Store Security Is Seriously Slipping

I work in internal IT for a retail company. A friend used to work in the same department, but she and her husband relocated. At the time, we didn’t have remote options for tech, so she transferred to work in one of the stores.

In the middle of her first week, I got a direct message from her.

Friend: “[My Name]!”

Me: “How’s [New Store]?”

Friend: “Security violations everywhere!”

Me: “Oh?”

Friend: “The store manager has her username and password written on a sticky note on her monitor. I asked her why, and she said it’s so if someone needs her computer when she’s not here, they can get on. Apparently, she’s told all the managers to do that, too.”

I sent a face-palm emoji.

Friend: “She’s also got the safe code written on another sticky on her monitor. And I’m pretty sure I saw the door codes on another one.”

I sent a string of facepalm emojis.

Friend: “And one of the shared laptops had its BitLocker key taped to the lid.”

Me: “What? Who would do that?! [Onsite Support] should know better!”

Friend: “Pretty sure it was one of the customer service people who thought she was helping because this device keeps asking for it. I already checked, and [Onsite Support] is going to be reimaging the device, but they had to go help with [Other Store].”

Me: “I know I always tell people they cannot write it down. But I also know people don’t listen. I just really hope it wasn’t one of our people who told her that was okay.”

Friend: “I don’t think it was because of that. Based on some conversations I’ve had with her, she’s really nice, but she doesn’t understand technological security at all. She also has her password written down and hands it out to any employee who asks.”

Me: “Oof.”

Friend: “I will whip this place into shape!”

She ended up going to another job a few months later, but by the time she left, the store understood: A) you do not, under any circumstances, give out your password, B) for something that might need to be documented somewhere (like a safe combination or door code), you don’t put it on a sticky on your monitor, and C) you never attach a BitLocker key to the computer it’s used for, especially when said computer sits on a counter where anyone could potentially snatch it without being immediately noticed.