A Laptop is Like a Box of Chocolates
David East, Security Consultant
You never know what you’re gonna get.
Laptops aren’t just devices that allow people to work remotely and more productively. They are also security risks. Most of us who use laptops as our network connectivity device store client related information on the hard drive and many of us also store personal information on them — which means that our laptops can provide the bad guys with a means of accessing our systems and potentially sensitive information.
Have you ever thought about what information the cookies on your machine may hold? Credit card information, telephone numbers, addresses? The sources of information that would help with identity theft don’t only come from the letters and junk mail we throw away, there is a wealth of information just waiting for some “Goodfellas” to exploit.
And it is not only your information that may be exploited. Think about the client data you may hold on your laptop. Those names, addresses, telephone numbers, and other information are all potential tools that could aid social engineering hacks, such as “bad guys” pretending to be you or one of your clients or employees when calling a service desk or supplier. What about those network diagrams on your hard drive that a hacker could use as the basis for attempting to access your network? A little knowledge is a dangerous thing.
You may think this sounds more like the world of I-Spy, Mission Impossible, or the CIA than information technology. And maybe it is. Coincidentally, “CIA” is the foundation acronym of the security profession — Confidentiality, Integrity, and Availability.
Recent high profile losses, such as those at T.J. Maxx and the Nationwide Building Society in the U.K., show how confidentiality can be compromised when laptops go missing. In both cases lost laptops, containing credit card information and customer account information respectively, had significant consequences. The fines levied by the regulatory authorities were minor for companies this size, but the damage to their business reputation and stock market price have had a far wider impact.
The cost of replacing lost laptops runs into hundreds of millions of dollars a year, and the impact of the data and proprietary software lost runs into billions of dollars according to FBI figures.
So what can you do to help prevent these losses? Consider some of the following ways to mitigate the impact of losing a laptop:
1. Where possible store critical data in a central location and access it remotely using your laptop.
2. If you must carry sensitive data on your laptop, consider encrypting your hard drive to prevent access to that data.
3. Consider installing Remote Laptop Security (RLS) software to protect your laptop.
4. Use a cable lock to secure your laptop to a fixed object when working remotely.
5. Put tamper proof assets tags on machines. If a thief cannot remove this it makes the laptop difficult to sell and therefore not as attractive to steal.
6. Don't use an identifiable laptop bag — a padded messenger bag helps disguise what you are carrying.
7. Don’t leave your laptop unattended or in view.
8. Don’t put your laptop bag down to do something else, like check-in at an airport. It only takes a minute for someone to steal the bag unnoticed.
9. Password-protect your laptop and the critical files on it. Use strong passwords to inhibit access and consider using a strong Basic Input/Output System (BIOS) Password to inhibit loading the operating system.
10. Make sure that password-protected screensavers are enabled when you leave your laptop logged on. Internal theft of information is still the biggest threat to businesses.
[PRINTER FRIENDLY VERSION]
|