National CERT Warns Pakistani Staff About Security Mistakes That Could Expose Critical Facilities to Hackers
Pakistan’s National Cyber Emergency Response Team (National CERT) and the National Telecommunication Corporation (NTC) have urged workplace personnel to strengthen physical security practices, warning that seemingly minor mistakes can expose sensitive facilities and organizational networks to unauthorized access.
The advisory highlights everyday security lapses, including sharing identification badges, allowing unknown individuals to enter restricted areas, leaving computer screens unlocked, and connecting untrusted USB devices to workplace systems.
Issued as part of Cyber Month 2026, the guidance emphasizes that protecting digital infrastructure requires more than firewalls and cybersecurity software. Physical access to offices, computers, documents, and network-connected equipment can also create opportunities for security breaches.
Small Workplace Mistakes Can Create Major Security Risks
Organizations often invest in digital security tools but overlook routine workplace practices that can help prevent unauthorized access.
According to the reported advisory, employees should remain alert when entering secure facilities, keep their identification badges under their control, and avoid allowing people without proper authorization to follow them through secured entrances.
These precautions are particularly important in workplaces that handle confidential information or operate sensitive infrastructure. An unauthorized person who enters a restricted area may gain an opportunity to access unattended equipment, view documents, or attempt to connect an unapproved device.
The warning reinforces a basic security principle: access should be granted only to people who have the appropriate authorization.
National CERT and NTC Highlight Key Security Precautions
The advisory identifies several practices that personnel should follow to reduce the risk of physical security breaches.
| Security risk | Recommended precaution |
|---|---|
| Shared or unattended ID badges | Keep identification badges secure and never lend them to another person. |
| Unauthorized entry into restricted areas | Do not allow unknown or unauthorized individuals to follow you through secured doors. |
| Unlocked computer screens | Lock the screen whenever leaving a workstation unattended. |
| Exposed documents and passwords | Keep sensitive papers, notes, and credentials out of sight. |
| Unknown USB drives or devices | Do not connect untrusted USB storage devices, chargers, or other equipment to workplace systems. |
| Suspicious activity | Report potential security violations to the relevant security team promptly. |
These measures are straightforward, but they can help reduce opportunities for unauthorized access when consistently followed by employees and contractors.
Why Sharing an ID Badge Can Be Dangerous
An identification badge is not simply a way to identify an employee. In workplaces with controlled access, it may also be linked to permission to enter particular buildings or restricted areas.
Lending a badge to another person or leaving it unattended can weaken those controls. It may also make it harder for security personnel to determine who entered a facility and whether that person was authorized.
Employees should therefore keep their badges secure and follow their organization’s procedures for lost, stolen, or damaged credentials.
Visitors should use the official registration and authorization process rather than relying on informal access arrangements.
What Is Tailgating in Physical Security?
Tailgating occurs when an unauthorized person enters a secured area by following an authorized individual through a controlled entrance without using their own credentials.
The practice can succeed when employees hold a door open out of courtesy or assume that someone walking behind them belongs in the facility.
National CERT and NTC have advised personnel to avoid allowing unknown individuals to enter restricted premises in this way.
Employees should follow workplace visitor policies and contact security staff if someone attempts to enter a restricted area without proper authorization. Security procedures should make it possible to challenge suspicious access attempts professionally and safely.
Unlocked Computers and Exposed Documents Can Reveal Sensitive Information
Leaving a computer unlocked, even briefly, can create an opportunity for someone nearby to view information or interact with an unattended session.
Similarly, documents, handwritten notes, and passwords left on desks may be visible to people who do not have permission to access them.
The advisory recommends locking computer screens when leaving workstations unattended and following a clean-desk policy.
Organizations can reinforce these practices through automatic screen-lock settings, appropriate document storage, secure disposal of confidential papers, and clear rules about handling passwords.
Employees should never leave sensitive credentials in easily accessible places.
Unknown USB Devices Can Put Workplace Networks at Risk
Connecting an unfamiliar USB drive or other unapproved device to a work computer can introduce cybersecurity risks. Depending on the device and the system involved, it may expose the computer to malicious software, unauthorized data access, or other security problems.
The reported advisory cautions personnel against connecting unknown USB drives, chargers, and similar devices to workplace systems.
Employees should use only devices approved by their organization and contact the IT department if they find an unfamiliar device or need to transfer files using removable storage.
They should also avoid assuming that a device is safe simply because it looks ordinary or was left in a familiar location.
Employees Urged to Report Suspicious Activity
National CERT and NTC have encouraged personnel to report suspicious activity and possible security violations to their respective security teams immediately.
Examples may include an unfamiliar person attempting to enter a restricted room, a missing access badge, an unexpected device connected to a computer, or sensitive documents left exposed.
Reporting such incidents quickly can help an organization assess the situation and take appropriate action. Employees should follow established internal procedures rather than attempting to investigate potentially dangerous incidents themselves.
Why Physical Security Matters for Pakistan’s Digital Infrastructure
Cybersecurity is often associated with software vulnerabilities, malicious links, stolen passwords, and online attacks. However, digital systems also depend on the security of the physical environments in which they operate.
Unauthorized access to a workstation, server room, communications facility, or other restricted area can create risks that digital controls alone may not fully address.
For organizations responsible for sensitive data or critical services, security therefore requires a combination of access controls, staff awareness, device management, monitoring, and incident reporting.
The Cyber Month 2026 awareness campaign, carrying the message “Stay Aware, Stay Secure,” is intended to encourage stronger security habits and greater vigilance in protecting Pakistan’s digital infrastructure.
What Employees and Organizations Should Do Next
Employees can help improve workplace security by following a few consistent habits:
- Keep identification badges secure and never share access credentials.
- Challenge or report unauthorized entry attempts according to workplace procedures.
- Lock computer screens before leaving workstations.
- Keep confidential documents and passwords out of sight.
- Avoid connecting unknown or unapproved devices to work computers.
- Report missing badges, suspicious activity, and potential security incidents promptly.
Organizations should complement these habits with clear access-control procedures, staff training, automatic screen-lock policies, approved-device rules, and a reliable process for reporting incidents.
Conclusion
Pakistan’s National CERT and NTC have highlighted how routine workplace oversights can undermine the protection of sensitive facilities and digital systems. Sharing access badges, allowing unauthorized entry, leaving computers unlocked, and connecting unknown devices are avoidable risks that deserve attention.
The message is simple: effective cybersecurity starts with everyday behaviour as well as technical safeguards. Consistent physical-security practices can help organizations protect sensitive information and reduce opportunities for unauthorized access.
Editorial note: This article summarizes the reported advisory. Confirm the original advisory and any additional instructions through official National CERT or NTC channels before publishing further details.