Lost devices, unknown USB drives, and charging points

Devices get lost and stolen. Bags are left on trains, phones vanish from cafe tables, cars get broken into. What turns a lost device into a serious incident is usually not the loss itself, but a slow or silent response.

Report it fast, even if it's embarrassing

If a work device, or a personal device used for work, is lost or stolen, report it to IT immediately. Do not wait a day hoping it turns up, and do not stay quiet because you feel foolish. Speed matters because IT can remotely lock or wipe the device, revoke its access, and reset your credentials, but only once they know. An honest report an hour after the loss is a minor event. The same report three days later, after accounts have been accessed, is a genuine breach. Nobody should ever be punished for reporting a loss quickly; the mistake is concealment, not the loss.

Unknown USB drives

A USB drive found in a car park, meeting room, or hotel lobby is not free storage, it is a classic attack. Drives can carry malware that runs the moment they are plugged in, and "dropped" drives are a well known way of getting malicious code inside an organisation. Never plug an unknown USB drive into a work device. Hand it to IT instead. Be equally cautious with free promotional USB sticks from events, and with cables or accessories of unknown origin.

Public USB charging points

USB carries data as well as power. A tampered public charging point in an airport or hotel could attempt to access a connected phone. The risk in practice is low but the defence is cheap: charge from your own plug adapter in a mains socket, carry a power bank, or use a charge-only cable or "USB condom" adapter that physically blocks the data lines. Plugging your own charger into a wall socket is always safe; plugging your phone into an unknown USB port is the thing to avoid.