Keeping Portable Data Secure
SHA Newsletter: Vol 2. No. 7

I've read recently about some nasty losses of portable computers, particularly from some financial organizations. The details vary from case to case, but they all seem to involve similar situations. Someone ships a portable computer to a remote office and the computer never arrives. Or someone who works for the company takes a computer home, where it is lost or stolen.

I've read of one case at Fidelity Investments, where a stolen laptop contained information about thousands of participants in a retirement plan. Customers of Wells Fargo, the national mortgage lender, have had information stolen too. And there are many more cases like this.

If you've been the victim of identity theft because of a case like this, it can be terribly distressing. What makes it worse is when the company reassures you of their "commitment to your privacy" while at the same time disclosing the loss of your personal information. Sometimes banks or financial institutions will cover any losses you have, or they will pay for services like credit monitoring, but this isn't the same as protecting your data in the first place.

These are big cases, affecting thousands of people, but the loss of a laptop can cause you no end of grief. Think about the information on your computer. What would happen if it were suddenly gone? There are some new technologies around, or coming soon, that might help. Here are some of them:

Biometric sensors

These are devices such as fingerprint readers that allow you to log into your computer by identifying yourself through some physical characteristic that is uniquely yours. Sometimes these are built into the computer itself, or they might be built into a keyboard or on a dongle. This can keep thieves away from your computer account and your data. Better yet, you don't have to memorize your fingerprint.

I've read, though, of some concerns with this idea, particularly when the biometric reader has to transmit data over a wireless or a "cordless keyboard" link. In that case, the link must be secure, or an attacker might obtain your encoded fingerprint between the reader and the computer. This could happen if your computer was infected with a keylogging program or some other malicious program. If that were to happen, how would you recover? You can change a password, but you can't change your fingerprint. Provided that the reader is designed well, biometrics can be quite effective and convenient.

Self-Destructing Disks

When it comes to a laptop, physical security means everything. If a thief has possession of your computer, she can get at your data. It can be as simple as removing the hard disk and putting it in another computer to be read. But self-destructing hard disks are coming soon. These devices are built with special sensors inside the disk drive. If someone tampers with the drive, then special programming in the disk electronics erases all the data. The thief will have the computer, but there won't be any data to steal.

Another method coming soon puts a vial of corrosive acid inside the hard disk. Removing or tampering with the drive releases a mist of acid inside the drive, which destroys the magnetic coating and therefore the data. It aims to make it impossible to recover data even if the drive is disassembled by a data recovery expert. These won't be cheap, and I doubt you'll see them in low-cost home computers anytime soon. But for protecting truly sensitive data, these are good ideas.

Tracking Systems

There are subscription services that hide tracking software on a laptop or desktop computer, which periodically reports via the Internet to the tracking company. If your computer is stolen, the tracking company can locate it when the thief connects to the Internet. They then work with the police to recover your computer if possible. I've seen these services sold at retail and also offered by manufacturers on new laptops. I don't have direct data on how effective they are. But the idea of a tracking system, like those used to recover stolen cars, is an appealing one for road warriors who depend on their computers.

Ten Things You Can Do to Protect Your Computer

Don't forget to take precautions with your laptop. Here are 10 ideas you can use even without fancy security arrangements.

1. Use a laptop locking cable if you have to leave your computer in an area that isn't secure. These are easy to buy at computer or office-supply stores. Some use a keyed lock, others use a combination lock, and they attach to a special slot on the side of the case.
2. Set up your screensaver so that it locks the screen when it launches. That way, you need to know the password in order to gain access to the computer.
3. Back up your computer regularly. This can protect you against losing your data, which might be enough if the data is important to you, but would not be useful to a thief.
4. Don't use a laptop for highly-sensitive information, such as customer or financial records. If you are thinking about taking files home from work, think twice. Do you really need that file? Could you take data home on a printout that you could shred? Can you use a flash memory device, which you can keep separate from the computer? Is there a company policy about taking work home that you need to follow?
5. Use a password on your computer accounts and disable or remove accounts you don't need. This won't give you much protection, but the more difficult you can make things for the thief, the better off you'll be.
6. When you travel, do not leave your computer unattended, such as when you pass it through the security gate at an airport. Don't leave it with your luggage when you check in at your hotel. And make sure that your computer case has some unique markings or labels, so that a thief can't swap your bag for a similar one. If you put your name and address in or on the case, make sure it's a business address and not a home address. And remember to have the battery fully-charged before you leave for the airport. The security checkers might ask you to run it at the gate.
7. If you keep your computer case with you at a conference or meeting, keep your foot on the case, or wrap the strap around your ankle. Thieves have been known to slide computers right from between the legs of participants sitting at conference tables.
8. Use security software provided by your employer, such as virtual-private networking software, to connect to your home office. That keeps data at home, and not on your laptop.
9. If you use your laptop for business, consider purchasing insurance to cover the cost of replacing the laptop and recovering data. You can often obtain coverage for the cost of reconstructing lost records and data. This won't keep data away from a thief, but it can help get you back on your feet.
10. Consider a privacy screen. These are special filters that prevent viewing the screen from the sides. They hide the screen from prying eyes on the left and right.

There's no substitute for keeping your laptop out of the hands of thieves, and new technologies will make it easier to keep your data out of the wrong hands. Meanwhile, you can take several steps to make it harder for a thief to get her hands on your precious data.

Please note: Any trademarks and trade names of others mentioned in this message are the property of their owners, and not Stoney Hill Associates, LLC. We respect the intellectual property of others. The information provided is believed to be reliable, but we cannot guarantee that the procedures and information given here will work correctly for your specific situation.

If you would like help with a computer or software problem you face, contact us. Send an email to request@stoneyhillassociates.com.

Want to subscribe to this newsletter? Just join our mailing list:

© 2006 Stoney Hill Associates, LLC