Getting staff to take it seriously...

[Gongalong]

Hi folks,

 

Having trained staff on this for several years, I'm at my wits end in trying to get them to take it seriously, having discovered the umpteenth unlocked laptop in a classroom, hardcopy sensitive data not locked away only days after repeated guidance etc.

 

What do other DPOs do to try and get staff to follow guidance and take it seriously?

 

Our approach so far:

 

- staff training, including refresher training (annually going forward)

- clear guidance including reference to it being a legal requirement, school policies, and inclusion in the staff code of conduct

- repeated guidance between training sessions

- penalties, including mandatory retraining for staff that are caught with unlocked laptops etc.

 

Interested to hear your thoughts and suggestions...

[Katy]

I've found they will only start to take it seriously when something actually happens to those doing it (e.g. disciplinary action) rather than just being written in a policy that doesn't in reality get enforced.

[RLR]

I've found they will only start to take it seriously when something actually happens to those doing it (e.g. disciplinary action) rather than just being written in a policy that doesn't in reality get enforced.

 

Yep, similar experience. It's a bit like health and safety training that everyone jokes about but it's there for a reason. People just don't take things seriously until it happens to them.

[peej2k]

I agree with Katy.

Unless some kind of tangible disciplinary action is taken against perpetrators they will have no reason to take it seriously.

When you say unlocked laptops, do you mean the lock screen or locked away? Are there not technical measures in place to lock screens after a few minutes?

[ShellfishClive]

It's a bit of an annoying process for you or someone else but you could take the key off them so they can't unlock it. When they want to unlock they have to request it from you and then you go back in and lock it back up when they are done.

[caffrey]

If you've exhausted every possibility, did everything you could and it's well documented - give up, it's not your problem that humans can't be fixed

[Andrew_C]

give up, it's not your problem that humans can't be fixed

If it is anything like H&S, it remains your (or the employers) problem.

[difinity]

Having a strong suspicion of who would have fingers pointed at them should there be a data breach, I'd record the instances and culprits and inform the head/BM/HR in writing outlining what repeated steps you've taken to train them. If they aren't already aware, impress the size of possible fines and put it on them to sort it.

[Gongalong]

When you say unlocked laptops, do you mean the lock screen or locked away?

Locked screen.

Are there not technical measures in place to lock screens after a few minutes?

Yes, 15 minutes. That's been the setting for a while, and inevitably it's a compromise between staff trying to use their PC and data protection. Changing it to 1 minute might make them think! Even so, that's 1 minute the PC's unattended. Definitely reduces the risk, but still a risk.

 

Thanks all for the comments so far. I agree that tougher sanctions, and recording and flagging up the incidents, are the way to go. I'm doing the latter.

[peej2k]

Locked screen.

 

Yes, 15 minutes. That's been the setting for a while, and inevitably it's a compromise between staff trying to use their PC and data protection. Changing it to 1 minute might make them think!

 

I don't know about 1 minute, but I would definitely be reducing that. I'd put it to 5 minutes perhaps, and then teach them where the freeze option is on their projector/screen should they need it to display that long without a password in the way.

GDPR doesn't discriminate in regards to how long it should be, but the law talks about "appropriate technical and organisational measures".

 

Your staff would hate what I'm putting in place. 2 factor authentication all over for every login. No non-encrypted memory sticks allowed and even then we only supply cloud based storage now. 5 minute screen locks.

Edited May 3, 2018 by peej2k

[Gongalong]

Freeze they know about (and love!) although definitely worth a reminder. It's just remembering that Win+L, and taking it seriously enough *fume*

[strawberry]

Introduce a grassing scheme. If you can take a suitable photo of someone else's failures the school pays £10 and the person gets taken into the office.

[IrritableTech]

We've started a sticker of shame scheme. When we come across an unlocked machine and the staff aren't in the room we lock it and place a sticker on their monitor informing them they have been caught.

 

Our senior leaders have agreed that those repeat offenders may be issued a management instruction as a first stage.

[StevieM]

People just don't take things seriously until it happens to them.

 

I've considered making a fake 'You have attempted to access pornography' page on our website and opening it on any unlocked laptops I find. Either that or leaving a Word document open that reads, 'Guess what I've been doing on your laptop...?'

 

Never quite had the courage to actually do it, though.

[witch]

I have been asked to reduce screen lock time to 15 mins from its current 45

It's a start, I suppose

[Gongalong]

We've started a sticker of shame scheme.

Good idea! Currently we contact those who were caught by email, and that's CC'd to some of the SLT.

[hardtailstar]

Introduce a grassing scheme. If you can take a suitable photo of someone else's failures the school pays £10 and the person gets taken into the office.

 

what happens after they go into the office??

 

We do a weekly log and send it to the head teacher. We dont actively search but just on walkabouts fixing classroom issues.

[RLR]

I don't know about 1 minute, but I would definitely be reducing that. I'd put it to 5 minutes perhaps, and then teach them where the freeze option is on their projector/screen should they need it to display that long without a password in the way.

GDPR doesn't discriminate in regards to how long it should be, but the law talks about "appropriate technical and organisational measures".

 

Your staff would hate what I'm putting in place. 2 factor authentication all over for every login. No non-encrypted memory sticks allowed and even then we only supply cloud based storage now. 5 minute screen locks.

 

Our screen lock is 10 mins for all machines except for classroom machines. This was set to 20 minutes. We have replaced our projectors with TVs which don't seem to have a freeze option!

 

We've put in 2 factor for staff. We've just enabled a bit locker policy to force USB encryption but still had backlash. All staff have google accounts and should be using google drive but there are quite a few people living their lives from a USB stick still. Plus, microbits and MBEDS act as USB storage devices which stops them working so we had to remove the bitlocker policy from certain machines.

 

We've now got the go ahead to enable 2 Factor for our students. This will be fun! They've all got iPads so can use an app as their 2 Factor step.

[korifugi]

I've had a small amount of success with creating a document containing nothing but lines (and pages worth at that) stating "All work and no play makes a dull ", leaving it up - then denying all knowledge of it.

 

I got a fair few to start locking desktops after a few instances of that.

 

The more resistant? I'd say you need SLT support and them to be dragged infront of annoyed management for it - it'll be the only way they get the hint (besides a vigorously applied cluebat).

[Gongalong]

We have replaced our projectors with TVs which don't seem to have a freeze option!

We thought we had the same issue after installing Promethean touchscreens, but thankfully found they have freeze. We have unwittingly bought some projectors without though, which causes great upset.

[David44]

Most people don't bother to lock their machines because it is too much effort if they are only going to be out of the room for a couple of minutes.

 

With that mindset in mind, is there such a product, or appetite for such a product that when a laptop is unlocked and the cause of the lock was due to the time-out, the machine doesn't let the user do anything for 10 seconds (or a configurable length of time). If the cause of the laptop locking was Windows+L, then once it is unlocked they can start working again straight away as normal. The idea being to make leaving the laptop unlocked more of an annoyance than locking it is. There are obvious edge cases where the machine will lock while you are in front of it speaking on the phone or similar but you could counter that by not applying the 10 second delay if the machine is unlocked less than 10 seconds after the time out locked it. The 10 seconds delay could be used to display GDPR facts (largest fine etc.)

[Bedders]

One of the best most evil was changing someone's New Email sound to the Shutdown one.

[Norphy]

Change their wallpaper to a picture of Rick Astley and tell them that it's staying until they learn how to lock their screens...

 

/edit This is a good one.

Edited May 3, 2018 by Norphy

[sted]

One of the best most evil was changing someone's New Email sound to the Shutdown one.

 

be funnier to edit the sound so its the normal email one followed by a few minutes of silence then something really annoying

[peej2k]

With that mindset in mind, is there such a product, or appetite for such a product that when a laptop is unlocked and the cause of the lock was due to the time-out, the machine doesn't let the user do anything for 10 seconds (or a configurable length of time). If the cause of the laptop locking was Windows+L, then once it is unlocked they can start working again straight away as normal. The idea being to make leaving the laptop unlocked more of an annoyance than locking it is.

 

Oh, well thats just a bit of evil genius! I'm not aware of a product like that, but I'm sure people would love it

 

Though I would have a ten second loop of this