Analyzing the three major risks in the workplace and creating a good feng shui for financial security

        In the concept of information security management, 'Physical&Environmental Security' has always been an important part. In this issue of "Information Network", we will re-examine the most commonly overlooked but easily occurring security risks from the perspective of office environment and work habits.

        Office security blind spots

                Modern people always like to study the "seat feng shui" of the office, such as whether there is a backrest and whether it faces the aisle, in order to improve work comfort and efficiency. Similarly, office desks can also be configured reasonably to create a "safe and sound feng shui" and reduce the risk of information leakage. Because many data breaches do not come from complex attack methods, but are hidden in the interactions of the work environment and gradually accumulate risks with usage behavior.

        Visual exposure risk: privacy protection, does not mean invisibility

        Many colleagues will install privacy protection devices on their laptops or mobile phone screens, hoping to enhance privacy protection and considering it 'sufficiently secure'. However, privacy goggles mainly reduce the visibility of others when viewed from the left and right sides, but cannot completely block the line of sight from behind, diagonally behind, or at higher angles. Therefore, if the seat is located behind the main aisle, open area, or facing a transparent glass partition, even if privacy goggles are installed, there may still be a risk of information exposure. Suggest starting with visual management to reduce risks, such as:

        Develop the habit of "locking the screen as soon as you leave your seat": For Windows systems, please press Win+L; For Mac systems, please press Ctrl+CMD+Q.

        Raise alertness: When handling highly sensitive data, dim the screen brightness or moderately change the screen angle to avoid facing directly towards the main aisle and areas with frequent pedestrian traffic.

        Risk of credential leakage: Changing password location does not necessarily mean it is more secure

        As password rules become increasingly complex, many people will record their passwords on sticky notes, under keyboards, or on specific pages of their laptops. However, these 'hiding places' only involve changing storage locations and are still frequently monitored in internal audits or external threat scenarios, so they have not reduced the actual risk. From the perspective of company management, the "Guidelines for Information Security Control of Listed and OTC Companies" also require the establishment of password management and sensitive data protection mechanisms. In addition to paying attention to password complexity, it also emphasizes that information should not be stored in the work environment in a form that is easily exposed. Suggest implementing desktop management from the following details:

        Do not leave paper passwords: Do not record account passwords, system URLs, or verification codes on physical paper.

        Implement desktop clearance: Do not leave any confidential paper when leaving work or sitting for a long time.

        Make good use of digital tools: Prioritize using password management tools approved or provided by the company to securely encrypt digital credentials.

        Sound has no boundaries: you thought it was just chatting, but it may have become a puzzle of information

        Most modern offices adopt open space designs, which facilitate quick communication and collaboration among teams, but can easily overlook the security of audio information. Please help me confirm the client's birthday, the supervisor will be on a business trip next week, the system cannot enter today, and the finance department needs to process a payment. These seemingly daily work conversations, if continuously collected and pieced together by malicious individuals, may form a complete information outline. After all, in social engineering attacks, attackers often do not need to directly obtain confidential information, but instead establish a trust foundation through fragmented information, making subsequent fake emails or phone calls more authentic. To ensure communication security, it is recommended to pay attention to the following principles:

        Implement environmental diversion: If personal or financial information is involved, it should be discussed in a conference room or enclosed space.

        Moderate volume control: Pay attention to the volume of calls and avoid discussing sensitive content loudly in public areas.

        Reduce digital footprint: Do not share internal information, system details, and other work content on social media platforms to reduce the possibility of information being used for jigsaw puzzles.

        Creating a 'safe and auspicious feng shui' for the office

        Reducing physical risks in the office environment does not necessarily require reliance on advanced technology. From keeping the desktop clean to casually locking the screen, seemingly small actions not only comply with the requirements of the international standard ISO 27001 for physical and environmental security control, as well as the core spirit of the "Guidelines for Information Security Control of Listed and OTC Companies" for the protection of sensitive data, personnel, and equipment, but also comply with the company's information security policies and management standards. Before leaving work today, why not spend 30 seconds rechecking your "security feng shui" again, because a truly stable security defense line is based on personal protective awareness and daily habits.

        invisible

        □ Lock upon leaving seat: Whether the screen is locked when leaving the seat.

        □ Eye protection: Is the screen placement angle adjusted appropriately.

        cannot get

        Desktop confidentiality: Have no confidential files or account information been left behind.

        □ The file has been consolidated: Has the basic desktop reorganization been completed.

        can't hear

        □ Discussion is divided: whether sensitive information has been moved to an appropriate space for discussion.

        Be alert in conversation: whether to avoid discussing sensitive content in public.

        *Image source: freepik

        #