This doesn't seem to always work.
Also (perhaps related?): when I close the lid of the laptop when it's connected to the Thunderbolt display, how do I make the display go black?
Basically, I am trying to increase security on my setup overall, if I leave my desk.
If you want to make sure the external display goes to sleep when you close your macbook, make sure you don't have a power adapter, external keyboard, or mouse connected, then close the lid.
Reference: http://support.apple.com/kb/ht3131
If you want the machine to require password after you sleep it:
You can't be 100% sure that the display will lock when closing the lid.
The only way you can be sure is to lock the screen before you close the lid and then close it. I use LaunchBar to lock the screen with key commands and/or sleep the OS.
The exceptions to locking are when the machine detects that a closed clamshell event has happened (connected to power, USB and an external display) while the system detects the lid closed.
The other exception is when the sleep sensor doesn't trigger (or was triggered and dismissed) or the system doesn't process that signal in a timely fashion. I have seen times when the OS is blocked enough to not sleep the lid for some time or even some hours when the system was frozen. They are rare, but do happen from time to time. Also, the hardware itself can become faulty or inconsistent even when the software is processing all SMC / environment signals properly and in a timely fashion.
There are many threads here covering these details:
The last question explains how Control + Shift + Power keys along with the setting to require a password immediately will rapidly put your Mac in a secure state requiring a password to use it.
Your question specifically asked for making your MacBook more secure when you leave your desk. Here are a couple more suggestions for you to consider depending our your needs:
In Keychain Access.app each Keychain can have its own lock settings. By default you should have a login and a System keychain. Right click on the keychain and you can set it to Auto-lock immediately on Sleep. Or you can set an inactivity timer. Thus, you can lock your Keychain independently of other system wide locking settings. Additionally, you can create different keychains with their own locking timings based on the importance of the credentials you save.
You can look at various apps that Lock your system based on the proximity a BlueTooth device such as your smartphone. You can find several of these apps in the Mac App Store or via MacUpdate.com. However, most of these apps seem to have poor reviews.
10 years ago I had such a system setup with my first Nokia with Bluetooth, the Salling Clicker app and an AppleScript. Today, I would use EventsScripts to trigger a locking script when your BlueTooth phone is out of range. To prevent false triggers, EventScripts allows you to set the BlueTooth signal sensitivity and how many times to retry before triggering a script. You would use this scripting to lock the screen:
do shell script "/System/Library/CoreServices/'Menu Extras'/User.menu/Contents/Resources/CGSession -suspend"
Such a BlueTooth based trigger is not perfect, but it does add another layer of automation to secure your Mac without you having to remember to take action.
My company set a policy that only requires the password after 15 minutes of inactivity.
I was able to lock my MacBook using BetterTouchTool, connecting the Did Close MacBook lid trigger to the Lock Screen action.
