Defending the Enterprise
Friday, November 24, 2006

The cost of one stolen laptop….$ 160 Million and counting

That’s what it cost the U.S. Department of Veterans Affairs when they recently lost just one of their laptops. According to Security magazine, the U.S. Department of Veterans Affairs offered veterans a year’s worth of free credit alerts after a laptop computer containing the personal records of 26 million VA clients was stolen from the home of a VA employee. That figure does not include the cost of lost productivity, the criminal investigation and legal fees that led to the recovery of the laptop, and the necessary audits to prevent future violations.

Protecting laptops—along with other mobile and wireless storage devices—is becoming a top priority for organizations seeking to secure their sensitive, confidential, and proprietary data.

Organizations need to develop a comprehensive Laptop Protection Program (LPP). Not all laptops in the organization will need the same level of security. Developing a one-size-fits-all solution for your laptops will be both ineffective and cost prohibitive.

Security of laptops and the data they contain is not a technical problem---it is a business problem. While technical solutions can often be employed to address some of these issues, the business needs of the organization should dictate when and how these technical solutions are used.

Specific areas of concern that should be addressed are:

• Theft Prevention / Recovery: There are numerous physical and software products that can help you to discourage theft and locate your laptop once it is missing.
  
  
• Data Protection: New hardware / software solutions now make it unnecessary to store critical applications and data on a laptop.
  
  However, if that is not an option for you, application passwords, data encryption, and biometric access control can be used to prevent unauthorized access to data. These solutions create a threefold protection scheme that is almost impossible to breach.



• Data Recovery: Procedure/software can be employed to protect intellectual property against accidental erasure or catastrophic loss due to a disk crash or to other device malfunctions.
  
  
• Laptop Maintenance: This is an often overlooked and very inexpensive prevention tool. One small office recently lost the use of a major point-of-sales terminal for 6 days. This was due entirely to poor maintenance policies. Security packages were not up-to-date, data was not backed up, and the hard drive was full of extraneous files. Their efforts to fix it themselves led to even more problems. Just as responsible automobile owners know the basics of maintaining their vehicles, so too should business persons who use a laptop know the basics of good laptop maintenance.
  
  
• Security Awareness: In addition to the above topics, Security Awareness Training should also cover corporate security policies / procedures and tips on travel and other risks specific to the laptop environment.