Within your organization, is every developer required to lock his workstation when leaving it?
What do you see a risks when workstations are left unlocked, and how do you think such risks are important compared to ‘over-wire’ (network hacking) security risks?
What policies do you think are most efficient to enforce locking the workstations? (The policies might be either something ‘technical’, like a domain group security settings for screen-savers to be locking, or a ‘social’, like applying some penalties to those who do not lock, or encouraging Goating?)
For me, this has become habit. On a Windows machine, pressing Windows-L is a quick way of locking the machine.
The solution might be social rather than technical. Convince people that they don’t want anyone else reading their email or spoofing their accounts when they step away.