Loss of hardware asset(such as a laptop) that belongs to an organization

Question

What should an organization do if an employee loses their laptop owned by the company. The laptop is used for business purposes, has confidential data and is also encrypted. Are there specific measures that an organization can take to minimise the impact of the asset/data loss?

Answer 1

You've already taken some good steps with encrypting the device, but there are a few other general things you can do:

• Require strong passwords, and dial down the amount of time cached credentials last if you can.

• Use multi-factor authentication; if your user has a smart card or secure key of some sort, they need to lose 2 things to let someone else in.

• Minimise the data stored on the laptop - keep as much as possible on your network and revoke the users credentials as soon as the laptop goes missing (ideally by revoking a certificate on your CA, but maybe by just changing their password).

• Keep very important files separately encrypted, using a different password to their login, in a truecrypt volume or the like - that way an attack on the notoriously weak Windows password store doesn't reveal your key.

• Set up a remote wipe / locate service (such as Prey) so you can nuke/find it if it goes online.

• Set up rules to wipe your keys in case of too many bad passwords - this will give you a fighting chance against an online brute-force attack, and full disk encryption is likely to make offline attacks difficult.

Your organisational policy and process should reflect the fact that confidential data should have a shelf-life after which it stops being important. You should make sure that cases where that shelf-life is long are flagged and that data not carried around. For anything else, you want to aim to keep the machine secure for at least as long as the data is valuable, and that should inform your encryption schemes and other access control measures.

Answer 2

You have three parts in the loss of the laptop: hardware loss, data loss and data theft.

For data theft, encryption is the right tool, although it would be even better if the data had not been on the laptop in the first place. Moving to a "cloudy" model might be smart: keep the data on some servers (that your company manages) and use the laptop only as a movable terminal to access sessions on the server (Web-based, or even with RDP or NX). This will make the data much safer by avoiding, to a large extent, writing the precious data on the laptop itself.

If you do need to store data on the laptop, try TrueCrypt and make sure that the system "auto-locks" after some inactivity.

For data loss, there again, the cloud model looks better. Otherwise, regular backups, e.g. syncing daily with a company server through a VPN.

For hardware loss, well, too bad, you won't get the laptop back. Hardware is not very expensive. You can make the loss lower by using cheap laptops, which again points at the could model (you need less muscle if the computing does not actually happen on the computer).

---

A critical point is to make sure that incidents such as a stolen laptop are reported with all the possible alacrity. Therefore, you MUST make it known that a stolen laptop will not imply corporate or financial punishment on the employee to which the laptop was entrusted.

If employees have a direct interest in not reporting laptop theft, then you will not be able to apply defensive maneuvers such as forcing password changes.

Answer 3

Encryption is definitely the first step...was it full-disc encryption? You might want to look into being able to wipe devices remotely as well, should this happen again. This might help: http://www.rjssmartsecurity.com/How-We-Help/Data-Loss/ I'd reach out to some professionals beyond the forum if it's possible that there was really sensitive information on there.