Forget hacking! A considerable fraction of unauthorized access occurs when someone sits down at somebody else’s computer. 

Recent research from Gartner Research has drawn attention to the risks of insider attacks as countless corporations turn a blind eye to the fact that unattended PCs facilitate clandestine access to sensitive information.

“Unattended PCs represent the computer security equivalent of ‘low hanging fruit’,” said Jay Haiser, Gartner’s research vice president.   “Organisations are protecting their systems and personnel against external security threats but failing to realise the very real risks that exist internally from something as basic as an unattended PC.”

The main risk is that confidential information could be secretly accessed and changed in an attempt to carry out fraud.  Concern also arises from the fact that employees can send out bogus or prank emails in another employee’s name.  Almost everyone in IT has heard a story where someone played a joke on someone else by sitting at that person’s PC and sending out an embarrassing email in the other person’s name.

Whether a joke email or access to highly sensitive information, people use what Gartner calls the “someone else used my PC” as a way of denying any wrongdoing.  If their company cannot prove the malicious activity was done by the person using the PC, discipline is difficult.

“Relatively simple solutions are available to address the problem but few organisations have implemented them,” Haiser said. 

One option is proximity tokens.  These tokens automatically disconnect and reconnect users depending on how close they are to their workstations.  Tokens reduce the risk of unauthorized access, but require employees to carry a physical token that can itself be stolen.

Another option is “timeouts”.  Gartner suggests timeouts ensure users are automatically logged out of sessions after their computers have been unattended for a certain amount of time. Gartner’s guidelines suggest a PC should time-out after 15 minutes and a laptop after 10 minutes. 

Regardless of implementing timeouts or tokens, Gartner urges organisations to protect internal PCs.  According to Haiser, “There is little point implementing some sort of sophisticated identity and access management system unless you can ensure that when people are logged into systems they stay at their PC.”