We have a policy that everybody who leaves their laptop at the office must put it in a cupboard or cabinet when they leave for the day. To make this easier, all laptop users are also provided with docking stations. The policy was introduced many years ago after the office was broken into at night.
Does it make sense to continue enforcing this policy, or is it security theater?
Details about our environment:
- 40% of staff use remote desktop (no client data stored locally)
- 60% of staff use thick applications to access client data on the file server
- Client data is occasionally copied to laptops for use in the field
- Outlook is installed locally on all laptops and connected to an Exchange server
- We are insured against theft, but the deductible is close to the cost of a laptop.
- Privacy breach probably more expensive than loss of physical assets
- The server room is considered sufficiently secure (no windows!)
- Full disk encryption is being considered for all laptops