Chapter 6 — Warehouse PCs
Lesson map
Lesson 06 published. Map, example, EX026.
flowchart TD
N0["Learning outcomes"]
N1["6.1 The environment"]
N2["6.2 Individual sign-in"]
N3["6.3 Agents"]
N4["6.4 Encryption timing"]
N5["Physical security"]
N6["Working with warehouse managers"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX026"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["6.1 The environment"]
N2["6.2 Individual sign-in"]
N3["6.3 Agents"]
N4["6.4 Encryption timing"]
N5["Physical security"]
N6["Working with warehouse managers"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX026"]
[Learning outcomes]
|
v
[6.1 The environment]
|
v
[6.2 Individual sign-in]
|
v
[6.3 Agents]
|
v
[6.4 Encryption timing]
|
v
[Physical security]
|
v
[Working with warehouse managers]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX026]
Learning outcomes
You will (1) harden shared PCs; (2) replace shared logons; (3) deploy agents.
6.1 The environment
Warehouse PCs run the warehouse system, label printing and a browser. They are used by shift workers who share logons, which makes it impossible to tell who did what. Shared logons also mean that any action, from a label printed in error to a stock adjustment, cannot be traced to a person. The PCs sit on warehouse floors and are used around the clock across shifts, so any change must not slow workers or interrupt the warehouse system. Seun spends a shift observing how they are used before proposing anything, and the warehouse managers agree the plan with him.
6.2 Individual sign-in
Seun introduces badge-based quick sign-in so each worker uses their own account without slowing shift changes. The restricted desktop shows only the needed apps. Quick sign-in means each action in the warehouse system is linked to a named worker, which answers the director's concern about accountability. Badges are already issued for building access, so workers do not carry anything new. The restricted desktop reduces what can go wrong on a shared PC. Seun pilots the change on one shift first and adjusts the sign-in time after workers report delays at shift change.
6.3 Agents
The detection agent is deployed to the nine warehouse PCs missing it. Two are too old to run it and are scheduled for replacement. Before deployment, nine of the forty warehouse PCs did not report the agent. After deployment, only the two old models remain without it, and they are listed in the exceptions register until replacement, with their isolation recorded. Seun checks that newly deployed agents actually report to the console, rather than relying on the installation result. The warehouse managers are told which PCs are being replaced and when.
6.4 Encryption timing
Encryption is applied as PCs are replaced, matching the risk ranking. Since unencrypted warehouse PCs ranked lowest, Seun does not encrypt the existing older machines, many of which lack the hardware support needed. Instead, replacement PCs are bought with encryption-capable hardware and encrypted before they reach the warehouse floor. The warehouse encryption figure therefore rises gradually as PCs are replaced. Seun reports it monthly with the replacement schedule, so the director can see when the group will be fully encrypted. The decision is recorded in the evidence pack with the risk ranking that supports it.
Physical security
Warehouse PCs are in busy areas. Their USB ports are restricted to approved barcode printers and scanners, and the cases are locked so drives cannot be removed easily. The firmware has an admin password so boot settings cannot be changed.
These physical controls support the decision to delay encryption: an unencrypted drive is less of a risk when it cannot easily be removed or read from another system.
Seun records these controls in the exception entry for warehouse encryption, so the reasoning for the delay is visible to auditors.
Working with warehouse managers
Seun runs the badge sign-in pilot on one shift with a warehouse manager present. Workers find it faster than typing the old shared password, and the manager becomes the change's champion for the other shifts, which matters more than any instruction from IT. Afterwards, warehouse system actions show individual names, which the operations director confirms is what was needed after last year's stock discrepancy. The two PCs too old for the detection agent are replaced in month three with models that support both the agent and encryption, closing their exceptions and adding them to the encrypted count.
Worked example
Within a month, all warehouse PCs except the two old ones report the agent, and shared logons are retired.
Synthetic case. Figures are synthetic.
Errors and limits
Individual sign-in that slows shift changes will be resisted; speed matters.
Exercises
- EX026 — Shared logon problem. What problem do shared logons create? Rubric: 3 = no accountability;; 2 = tracing;; 1 = vague;; 0 = none.
- EX027 — Badge sign-in. Why badge-based sign-in? Rubric: 3 = fast individual access;; 2 = speed;; 1 = vague;; 0 = none.
- EX028 — Old PCs. How are PCs too old for the agent handled? Rubric: 3 = exception and replacement;; 2 = replaced;; 1 = vague;; 0 = none.
- EX029 — Restricted desktop. What does the restricted desktop limit? Rubric: 3 = apps available;; 2 = access;; 1 = vague;; 0 = none.
- EX030 — Encryption plan. Why encrypt warehouse PCs on replacement? Rubric: 3 = low risk, hardware age;; 2 = later;; 1 = vague;; 0 = none.
Synthesis
Shared PCs can be accountable and protected without slowing work.
Continue studying — chapter 06 of 12
← Chapter 05 (draft) · Course chapter index · Chapter 07 (draft) →