What should an organization do if an employee loses their laptop owned by the company. The laptop is used for business purposes, has confidential data and is also encrypted. Are there specific measures that an organization can take to minimise the impact of the asset/data loss?
2
-
1One thing you should definately do: Keep it from the press. Most people who steal a laptop won't show much interest in it's content. But, if they hear it is valuable a crack might be attempted.– Dennis JaheruddinFeb 13, 2013 at 16:53
-
1The very fact that the laptop was stolen means the organization's security framework failed at least once. You have no guarantees that there are no other faults in it. In addition to the good points raised by Thomas Pornin and Bob Watson, I would have one more issue to investigate: Was the employee storing restricted files he/she shouldn't have had access to?– Deer HunterFeb 13, 2013 at 18:03
Add a comment
|
4 Answers
You've already taken some good steps with encrypting the device, but there are a few other general things you can do:
Require strong passwords, and dial down the amount of time cached credentials last if you can.
Use multi-factor authentication; if your user has a smart card or secure key of some sort, they need to lose 2 things to let someone else in.
Minimise the data stored on the laptop - keep as much as possible on your network and revoke the users credentials as soon as the laptop goes missing (ideally by revoking a certificate on your CA, but maybe by just changing their password).
Keep very important files separately encrypted, using a different password to their login, in a truecrypt volume or the like - that way an attack on the notoriously weak Windows password store doesn't reveal your key.
Set up a remote wipe / locate service (such as Prey) so you can nuke/find it if it goes online.
Set up rules to wipe your keys in case of too many bad passwords - this will give you a fighting chance against an online brute-force attack, and full disk encryption is likely to make offline attacks difficult.
Your organisational policy and process should reflect the fact that confidential data should have a shelf-life after which it stops being important. You should make sure that cases where that shelf-life is long are flagged and that data not carried around. For anything else, you want to aim to keep the machine secure for at least as long as the data is valuable, and that should inform your encryption schemes and other access control measures.
You have three parts in the loss of the laptop: hardware loss, data loss and data theft.
For data theft, encryption is the right tool, although it would be even better if the data had not been on the laptop in the first place. Moving to a "cloudy" model might be smart: keep the data on some servers (that your company manages) and use the laptop only as a movable terminal to access sessions on the server (Web-based, or even with RDP or NX). This will make the data much safer by avoiding, to a large extent, writing the precious data on the laptop itself.
If you do need to store data on the laptop, try TrueCrypt and make sure that the system "auto-locks" after some inactivity.
For data loss, there again, the cloud model looks better. Otherwise, regular backups, e.g. syncing daily with a company server through a VPN.
For hardware loss, well, too bad, you won't get the laptop back. Hardware is not very expensive. You can make the loss lower by using cheap laptops, which again points at the could model (you need less muscle if the computing does not actually happen on the computer).
A critical point is to make sure that incidents such as a stolen laptop are reported with all the possible alacrity. Therefore, you MUST make it known that a stolen laptop will not imply corporate or financial punishment on the employee to which the laptop was entrusted.
If employees have a direct interest in not reporting laptop theft, then you will not be able to apply defensive maneuvers such as forcing password changes.
answered Feb 13, 2013 at 14:01
Encryption is definitely the first step...was it full-disc encryption? You might want to look into being able to wipe devices remotely as well, should this happen again. This might help: http://www.rjssmartsecurity.com/How-We-Help/Data-Loss/ I'd reach out to some professionals beyond the forum if it's possible that there was really sensitive information on there.
In addition to all the rest of the answers here I will suggest the following:
Implement a corporate policy that mandates lost company devices be reported to IT.
People who do not work in information security at a company may not be as conscious in safeguarding company assets / data as those who do, and may not think twice about the incident. Make sure the policy has senior management approval and is communicated to all employees.
Implement end user device control software that can remotely wipe a lost device
There exists commercial software that can be used to control and lock down end user computing devices. Choose a solution that meet your company's needs and implemented it so that IT can remotely wipe the HD of devices deemed lost.
Adopt a IT Asset Management System
If you don't who has what devices assigned to them, it becomes very difficult to track the status of assets such as whether they are lost stolen etc. Effective IT control of mobile assets such as laptops without prior knowledge of information such as what assets are in use or where are they being used is not feasible.
