Clean Desk Basics

Clean Desk Basics

The password on your desk is a password anyone can read.

What Is Clean Desk Basics?

A password written down beside a keyboard needs no phishing and no malware. Anyone allowed into the building can read it and sign in as you. In this exercise you leave your desk for the night with the screen unlocked and your notes where they are, watch what someone with a genuine badge does with them, then trace it through the portal log. You audit every note on that desk, destroy the ones that hand out access, rotate what was read, and lock the screen before you leave again.

What You'll Learn in Clean Desk Basics

Clean Desk Basics — Training Steps

  1. A call on the calendar

    Tuesday, 16:20. You are at your desk on the second floor. Devan in Ardwell IT has a short call booked to check your access to the Latchford client portal before tomorrow's review. A blank sticky pad sits by your keyboard, where it always does.

  2. Open the meeting app

    The call is a video meeting. You open it on your monitor.

  3. Join the review

    Devan is already waiting.

  4. Devan reads out the password

    Devan confirms your Latchford portal access is live and reads the password back to you so you can check it against your password manager.

  5. Jot it down

    You do what you always do on a call: you write it on the pad by your keyboard so you have it to hand.

  6. Was that needed?

  7. The call wraps up

    Devan signs off. It is nearly the end of the day. You head to the Birch room to set up for tomorrow, and from there you go home. The screen stays unlocked, and the note stays by the keyboard.

  8. After hours

    19:48. You badged out an hour and a half ago. The floor is empty, your monitor is still awake, and somebody is walking over to your desk. You were not here to see this. Watch it anyway.

  9. The note by the keyboard

    19:50. She does not move anything or open a drawer. She does not need to. The note is in plain view beside your keyboard, so she takes a photo of it.

  10. A genuine badge

    Nobody would have stopped her. She works for the building's cleaning contractor, and her badge is real: it opens this floor every weekday evening.

Security Framework Coverage

CWE

  • CWE-522 Insufficiently Protected Credentials

CIS Controls

  • CIS 14.4 Train Workforce on Data Handling Best Practices
  • CIS 14.5 Train Workforce Members on Causes of Unintentional Data Exposure

NIST CSF

  • PR.AT-01 Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind