Laptop Security
Starts With Physical Security:
In a
previous article, I mentioned some security tips to keep you safe while
traveling. I would like to take that a step further
and discuss some ways to keep your laptops and portable
information devices safe from being stolen or lost.
This may be while you are traveling, this may be in your
car, this may be at home or even in the office. There has
been a lot in the news lately about laptops getting stolen,
and the resulting exposure of personal and other sensitive
information. Protection of personally identifiable
information (PII) has become a very hot topic lately, and
there have been many instances in the news where PII has
been exposed because of a stolen laptop. In fact, the
Office of Management and Budget (OMB) in 2006
released a memo requiring government agencies to
implement procedures to encrypt all agency sensitive data on
laptop and other portable computing devices. This includes
PDAs, Blackberries, cell phones, flash drives, and other
easily stolen removable storage media. This article will be
primarily discussing the loss of sensitive or personal
information due to a stolen laptop or other device owned by
an employer. But we could very well be discussing personal
laptops and devices as well, because these security measures
will apply to anything that contains data, is small, and can
be easily lost or stolen. And in many cases the loss of
your own personal data can be just as devastating to you as
losing something that contained the data of others.
Much of what is being
discussed to solve this problem involves implementing
technological solutions. For example, laptops can be
encrypted using something as simple as Windows’ built-in
file and folder encryption, Windows Vista’s built-in
BitLocker tool, or a wide variety of other full-drive
encryption solutions. Blackberries can already be password
protected and encrypted, and many flash drives come with
built-in software to encrypt them. But using these
technologies, while providing an extra layer of protection,
will help protect after the loss event occurs, they do
nothing to prevent the loss. Data security is more about
being proactive than it is about being reactive.
These technologies offer a
valid and useful solution to this problem, to be sure. But
I think people are overlooking a very fundamental
non-technical solution that can really go a long way to
preventing these exposures – physical security. I was
talking with a colleague recently, and she brought up a very
valid point – if people would just do more to prevent these
thefts in the first place, then we wouldn’t be where we are
today, with so many instances of people winding up in the
news because they allowed a laptop to be stolen from them.
She said, and I strongly agree, that physical security is
completely being overlooked. In fact, I would go so far as
to say that the advent of all these technological solutions
is actually giving people more of a reason to be less
careful about protecting their laptops and other devices
from theft. And all these technological solutions protect
you after the fact. What ever happened to being proactive
and using some prevention to avoid the theft in the first
place?
How many times have we heard
that a laptop has been stolen from a car? “But the car was
locked,” “I was only gone for a few minutes,” “It was hidden
in the back seat.” It only takes a fraction of a second to
smash a window. And the thieves are getting clever and
using electronic devices to help them detect if a car has a
laptop inside. They can then be very selective about their
targets, and easily do a “smash and grab” in very little
time. “The laptop was stolen from my house. The house was
locked. What could I have done?” This looks like a less
preventable issue than having it stolen from a car, but
let’s takes a look at what they have in common, and what the
underlying issues are. Then, we will come up with some
methods that can be used to protect them in each case.
Standard of Care:
To being with, let’s look at the fundamental issue – if you
are going to wind up in the news, it is because you did
something to allow the personal information about many
people to become compromised, or you were careless with a
company’s secrets. The media could care less if your personal laptop, your checkbook register,
latest term paper, and resume where the only things that got
stolen. If you are carrying around a laptop or PDA with a
lot of PII and/or a company’s proprietary information,
however, it means that you either have a piece of equipment
provided by your employer, or you were keeping that
information on your own personal equipment. First, I’ll
discuss the later – what do your company policies say about
you storing business information on your own personal
computer? They don’t have a policy? That’s another issue,
and I won’t cover that in this article. But even if they
don’t have a policy, what does common sense tell you about
it? You shouldn’t do it, period!
Now let’s look at the former
– your company provided your laptop and PDA for you, and you
will need to surrender it upon request. It is provided for
your use to perform company business. Your employer paid
for it, and hopefully they have policies about your
responsibilities towards safeguarding it. This is where the
commonly heard term “standard of care” comes in. Your
standard of care in protecting this equipment is far greater
than the standard of care you most likely exercise in
protecting your personal computing equipment. You are not
only responsible for protecting the equipment itself, but
you are responsible for protecting the data on it as well.
This may be the data about thousands of people or the trade
secrets about your company’s newest product! Losing it may
wind up costing you much more than just the embarrassment of
media attention. Your company can be sued, and you can be
sued. Or worse – federal or other regulations may have been
violated, and you and your employer could wind up facing
criminal charges. Termination, jail time, fines, and a long
miserable process of dealing with the unwanted attention are
some potential outcomes. Those ideas alone should instill a
new sense of urgency in your thoughts about “standard of
care” and “due diligence.”
So what can be done?
This is the relatively simple part because laptops, PDAs,
flash drives, and such are small – they should be easy to
protect. Here are some ideas that you may find useful while
taking your laptop out and about, or even just leaving it in
your home, hotel, or dorm room.
Physical Protection in the
Car:
A laptop is light – put it in a carrying case and take it
with you – just don’t leave it in the car. Is it really
that tough to have to take your computer case into Wal-Mart
with you? If it is, then why are you running all these
errands? Take the laptop home, lock it up (see the next
section), and then go shopping. I know, I know: Wal-Mart
is just on the way home, and with the high price of gas, it
is much more economical to stop off on the way home and pick
up a few things. That’s a decision you have to make – but
remember what I told you about “standard of care.” You have
an obligation to safeguard this equipment and the data on
it. Be prepared to take the necessary steps to protect it.
My colleague had a clever
idea: She said that if you absolutely must leave it in the
car, buy a computer cable and secure it. I’ll add to that,
put the cable in the trunk, secure it to the frame, then
secure the laptop to the cable, in the trunk. The one thing
to remember is that thieves who break into cars don’t
usually have a whole lot of time to spend trying to get
around physical security devices such as cables. They are
looking for targets of opportunity – the “low hanging fruit”
so to speak. If they smash a window in broad daylight, they
need to get in and get out quickly. A cable presents a
significant delay, and more chances for them to get caught.
If it’s in the trunk they can’t even see it in plain view,
making it that much more difficult. But again, do you
really need to leave it in the car? I am now putting on my
“electronics geek” hat and will tell you that leaving a
laptop in a car in either extreme heat or extreme cold, or
leaving it exposed to the sun, is just wrong on so many
levels. Forget my 30+ years of experience working with
electronics. You are damaging your computer, or at the very
least shortening its life by doing that!
Physical Protection in the
Home, Hotels, and Dorm Rooms:
There are a variety of inexpensive cables and other devices
you can buy to protect laptops these days. Cables that do
everything from simply physically locking down the device,
to emitting an alarm when cut or broken, can be purchased
and easily installed. If you are going to leave that
employer owned equipment in your house, secure it to the
desk. Better yet, how about locking those things up?
Remember, thieves look for the low hanging fruit. If they
break into your house, they aren’t going to hang out finding
ways to get into secured cabinets or safes, and wait for the
police to show up – they need to get in and get out. A
locked filing cabinet inside a locked office does not
present them with an easy target, but it shows that you were
practicing due diligence in protecting these items should
some brazen criminal decide to take the time to break into
those secured areas.
If you’re in a hotel, it
probably means that you are on travel for your job. That
being the case, it should be just a simple matter of fact
that you are taking your computer with you when you leave
for the day for your conference or other meetings. If you
are in a hotel on a pleasure trip, then why, oh why do you
have your computer with you? OK – you’re probably a
workaholic geek like me. In that case, then the above
applies. Or ask the hotel to lock it up in their safe while
you’re gone. The standard of care is then at least
partially on them.
College students – even
though I have been primarily focusing on employer owned
equipment and data, I just have to mention you in this
article also. Many of you live in dorm rooms and have
computers. While the level of sensitivity of your data
isn’t nearly at the level of what I have been discussing so
far, can you really afford to lose that paper that is due
tomorrow, and that you have been working on all night? Does
your dorm room have a steady stream of visitors? Do you
know all the people who your roommate invites in? Get a
computer cable and lock that thing to your desk! Even if
it’s a big desktop computer – lock it!
The
University of Arizona has a great security poster that gives
some good tips on security in the dorm room:
http://security.arizona.edu/index.php?id=780
Physical
Protection While Out and About:
It is easy to let down your guard when going to the coffee
shop, waiting for a flight in an airport, or just hanging
out in the park. These settings all provide classic
examples of how computers get stolen. In one example, a
television commercial depicts a guy sitting in a coffee
shop, turns around to look at a girl, then turns back – the
laptop is stolen! The punch-line is “what now?!” What now,
indeed? How many times do you go to the coffee shop, leave
your laptop on a table, and go back to the counter to get
your coffee and a donut? All it takes is for you to turn
your back for a moment and for your laptop to then go
missing.
You wouldn’t leave your
wallet lying on a table while you go off to do something
else, would you? As was stated in a
2004 Security Watch article by Robert Vamosi “…you
should think of your laptop sitting on the table as a
thousand dollars in cold cash; you wouldn't turn your back
on that, would you?” Protect your laptop like you would
your wallet or purse. Don’t take the thing out unless you
are ready to use it, and you can be there to physically
protect it. Robert also mentioned carrying laptops in
non-descript bags. A great big black “Dell” bag is a good
indicator that you are carrying a laptop. Use a padded
backpack or something a little more plain.
Physical Protection While In
the Office:
We can’t discount security in the office or take for granted
that just because your equipment is located in an office
building it will be safe. First of all, just because it is
in an office building, are you sure your employer’s policies
don’t still hold you responsible for lost or stolen
equipment? Start out by finding out what the policies are.
Then, if they don’t already do so, ask your employer to
purchase a security cable to secure that employer owned
laptop. A number of recent articles have indicated that
many, if not most, security threats come from within the
organization. This can include coworkers or building
custodial staff. How many people have access to your work
area? If you are in a typical cube-farm, then nothing is
secure. All of your work area is fair game for people to
cruise around looking for easy targets.
If you are going to leave a
laptop in the office or cubicle overnight, then lock as many
things between public access and your equipment as
possible. If it’s an enclosed office, and you are able to,
lock the door. Secure the laptop with a cable or lock it in
a file cabinet. Don’t lock it in one of those cubicle
cupboards that someone can just lift off of the wall to get
to the contents, but a file cabinet that is solid on all
sides. Lock up any PDAs, flash drives, or portable storage
units that you don’t take home with you. And since we’re
talking about securing data in all of its forms, put away
and lock up any paper, CDs, disks, or any other things that
have sensitive information on it. Many organizations have a
“clean desk” policy in place. And no, this doesn’t mean to
take 409 and wipe down your desk every day. It means to put
away and secure all items containing information: PDAs,
paperwork, sticky notes, micro-film, secret decoder rings,
everything!
An important note about those
cables:
If you do take your laptop home with you, don’t leave the
cable just laying there on the desk with the combination
dialed in. All someone has to do is come by, test the
unlatching mechanism, and if it works, they can then look to
see what the combination is. And dialing one of the numbers
to one digit off won’t do it either. Set the dial to all
zeros – don’t leave any clues at all. If you leave the
combination dialed in, or close to it, on that cable, it
doesn’t matter if you lock that laptop with the cable or
not. The potential thief then has the combination and can
just come back later. If you do use a combination lock
instead of a key lock, change the combination periodically,
just as you would change your network password
periodically.
Wrapping It All up:
There are a wide variety of
technologies now available to protect the data on your
laptop or PDA should it get lost or stolen. But those
things protect the data after the fact, provided they are in
place and functioning. You still lose hours of hard work
and an expensive piece of equipment. The real goal is to
use some prevention and keep the asset from being lost or
stolen in the first place.
Don’t be in such a hurry
while running your errands that you leave an unsecured
laptop in a car. Windows can be smashed and the laptop
taken in seconds. Are you aware of your surroundings? When
you leave the laptop on a table in a coffee shop, are you
sure it will be there when you return? How about in hotel
and dorm rooms? Are you sure the housekeeping staff is
completely honest? Are your dorm room roommates having a
lot of visitors? There are so many variables and so many
possibilities to have equipment go missing.
Physical security is a
preventive measure that should be taken seriously. Don’t
rely solely on technologies to make data unobtainable
through encryption – keep it from getting stolen and exposed
in the first place. There a re a variety of low-tech to
no-tech solutions to keep you from losing your equipment..
Cables, keeping the item with you, good file cabinets and
locked doors will all add a significant measure of
protection and security. It all begins at the lowest layer
– physical security!
Additional Resources:
Security Watch: How to
Protect Your Laptop While on the Road
http://reviews.cnet.com/4520-3513_7-5145310-1.html
Washington Post – “OMB
Sets Guidelines for Federal Laptop Security”
http://www.washingtonpost.com/wp-dyn/content/article/2006/06/27/AR2006062700540.html
Security Posters:
http://www.us-cert.gov/reading_room/distributable.html
Georgetown University
Safe and Secure Computing Quick Start Guide:
http://www3.georgetown.edu/security/10574.html
University of Arizona
Security Posters:
http://security.arizona.edu/index.php?id=780
IA Newsletter – Defense
in Depth
http://iac.dtic.mil/iatac/download/Vol3_No2.pdf
Information Security
Magazine - Laptop Security:
http://infosecuritymag.techtarget.com/articles/february01/features_laptop_security.shtml
SearchSecurity.Com -
Elements of a Security Program:
http://searchsecurity.techtarget.com/tip/0,289483,sid14_gci1210562,00.html
NIST SP800-100:
http://csrc.nist.gov/publications/nistpubs/800-100/SP800-100-Mar07-2007.pdf
Back to the Computer
Page
