All users should be made aware of the security requirements and procedures for protecting unattended equipment, as well as their responsibilities for implementing such protection. Users should be advised to: a) terminate active sessions when finished, unless they can be secured by an appropriate locking mechanism, e.g. a password protected screen saver; b) log-off from applications or network services when no longer needed; c) secure computers or mobile devices from unauthorized use by a key lock or an equivalent control, e.g. password access, when not in use. (NL ISO/IEC, 2015) 11.9. Clear Desk and Clear Screen Policy A clear desk policy for papers and removable storage media and a clear screen policy for information processing facilities should be adopted. The clear desk and clear screen policy should take into account the information classifications, legal and contractual requirements and the corresponding risks and cultural aspects of the organization. The following guidelines should be considered: a) sensitive or critical business information, e.g. on paper or on electronic storage media, should be locked away (ideally in a safe or cabinet or other forms of security furniture) when not required, especially when the office is vacated; b) computers and terminals should be left logged off or protected with a screen and keyboard locking mechanism controlled by a password, token or similar user authentication mechanism when unattended and should be protected by key locks, passwords or other controls when not in use; c) unauthorised use of photocopiers and other reproduction technology (e.g. scanners, digital cameras) should be prevented; d) media containing sensitive or classified information should be removed from printers immediately. A clear desk/clear screen policy reduces the risks of unauthorized access, loss of and damage to information during and outside normal working hours. Safes or other forms of secure storage facilities might also protect information stored therein against disasters such as a fire, earthquake, flood or explosion. Consider the use of printers with PIN code function, so the originators are the only ones who can get their print-outs and only when standing next to the printer. (NL ISO/IEC, 2015) 12. Management of Removable Media Procedures should be implemented for the management of removable media in accordance with the classification scheme adopted by the organization. The following guidelines for the management of removable media should be considered: Lebanese National Security Policy Guidelines v1.7 Page 41 |