Physical & Device Security

Your Device Is a Vault

Your work laptop and phone contain:

• Email access (including sensitive communications)
• Company credentials
• Customer data
• Financial information
• Access to internal systems

If someone takes your device, they potentially take everything.

The Basics That Matter

1. Screen Lock — Always

Keyboard shortcuts:

• Windows: Win + L
• Mac: Cmd + Ctrl + Q or Ctrl + Cmd + Q

Make it automatic:

• Set screen to lock after 2-5 minutes of inactivity
• This is your safety net when you forget

2. Strong Device Password/PIN

❌ 1234, 0000, 1111 (most common PINs)

❌ Your birthday, anniversary, postcode

✓ 6+ digit PIN minimum

✓ Biometrics (Face ID, fingerprint) + strong backup password

3. Encryption

All work devices should have full disk encryption:

• Windows: BitLocker
• Mac: FileVault
• Mobile: Built-in (ensure it's enabled)

Why it matters: If someone steals your encrypted laptop, the data is useless to them. If it's unencrypted, it's like handing them the keys.

Real Example: Heathrow USB Stick (2017)

An unemployed man found a USB stick on the street in West London.

What was on it:

• Security details for the Queen's route to Heathrow
• Types of ID needed for restricted areas
• Routes and schedules for dignitaries
• Details of CCTV cameras and security patrols

What went wrong:

• Unencrypted USB drive
• Lost by an employee
• No remote wipe capability

The lesson: Every device that leaves your organisation is a potential data breach waiting to happen.

Securing Mobile Devices

Your Phone Is Now Your Weakest Link

Your phone likely has:

• Work email access
• Two-factor authentication codes
• Access to cloud documents
• VPN access
• Sensitive photos and messages

If compromised, an attacker can:

• Reset passwords using your email
• Bypass 2FA on your accounts
• Access company systems
• Read confidential communications

Mobile Security Checklist

✓ Biometrics enabled — Face ID / fingerprint for convenience and security

✓ Strong backup PIN — At least 6 digits, ideally alphanumeric

✓ Auto-lock enabled — 30 seconds to 1 minute maximum

✓ Find My Device enabled — Ability to locate and remotely wipe

✓ Software up to date — Security patches matter

✓ No jailbreaking/rooting — Removes security protections

What to Do If Your Device Is Lost or Stolen

Immediately:

1. Report to IT/security team
2. Report to your manager
3. Use Find My Device to locate or lock
4. Request remote wipe if can't be recovered

IT will:

• Revoke device access to company systems
• Reset passwords if needed
• Issue replacement device
• Investigate potential data exposure

Don't:

• Try to track down the thief yourself
• Wait to see if it turns up
• Assume it's "probably fine"

Time matters: The faster you report, the less time attackers have to access your data.

The Coffee Shop Office

Remote work means working from anywhere: coffee shops, trains, airports, hotels. Each brings security risks.

Shoulder Surfing

What it is: Someone watching your screen or keyboard.

What they can see:

• Passwords as you type them
• Confidential emails
• Financial data
• Customer information
• Access codes

Where it happens:

• Trains and planes (seats behind you)
• Coffee shops (seats facing you)
• Hotel lobbies
• Co-working spaces
• Even your own office (visitors, cleaners)

Protecting Your Screen

Privacy screens:

• Physical filter that limits viewing angle
• Essential for train/plane travel
• Available for laptops, monitors, and phones

Positioning:

• Sit with your back to a wall
• Avoid window seats where passersby can see
• Be aware of mirrors and reflective surfaces

Screen brightness:

• Dim your screen in dark environments
• Bright screens are visible from further away

Real Example: Military Data on Train (2021)

A journalist sat next to a Ministry of Defence official on a train. The official was reading classified documents on an unprotected laptop.

What was visible:

• Details of HMS Defender incident in Black Sea
• Military capability assessments
• Sensitive geopolitical information

The outcome:

• Documents photographed by the journalist
• Significant embarrassment for the MoD
• Investigation launched

The lesson: Public transport is public. Act accordingly.

Public WiFi: The Hidden Threat

Why Public WiFi Is Dangerous

Open networks (no password):

• Anyone can see your traffic
• No encryption between you and the access point
• Attackers can intercept data in transit

Fake networks ("evil twin"):

• Attacker creates network named "Starbucks WiFi"
• You connect thinking it's legitimate
• All your traffic goes through attacker's device

Man-in-the-middle attacks:

• Attacker positions between you and the internet
• Can see and modify your traffic
• Can steal credentials and session cookies

Safe Practices for Public WiFi

Best option: Use mobile hotspot

• Your phone's data connection
• Much more secure than public WiFi
• No sharing with unknown people

If you must use public WiFi:

✓ Always use VPN — Encrypts all traffic

✓ Verify network name — Ask staff for exact name

✓ Don't connect to open networks — If no password, no security

✓ Avoid sensitive work — Banking, confidential documents

✓ Forget the network after — Don't auto-connect next time

What VPN Does

Your company VPN:

• Encrypts your connection
• Routes traffic through company servers
• Should be mandatory on untrusted networks

Your Desk Is a Security Perimeter

Clean Desk Policy

At the end of each day (or when away from your desk):

Lock away:

• Printed documents with sensitive information
• USB drives and external storage
• Access cards and badges
• Notebooks with passwords or notes

Clear from screen:

• Close sensitive documents
• Log out of applications
• Lock your computer

Shred:

• Documents with personal data
• Printed emails
• Drafts and notes you no longer need
• Post-it notes with credentials

Real Example: Photo in News Article (2020)

A senior official was photographed entering 10 Downing Street holding documents.

What was visible:

• Classified briefing notes
• Clear text readable in high-resolution photo

The outcome:

• Documents were partially readable
• Information had to be reassessed for security impact
• Reminder issued to all staff about visible documents

The lesson: Any document visible in public can be photographed. Turn papers face-down or use a folder.

Printer & Document Security

The Forgotten Print Job

You send a document to print. You get distracted. An hour later, it's still sitting in the printer tray.

Who could see it:

• Colleagues
• Cleaners
• Visitors
• Anyone walking past

Secure Printing Practices

✓ Collect immediately — Don't let prints sit

✓ Use secure print (if available) — Requires PIN at printer

✓ Check what you're printing — Need physical copy?

✓ Don't print more than needed — Minimise physical copies

✓ Shred unwanted prints — Cross-cut shredders are best

Document Disposal

Regular bin: ❌ Never for sensitive documents

• Can be retrieved
• May be read by cleaners
• Could end up anywhere

Recycling bin: ❌ Not for sensitive documents

• Same risks as regular bin
• Often collected by third parties

Shredder: ✓ For all work documents

• Cross-cut shreds are harder to reconstruct
• Strip-cut is better than nothing
• Some companies use secure document destruction services

Visitor and Access Management

Who's in Your Building?

Every person in your workspace is either:

• An employee (verified and trusted)
• A verified visitor (signed in, escorted)
• A potential threat (unknown)

Visitor Best Practices

When expecting visitors:

1. Inform reception in advance
2. Meet them at reception
3. Escort them at all times
4. Ensure they sign out when leaving

When you see unknown people:

1. "Hi, can I help you? Are you looking for someone?"
2. If no badge/escort: "Let me get someone to assist you"
3. If suspicious: Alert security

Badges and Access Cards

Your badge:

• Should be visible at all times
• Never lend to others
• Report immediately if lost
• Don't hold doors for non-badge holders

Why it matters:

• Badges create accountability
• Access logs show who was where
• Lost badges should trigger access review

USB and Removable Media

The USB Threat

Found USB drives:

• Could contain malware
• Could be deliberately planted
• Curiosity is natural — don't plug it in

Real attack method: Attackers drop infected USB drives in parking lots, lobbies, and conference rooms. Curiosity does the rest.

USB Security Rules

❌ Never plug in unknown USB drives — Even to "see what's on it"

❌ Don't use personal USBs for work — Use approved cloud storage

❌ Don't leave USBs lying around — They're easy to steal or copy

✓ Report found USB drives to IT — They can analyse safely

✓ Use encrypted drives if needed — Company-approved only

✓ Keep track of your USBs — They contain data too

Real Example: Stuxnet (2010)

The Stuxnet malware was spread to Iranian nuclear facilities via infected USB drives.

How it worked:

• USB drives were planted where employees would find them
• Curious employees plugged them into air-gapped systems
• Malware spread through the facility
• Caused physical damage to centrifuges

The lesson: USB drives are a tried-and-tested attack vector. A few seconds of curiosity can compromise an entire network.