy enough to leave it sitting out when going to lunch, for coffee, or so forth. Add in an open office floor plan and clients walking through on their way to training, and you've got a HIPAA violation waiting to happen.

7

Because in an office environment, you will often see at least a couple users who will leave documents and notes all over their desk. These documents can contain anything from sensitive customer data to a sticky note with their Windows credentials on them.

This policy describes a best practice.

2

The main purpose is to reduce the chance of lowest hanging fruit laying low for a possible compromise.

There is also no more approachable, catchable and doable attack then removing the sticky note from a data entry operator keyboard and reading the password. I've seen this happening so often in an organization I work in.

  • 3
    This is an extremely generic sentence which could apply to half the security policies out there. Could you explain how this relates to a clean desk policy? – Gilles 'SO- stop being evil' Mar 6 '13 at 16:00
  • This is mildly amusing, "lowest hanging fruit" following an anecdote about an orange. – Iszi Mar 6 '13 at 16:02
  • 1
    Generic indeed so is the threat. – Saladin Mar 6 '13 at 16:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.