I am, however, appreciative of your comments and suggestions and will be making some changes in my own behavior and habits. But for me, it is all about trust, and it is still a sad thing that my own coworkers cannot be trusted. Temptation abounds, in all parts of our lives, and the same people that would never think of shoplifting, would easily access another’s computer files with no qualms whatsoever. I find that disturbing, at it’s very base.

Has your institution a mandatory class on computer security with signed acknolwedgement? If not, consider it pronto. It’s not about trust or lack thereof per say; it’s about the the law and/or procedural protection of your clients information.

Our desktops auto-lock at 5 minutes of inactivity. (Pain in the butt, but dem’s da’ rules…)

Something like you described would be grounds for IMMEDIATE termination in the IT department where I work, and a full investigation by the bank’s security and Compliance department as s result.

You mentioned: “Locking my computer because I need to go to the bathroom is paranoid and should be unnecessary, except in the case of a nosy coworker, which is really a whole other issue than campus network security.”

Sorry to say, but, No, you are wrong. You as much indicated it IS a security issue. People are human, and that is EXACTLY why the strict security measures are required. Doesn’t matter if it is a nosy or non-nosy coworker, or paranoia, or whatever.

Look at it this way – let’s say you step away for restroom break, and your superiors bring by a vistor, or perhaps a Federal or State Auditor stops in to see the department; what do you say then in reponse to your unlocked terminal?

Just a thought.

Think smarter, not harder.

You are (likely) subject to Sarbanes-Oxley and if the regulations had any real teeth, your management and/or trustees could be in court if any sort of breach incident was escalated to federal investigation, as leaving a workstation with an administrator’s credentials active in your environment (with dbs full of names and SSNs) could, at minimum, land a jumbo fine.

Just what are you thinking and why haven’t any of your people had any real IT security training? Doesn’t anyone there read the security industry news?

I, too, work for a university and even though I trust every member of my team, I hit Windows-L every time I leave the office. EVERY time. Of course, it’s almost automatic for me because of my former employment. We were required to lock our computers if we stepped away from our desk. If you were unfortunate enough to forget, you would get visited by the My Little Pony bandit. A young coworker that sat across from me who would change your wallpaper to a My Little Pony picture. Nothing harmful but it was an embarrassing reminder.

My point is, even if you trust the people you work with, don’t give them any temptation. I mean, you lock the door to the server room, don’t you?