Information security in the workplace

Whether working from home, in a private or shared office, in a laboratory, in a lecture room, or whilst travelling by train, ship or aeroplane – students work everywhere. Shoulder surfing is one of the simplest attacks in a social engineer's arsenal, as it can be carried out without direct contact and without the need for any tools. Shoulder surfing refers to the act of 'looking over someone's shoulder' to spy on information, login details, secret codes, PINs, unlock patterns, credit card numbers, etc. [1]
In the past, shoulder surfing was mainly used to spy on PINs for prepaid phone cards and at cash machines. [2] Nowadays, shoulder surfing has become even more attractive due to the widespread use of smartphones and laptops. There are more opportunities for attack, and social engineers can discreetly film data being entered using their own smartphone and analyse the footage afterwards.

Particularly in public spaces, it is important to provide special protection for sensitive information and to handle data carriers with care.

 

This includes:

• Ensuring that no unauthorised persons are present in offices, laboratories, lecture rooms or other rooms containing sensitive data
• Before leaving a room, check whether there is any sensitive information still on noticeboards or whiteboards, and remove it
• Before leaving a room, ensure that windows are closed to prevent damage caused by rain or storms
• Lock any rooms that are no longer occupied after leaving them
• Ensure that no unauthorised persons are listening in on telephone calls
• Never leave passwords or other authentication details in plain sight (this also applies to passwords that are supposedly hidden by sticking them under laptops, keyboards, on PCs, behind screens, etc.)
• Be vigilant if unknown individuals are present in areas not open to the public and appear to be casually pointing their smartphones at screens, and check with managers or colleagues to see if the person is known

The following applies in particular, both when working from home and at your office desk:

• Even if you are away from your workstation for a short time, you should always lock your screen (keyboard shortcut: Windows+L) and enable automatic screen locking
  When working from home:
• To prevent pets (or children) from wandering across the keyboard and ruining hours of work

In the office:

• To prevent unauthorised persons from spying on, deleting or altering data, or causing disruption
• In the case of files or printouts, care must be taken to ensure that these are stored in lockable cupboards and are not left lying around in printers, on desks or on cupboards where they are freely accessible.
  When working from home:
• To prevent children from misusing important documents for creative drawing projects
• To prevent pets from damaging or even destroying important documents

In the office:

• To prevent unauthorised persons from gaining access to them
• To ensure that no one is tempted to place coffee cups on top of important documents
In addition, it is always advisable to familiarise yourself with the applicable classification rules. These regulations often contain further information on how documents requiring protection should be handled.

When travelling on public transport, please be mindful and protect your data.
Here are a few tips on handling information whilst travelling:

• Smartphones, documents, laptops and other work equipment should never be left lying around unattended
• Screen protectors ensure that the screen is only visible to the person sitting directly in front of it
• Using a VPN connection enables a secure connection to the company network even when on public networks (aircraft, buses, trains, etc.)
• When entering login details, it is essential to be aware of fellow passengers and your surroundings. If you have even the slightest suspicion that someone is trying to spy on you, you should stop the login process. When authenticating, it is best to shield the screen from view with your body. [3]