🟠 High | Source: The Register — Security
An IT department attached sticky notes containing login credentials directly to employee laptops, leaving usernames and passwords physically exposed. This allowed an unauthorised individual to gain access to systems using the visible credentials. The incident highlights how even basic physical security oversights can completely undermine technical controls.
Security Architect’s Take: Conduct a physical security audit across your organisation’s office and remote working environments to ensure credentials, MFA codes, and access tokens are never written down or left exposed. Enforce passwordless authentication or SSO with MFA to remove the need for users to remember or write down passwords entirely.
Original advisory: IT department put sticky notes on the laptops to help employees log in