1.4Lock your session & secure your workstation
The essentials in 30 seconds
- The reflex when standing up: lock your session at every departure, even 2 minutes — one second is enough.
- The automatic safety net: locking after 5 minutes maximum + locked phone — manual stays the rule.
- The clean desk: individual session never lent + documents filed, no visible password.
Threaded mini-case — Karim locks everything going to lunch
Karim leaves for lunch with his session open “just 2 minutes”: a passing visitor could have sent an email in his name. Since then, he locks his session at every departure, set auto-lock to 5 minutes, locks his work phone and files away sensitive documents and sticky notes. When a colleague asks him for “just 2 minutes” on his session, he offers the guest session.
Sequel to cases 1.1-1.3 — Karim physically protects the maintained workstation.
1. The locking reflex
A workstation left unlocked for 5 minutes in an open space means a curious visitor can do anything in your name: send an email, read your files, install software. The reflex: lock your session every time you leave your workstation, even for 2 minutes.
Karim trains himself to automaticity: standing = locked, without thinking, even for a coffee.
2. Auto-lock as a safety net
Set automatic locking (screen locking after 5 minutes maximum): it is a safety net, the manual reflex stays the rule. Also enable locking on the work phone (code or biometrics) and disk encryption in case of theft.
Karim sets 5 minutes maximum and locks his phone: the net does not replace the gesture, it catches it.
3. Physical security
An individual session (never shared) conditions traceability. The privacy screen and the clean-desk policy (no sensitive documents or password sticky notes) matter as much as digital.
Karim files his documents and refuses to lend his session: everything done under his login is attributed to him.
Office bloopers (never do this)
Moral: one second of locking beats weeks of explanations after an incident.
🔎 Concrete example — 🔎 Concrete example — Workstation habits
One second that protects everything.
Stand up → lock the session, until automatic.
Auto-lock 5 min max + locked work phone.
Desk tour: documents filed, no password visible.
→ the workstation no longer betrays anything, even on breakTakeaway: manual first, automatic as a net.
Lesson: individual session = traceability, not mistrust.
Section vocabulary
- Session locking
- Locking when leaving your workstation: the one-second gesture preventing physical access to your data and email.
Simple example: The reflex Karim applies leaving for lunch, even 2 minutes.
What it is not: only switching the screen off while leaving the session open.
Reflex: standing = locked, no exceptions.
- Individual session
- One account per person, never a shared session: traceability and accountability depend on it.
Simple example: Karim offers the guest session instead of lending his own.
What it is not: lending your session “just 2 minutes” to a colleague.
Reflex: every act under your login is attributed to you.
- Privacy screen
- A physical filter or vigilance in open space and travel: prying eyes are a discreet but real leak.
Simple example: Karim turns his screen away from the corridor and watches for glances on the train.
What it is not: a screen readable from the corridor with sensitive data.
Reflex: who can read my screen from where I am?
- Clean-desk policy
- No sensitive documents or password sticky notes visible: tidying is a security measure.
Simple example: Karim's tidied desk before each break: nothing sensitive out.
What it is not: password sticky notes stuck on the screen.
Reflex: when leaving: nothing sensitive on the desk or screen.
In practice — In practice — Secured-workstation habits
- Train the reflex: when standing up, lock your session. Repeat until automatic.
- Set automatic locking: screen locking after 5 minutes maximum.
- Enable locking on your work phone (minimum 6-digit code or biometrics, lock at 30 seconds).
- Tour your desk: sensitive documents filed, no password visible, screen unreadable from the corridor?
Ready-to-say script — refuse to lend your session (20 s)
“I cannot lend you my session: everything done in it will be attributed to me. I will open the guest session for you — or log in on yours — and I am back in 5 minutes.”
Say politely to the hurried colleague; always offer the alternative (guest session).
Copy-paste template — clean-desk check
REFLEX: stood = locked [ ] trained this week [ ]
AUTO: screen 5 min max [ ] | phone (6 digits or biometrics, 30 s) [ ]
DESK: documents filed [ ] | no password visible [ ]
SCREEN: unreadable from corridor/train [ ] | session never lent [ ]Dense open space
All the more vital: visitors, contractors and cleaners circulate — systematic locking also protects your neighbours.
Office in Algiers
Karim applies his internal charter guidance and asks his manager when in doubt: the company's local rule comes first.
Remote work / train
At home or travelling: same reflex + oriented screen and privacy filter — prying eyes travel too.
Insistent colleague
Stay firm and friendly: offer the guest session or their own session — a real colleague understands traceability.
✓ Best practices
- Stood = locked.
- Auto 5 min as a net.
- File + orient screen.
✗ Common pitfalls
- “Just 2 minutes” open.
- Session lent to a colleague.
- Screen readable from the corridor.
Key takeaways
- Lock your session when standing up: THE physical reflex of office security.
- Automatic locking as a net (5 min max) — the manual reflex stays the rule.
- An unlocked session = your email, files and identity offered to whoever passes.
- Physical security matters as much as digital: screen, documents, sticky notes.
48h Challenge - apply tomorrow
Lock at every departure for 2 days (template above), set auto to 5 min max and file all password sticky notes. 20 minutes is enough.
- I can cite the reflex + the net (5 min max).
- I know why you never lend your session.
- I locked 2 days + set auto + tidied my desk.
Frequently asked questions
Among trusted colleagues, is it really needed?
Yes: visitors, contractors, cleaners circulate too — and if an incident occurs, an open session makes it impossible to know who did what. It is not about trust, but traceability.
What if a colleague asks for “just 2 minutes” on my session?
The right answer is the guest session or THEIR session: everything done under your login is attributed to you. The IT charter usually bans it in black and white.
Karim leaves his workstation for a coffee. THE reflex?