The Irish Independent is reporting (free sign-up required) that a laptop was stolen from the constituency office of the Taoiseach (the prime minister of Ireland).
This story reinforces how important it is to implement roaming device security. I’ve talked about this sort of thing over and over before but here we go again …
First, let’s get something out of the way. Security is the opposite of usability. You must find the right balance between the two. This is not usually a one-size-fits-all policy. I’m not saying that you should treat every person/computer differently. That’s the sort of madness that only over zealous (in)security offices come up with. Create a set of polices that cover a reasonable number of scenarios and clearly document and communicate them.
Physical security cannot be guaranteed for roaming devices, even in your own office. I’ve known a finance company in London where burglars dressed as cleaners walked past a dozing security guard and walked away with every laptop they had time to find. You can try to use security cables but these can be cut by someone who is prepared. This might not include the casual burglar but anyone targeting your data will be prepared. Don’t think this is realistic? Hah! Aren’t you naive! If your business data is valuable to you then it’s way more valuable to your competitors. I’m not saying you need to lock down every roaming device but you might want to consider it for those with critical data.
Any roaming device with sensitive data that cannot be physically secured should be encrypted. Let’s look at that sentence:
- A roaming device is not just laptops. There are laptops, tablet PC’s, PDA’s and mobile/cell/handy phones. Each of these is capable of storing sensitive data. We often think of securing laptops and tablets but we rarely consider the device that is most likely to be not only used by directors, government ministers, etc (the mobile phone or PDA) and is also most likely to be stolen or lost.
- Sensitive data … ask a user if they have sensitive data on their PDA or laptop and they’ll say "No … I just use it for email". That there is the most sensitive data. Look at the major corporate lawsuits or political scandals these days and what documentation is being used? Email. What is the only IT business application that senior management use? Email. What is used to share most valuable documentation? Email. Anyone using a laptop or PDA for email (which is 99% likely these days) will have a local replica of their inbox and will likely have the attachments (at least the most valuable ones) on local storage.. This must be secured.
- Passwords are not a long term security solution against a determined attack. If you store files on a machine and secure them or the machine with passwords, PIN’s, etc, then you can gain access with a few easy steps. Some manufacturers include biometrics but that’s just another password. A TV show even documented how to bypass this security method. The only solution is to encrypt the data with a strong algorithm to make it unreadable to unauthorised users.
There’s two approaches to encryption:
- Encrypt the files: Using something like EFS in Windows. This usually requires some effort on the part of users. It will not secure mail. I don’t like it because of the reliance of effort on the part of users. I prefer things to be completely automated.
- Encrypt the hard disk: This encrypts the entire contents of the mobile device. This is my favoured approach. Access to the device is secured by physical token or a passphrase. There is no bypass like with traditional password protection because the data itself is encrypted.
There’s plenty of encryption solutions available. Some versions of Windows Vista include BitLocker for complete disk encryption. It’s OK if you have the right versions and don’t want to implement a management solution, i.e. for ad-hoc device security. The downsides are lack of centralised policy, management, passphrase recovery and it requires that you know before you build the machine that you want to encrypt the hard disk because it requires a dedicated partition 0.
I prefer a dedicated solution that will offer centralised deployment, policies, passphrase recovery and cross platform security:
- Centralised Deployment: From a console, you can deploy your agent to targeted devices.
- Centralise Policies: You can deploy a preset collection of well defined and managed policies to devices.
- Passphrase Recovery: What do you do when your boss calls at midnight from Tokyo saying that he forget his passphrase and needs access to his laptop for a business deal? If you can’t reset their passphrase using across-verification method then you shouldn’t count on being around for much longer.
- Cross platform support: Remember that you need to secure all mobile devices, not just laptops. Using a single solution will simplify deployment and management while minimising mistakes.
I like Safeboot for this sort of thing.
Don’t forget document security! We often focus on device security. Have you heard of a sales person or manager who is leaving who is caught email sensitive documents to their future employer or a personal email account? I have seen it personally … a few times. No amount of folder permissions or encryption will stop this because these people need access to these files to do their jobs. Could you put them on gardening leave when they hand in their notice? Sure … but if they’re clever they’ll have copied the data before they told their employers about their intentions. The solution here is to implement file level encryption or authentication using something like Windows 2003 Rights Management Services. This solution will use a PKI to place encryption on documents or emails so that unauthorised internal or users cannot read or modify (depending on the security put in place) the document or email. This secures you against employees copying data externally or deliberate/accidental leaks.
Given enough time with mobile devices on your network, some of them are going to be stolen or lost. You might have a scenario where a sneaky or unhappy employee tries to copy/leak sensitive data. If you implement the above solutions then you’ll be able to sit back and watch things, knowing that your organisation is safe.