in our 15-person software office everyone knows everyone, the door isn't locked. one day someone's portfolio was stolen — then we got scared that customer data could be stolen from our computers.
should we lock the computers? how is physical security ensured in the office?
budget is limited, we can't install expensive systems.
Physical security is very important. Servers and computers containing sensitive data should be in a locked room.
At employees' desks: Computers should have lock-out set (all devices locked before leaving). Make it a rule to use Windows + L (lock before leaving the computer).
Office entrance door: A keypad lock is sufficient (simple but effective). Assign someone to greet visitors.
we also work in an open environment..... anyway everyone has access to everything... we made a written rule that computers must be in away mode, it helped
Physical security checklist: 1. Office door keypad lock 2. 'Auto Lock' on computers (after 15 minutes) 3. Sensitive files in a locked drawer 4. Visitor log 5. Periodic security check
Doki · Vulnerability scanning · 2025
auto lock is a good thing employees forgot at first but it became a reflex after 2 weeks... honestly no one is left who doesn't lock their own computer
You can configure auto-lock settings on Windows using Group Policy (gpsec.msc). Everyone's computer should automatically lock after 15 minutes of idle time.
physical security gets overlooked but it's super important! btw attackers can copy files straight off a desk
edit: typed from phone, sorry for typos.
I've been dealing with this for a long time. Security isn't absolute; it's about making attacks not worth the effort.
The real issue isn't the number, but what it's based on. Hope this helps.
Doki · Log management setup · 2026
We need to make a distinction here. If the notification path is long, notifications don't arrive; missing notifications mean delayed incident detection.
The cheap-looking path usually ends up costing more later. If 2FA is on, a stolen password alone is useless.
This is my opinion I'm not claiming it's absolute truth.
Let me share what happened to me; it might be useful. Payment information changes are never verified through the channel they came from.
Just leaving this note, it might be useful.
Correct in theory, but it doesn't work that way in practice. Everything goes well for the first three months; problems arise in the fourth.
Hope this helps.
The opposite happened to me, that's why I'm writing. Everything goes well for the first three months; problems arise in the fourth.
If I were you, I'd go this route.
We need to take it step by step. An untested backup is not a backup.
Forgotten test environments are more often the entry point than live systems.
I agree with this. Forgotten test environments are more often the entry point than live systems.
Just leaving this note, it might be useful.
Don't miss this: Everyone rushing into office physical security gets stuck at the same point.
Proven by experience.
I was thinking the same thing. Solutions that work at a small scale collapse when you grow; I learned this late.
Proven by experience.
Timely topic. If it's your first time, start small; scaling comes later.
Forgotten test environments are more often the entry point than live systems.