Starting a new job after working at home for years. How to best protect data, secrets, and privacy in the workplace?

Question

I have just started interviewing for new computer job after years of working from home.

At home I feel very secure with how I protect myself from data loss and keeping my secrets secure. I backup both of our computers with the awesome-four-dollar-a-month CrashPlan, and, in addition to my programming projects, I use Bitbucket to individually backup every substantial thing on my computer. This includes Firefox FEBE backup, XYplorer settings, Sublime Text settings, my website, some personal documents, and smaller-sized configuration settings for a whole bunch of other applications).

Most importantly, given the horror of malware like (the former) CryptoLocker and (current) CryptoWall, these offline backups are not connected to my computer, except during the actual backup process. I don't use Dropbox for anything except short-term document transfers. (I would be surprised if Dropbox didn't release a disconnected version at some point.)

As far as secrets, I use 1Password (which requires a master password) and AxCrypt (which uses both a passphrase and key-file) to encrypt anything even mildly private.

---

The most important thing I'm concerned about in the workplace, is how do I protect my master password, which I have to enter around a hundred times every day?

I'm thinking of making the 1Password timeout moderately longer, but to make it a(n absolutely infallible) habit, that every time I get up from the computer, I lock it...which also locks the 1Password vault. I also always use their "Secure login".

(I should get a string and alligator clip like they have on treadmills, that when you pull away, it auto-shuts off.)

Seriously, though, how far do you take it? Do you put a towel over your hands every time you enter it?

My other major concern is, although I want to minimize the amount of encrypted documents I have on my work machine, how do I conveniently unencrypt documents, when the key file has to be a plain-text file, but (a) I don't want to just leave the key file sitting there vulnerable, yet (b) I also don't want to have to create-use-then-destroy this document each time, either. (Both the AxCrypt passphrase and key-file text are in 1Password.)

My last major concern is my computer getting eaten alive because a coworker on the same network got tricked into installing CryptoWall. I think my backup habits generally cover this, although I'm not sure if my employer would allow me to use CrashPlan, or if I'd be forced to use something in-house, which scares me a little.

And some paranoid (?) concerns: Key-loggers, spy cameras, and tracking my online activity.

Two remaining thoughts: Do you just avoid Facebook and multi-clipboard managers (because I know of none that have built-in password protection/purging features) at work?

I would love a checklist of the most important things to be wary off, and the most important things to do/not do, to protect myself, my data, my secrets, and my online privacy when at work.

Thanks.

Answer 1

Firstly I think you need distinguish between personal risk and company risk. You're probably used to being responsible for all risk, but in a corporate scenario you probably won't be responsible managing risks to the company (except through applying company policy).

Personal and company risk need to be managed differently from your point of view so I'll discuss them separately.

Personal Risk

These are risks to your personal data and accounts when accessing them through company resources. For example: Your Facebook password being compromised by an onlooking co-worker, your personal cloud storage being compromised by malware on the corporate network, etc.

The thing is that you can't be certain of the integrity of a company owned machine. You cannot rule out that the company isn't running key-logging software for monitoring purposes or that they haven't installed their own CA certificate so they can monitor HTTPS traffic. Even if it's not company policy to do these things chances are that someone besides you will have administrator access on your machine and therefore a rogue employee could potentially be a threat. Someone else having root/administrator access means they could change just about any aspect of the system and hide almost any indication of their changes.

Under that scenario you should treat your workstation like any other system which could be a threat to your personal accounts, therefore:

• Use different master keys and passwords at work and for work accounts
• Avoid accessing especially sensitive personal accounts at work
• Separate your work and personal accounts, avoid registering company email addresses as recovery addresses, etc.
• If you need to access a personal account while at work then use a personal device instead

Personally, while my workplace doesn't have an issue with accessing personal accounts like Facebook or email from work I generally avoid it. Instead I just use my phone (which isn't company owned) over 3G. If there's something I want to access from my workstation which doesn't pose a significant risk (eg. a link I saved in my personal inbox) I'll just forward it to my work email from my phone.

Company Risk

Risks to company resources, for example cryptolockers, data loss, work accounts, work passwords, etc.

Generally this probably isn't your responsibility. Your company should have policies in place which consider these threats relative to the cost of mitigating them and you should apply these policies as required.

Going beyond the company mandated policies at your discretion is probably okay but keep in mind there will be some scenarios that this won't be okay, for example:

• Taking your own backups of important/valuable company data might be seen as suspicious
• Some precautions might be deliberately forgone because it has been determined that the cost (eg. to productivity) outweighs the risk it mitigates
• Introducing your own software (eg. 1Password) might create risks which haven't been considered by your company even if they are intended to increase security

TLDR; Keep your personal accounts/data separate from work and follow your company information security policies.