A solution for addressing laptop thefts and losses was described in a press release today.  The product uses GPS in combination with encryption to locate stolen and lost laptops quickly in addition to being able to delete sensitive files from lost or stolen computers. 

I know nothing about this particular product, "MyLaptopGPS," beyond this press release, but the concept is good, and there may be other products out there that do the same thing.  Security in layers does not just apply to networks; it applies to all aspects of information security.

In fact, with regard to mobile computing devices it is good to take MANY safeguards, a few of which include:

• Encrypt all sensitive data on the device.  This often is most efficient to accomplish by encrypting the entire hard drive.
• Use boot and login passwords...GOOD passwords!
• Configure the device to automatically lock, requiring requiring password based re-authentication, after a specified period of inactivity.  5 or 10 minutes is reasonable.
• Use privacy screens to cut down the amount of information onlookers, nosy neighbors and other looky-loos can see, like on planes, in airports and so on.
• Use asset monitoring tags and services, such as StuffBak.  The GPS product also serves a similar purpose.
• Require unique devices for each person; don't allow the devices or passwords on the devices to be shared; this destroys accountability.
• Maintain an inventory of all mobile computing devices used, along with the data stored upon them.
• Do not allow mobile computin devices used for business to also be used for personal activities or to be shared with others, such as friends and family members.
• Do not allow employee-owned mobile computing devices to be used for business purposes.  Organizations should own all the computing devices used for business purposes to ensure all business policies and procedures can be applied to them.
• Provide locking devices and other methods for physically protection mobile computing devices when personnel have them outside the more protected confines of the corporate facilities.
• Do not allow large amounts of PII to be stored on mobile computing devices.
• Implement malicious code prevention software and personal firewalls on mobile computing devices.
• Very importantly, provide awareness and training for your folks who use mobile computing devices!!!  You can't expect that they will provide appropriate safeguards if you do not tell them what the appropriate safeguards are that they need to take.

Technorati Tags
information security
IT compliance
policies and procedures
encryption
awareness and training
laptop theft
privacy