Classic psychological manipulation
See the "gold phone" in Ocean Eleven 3.
Official BOFH logo (red rotary telephone with devil's tal and devil's horns) BOFH logo EPISODE 11 "And uh... what are you doing?" the Head of Security asks, entering the Security office as I'm making my way to the exit – with a PC under my arm. "Just taking this back to the office to archive the contents and then reset it to …
There was a time when he employed a small explosive charge to physically destroy a laptop when accessed incorrectly.
" The next day I roll in at about 9:30 in time to be summoned to the CEO's office.
"WHAT THE HELL IS GOING ON?" he rants.
"About what?" I ask, innocence personified.
"THAT BLOODY EXPLODING NETWORK CARD THAT CARSON IN PR GOT!"
"Exploding network card? What explo.. Oh dear. He didn't try to install a SECURE-network card in his machine did he? I told him yesterday to be careful about installing and configuring it. They're programmed to self-destruct if someone attempts to override their access parameters..."
"By self-destruct you mean..?"
"Well there's a tiny nitrate charge in them which burns out the circuitry.."
"Or perhaps blows a hole the size of a saucer through the laptop in question?"
"They DID have teething problems with the first batch, which is why I had them recalled to the equipment room in preparation to send them back to the manufacturer. But it shouldn't have been used in the first place. I warned Carson yesterday when he asked, it's all on the voice tapes..."
http://bofharchive.com/1995/bastard95-06.html
Anything carried by the BOFH or the PFY should be considered and treated as nuclear weapon about to explode when they relinquish it.
But unless you're yourself a BOFH or a n educated PFY, there's no way to know that.
Now when you're an upcoming Security Type that probably knows more about guard dogs than computer and networks it's easy to hook you... On stuff.
(for reference, been there, got called to fix a broken Active Directory because the upcoming security type had no clue and played with backup restore as if they were windows update checkpoints... It made a mess in Kerberos and in the end they had to rebuild one of the two AD server from scratch... and yes they were Security Types that thought they had a clue... and as an added bonus it got my employer back in that contract [we had been put on the side... because Corporate Politics])
You might be slightly off the mark there. Security are usually the gatekeepers to a wealth of shiny things, allowing their preferential clients swing door access for nothing more than a quick back scratching.
Of those I knew, they had to get a new uniform every few months as the back of their jackets looked like they'd been mauled by a tiger.
After one security guard at a prestigious insurance company grumbled that I was "doing stuff" at his reception security seat and tried it on ( I was patching the network port after it received a kick) AND complained to management he found that his PC often remotely shut down.
Funny what a batch file can do.
So this security chap says he didn't steal any laptops and they must have been planted? Sure, let's check the video for this area.
[...]
Would you look at that? Ransomware on the system with all the surveillance files. We've lost everything before the latest off-site backup. This is what happens when you don't scan computers when they've been incompetently managed.
[...]
My fault? If you'll remember, our friend here in security required their network segmented off and forbade us to scan machines for malware. In fact, I have a video of him refusing to let us disinfect a machine because I was documenting the asset labels of the ones I was removing, and I have this recording of a call where my boss accepted that. You know, if you think there was planning, it certainly seems like it was this security fellow, possibly with my boss. Malice or incompetence, it goes the same way, but I think it's both.
.. security (!) were baffled by a whole series of laptop thefts. So, much to the displeasure of the site senior management, a bag search mandate was put in - every staff members bag had to be searched on exit and, if they had a laptop in their bag with no authorisation form, countersigned by their manager *and* director, they would be in trouble.
They caught a few - investigation showed they were genuine mistakes and not attempts to nick stuff.
Laptops carried on going missing. Tens of them (in the days when laptops were *seriously* expensive. We IT wallahs didn't qualify for them, we had to make do with old, virtually steam-powered desktops. Only managers and their favoured minions got them and, allegedly, locked them up in their lockable drawer every night.)
A lucky event solved the problem. One of the security guys [1] was having a furtive smoke out the back [2] and saw a cleaner throwing something into the big wheelie big - something suspiciously rectangular in a standard rubbish bag.
When the cleaner had gone back inside, stealthy smoker checked. Inside the rubbish bag, lightly wrapped in torn-up printouts, was a nice, almost-shiny, laptop.
Further investigation showed that a couple of the cleaners had got hold of master keys for the desk units and, every so often, would open them up and nick stuff. Laptops would then be well-wrapped up and put into the usual rubbish bags (which didn't get searched. Lots of cleaners, only 3 security guards overnight). Then the guy from the company that picked up the wheelie bins would be tipped off and extract the loot and flog them, sharing the money with the on-site cleaners.
Much to everyone's relief, the bag-search policy was dropped forthwith.
[1] In those days they were all male, mostly ex-squaddies.
[2] It was, allegedly, a smoke-free site except for the cancer-cabin room (the one with the walls liberally streaked with tar despite the ferocious aircon) as the site itself used a *lot* of solvents. But access to the smoking room was monitored and the security staff were only allowed two smoke breaks per shift so, if they wanted more, they'd just announce they were doing a 'perimeter check' and wander outside to have a smoke. Everyone knew but no-one did anything.
How times have changed. Now the company I work for snags your laptop if you leave it in the office overnight. You are expected to take it with you every night.
I only forgot mine once, during my first week many years ago. I had to do the walk-of-shame to the security desk and ask for my laptop back.
Why don't I lock it up in my desk? Because *I* don't have a desk anymore. *We* have minimal standing desks in open-seating areas with nowhere to store anything.
It's fine I guess, I don't love it, but I've gotten used to it.
At my university we had security steal PCs from the lab. Yeah, the PC was one thing. The data acquisition hardware inside? That was really bloody expnsive - and probably no real resale value because the market was pretty small. Really, nicking a PC that was maybe 2000 EUR or something and causing a damage to the institute of more like 30000 EUR.
And then there was the episode when copper thieves stole the piping for the Helium system causing a massive leak.
By contrast, I once worked in a secure place where personal IT was among the recording devices forbidden because security. We had to leave it at the desk on the way in. There was a big list - no dictaphones, memory calculators, iPods, floppy discs, game cartridges, etc (It was a long time ago).
When Psion launched the Series 5 PDA, I got one that same evening. A big feature was voice recording, which you could use with it closed. Not long after that I realised I was walking into work with it in my pocket. Stopped at the desk. "Not on the list mate, you're free to take it in".
Used it strictly according to the book: just as my personal note-taker etc, no sensitive stuff, serial connection or voice recording.
I was a subcontractor for the main contractor. One of their managers spotted it, realised what it was. A week later they were all prancing around with one, couldn't have me upstaging their IT chops. Inevitably, some mini-Boss was soon busted for breaking the rules, unable to resist the temptation to show off. But it was still a while before PDAs got added to the list on the way in. There were a good few Series 3s and the odd Atari Portfolio removed from desk drawers the next day...
I was once flying out to a North Sea oil platform and heliport security tried to stop me taking my Palm PDA. Not having it was going to cause me problems as it held a lot of the technical data I needed for my visit (inspecting one of the platforms main control systems which, if I couldn’t give it a clean bill-of-health, meant the platform would have be shut down - a VERY expensive consequence). I noticed another passenger was allowed to take their mobile phone, asked and was told they’re allowed. “In that case”, I said, “this is a mobile phone”. I clicked on the calculator app to show the “dialling buttons”. My bluff worked as I did it quickly and the security bod didn’t notice the buttons are in a different layout - they’d done their job of challenging and let me take it.