What you will learn: This tip outlines seven essential steps for protecting your company's laptops and offers practical advice on what you can do to get beyond the basics and develop a new mindset about laptop security.
Do you know where your laptops are and how they're being handled? Probably not -- that's the essence of mobile computing, right? Perhaps the more important issue is whether or not you feel confident that sensitive information stored on your laptops is secure from malicious abuse when the time comes for loss or theft. I'm convinced most people aren't ready, and that the vulnerability is much greater than we think it is.
Mobility has become a business necessity. The benefits are obvious -- the risks, not so much. ''For an eye opener, just skim through A Chronology of Data Breaches Since the Choice Point Incident at privacyrights.org. All the laptop-related incidents will make your head spin!
Laptop security essentials
The following are seven essential requirements for locking down laptops:
These basic controls are essential. You may even need more depending on your circumstances. One thing's for sure -- never, ever rely on your users to do the right thing to protect their laptops all the time. Whether through carelessness, ignorance, or malice, users can and will create laptop security exposures.
Encryption's not everything
For those who do encrypt their laptop drives, there is a certain false sense of security. Encrypted doesn't mean secured. It's all the business processes and usage requirements associated with encryption that typically cause problems. There are a lot of ways to exploit basic encryption controls, but there's one vulnerability in particular with laptop encryption that stands out to me. Here's the scenario: A user is logged into his laptop (often with full admin rights/access). His screen is not locked or his screensaver has a too long timeout period. He leaves his desk or
To continue reading for free, register below or login
To read more you must become a member of SearchStorage.com
seat, table, room, as is the case in restaurants, coffee shops, airports and hotels. A criminal comes by and takes the laptop with the screen unlocked and the user still logged in. The criminal now has unfettered access to the entire system for as long as the battery holds out or until he can get the laptop plugged into a universal power supply. Obviously, not good for business.
I see the potential for this scenario literally every time I'm in a public place where laptop users happen to be. Who's to say this can't happen very easily, especially in a crowded area. It's textbook -- the laptop user, trusting by nature as humans are, thinks to himself, "I'm just going to step away real quick -- everything will be safe. If someone tries to do anything, others will see it happening and stop him." Despite what we think will be done, there's something called "bystander apathy" whereby "good Samaritans" don't really do what we think they're going to do to help.
The problem is not going anywhere
The bottom line is that bad things are happening, and we can't rely on others to keep our laptops safe. Inject a good dose of technical controls backed up with policies that are actually enforced by management. This combined with a trust no one stance is the best form of vigilance for protecting your laptops. If you do experience the unfortunate do laptop breach, I've outlined what to in this article from SearchMobileComputing.com.
Sensitive information that used to be protected in a highly controlled storage environment now has feet. With laptops being the majority of new computers being shipped, combined with the fact that very few of them end up with an encrypted disk or partition, we've got a problem on our hands that's here to stay.
A new mindset is required for mobile storage security. Rise above all the laptop encryption noise and at least implement the basics. Like all things security related, a little common sense goes a long way.
About the author: Kevin Beaver is an independent information security consultant, speaker and expert witness with Atlanta-based Principle Logic LLC. He has nearly two decades of experience in IT and specializes in performing information security assessments revolving around compliance and risk management. Kevin can be reached at kbeaver at principlelogic.com.
