* Examples illustrate hazards of keeping sensitive data on laptops
Recently I was updating some lecture materials for an upcoming course and needed some recent examples of losses of control over data. I ran across some excellent reporting by Ashlee Vance of _The Register_.
Vance wrote that the international consulting firm Ernst & Young lost a series of laptop computers in early 2006. In February, the firm grudgingly admitted that a laptop with confidential customer data, including the Social Security number of Sun CEO Scott McNealy, had been lost or stolen in January.
McNealy reported that his identity had in fact been compromised. Then a March report in the Miami Herald stated that some Ernst & Young auditors went to lunch on Feb. 9 – leaving their laptop computers in a conference room in the office building where they were working. Two men stole four of their laptops. Ernst & Young declined to issue a public statement about these breaches of security, although when pressed, they did assure the public that “password protection” sufficed to compensate for loss of control over the data.
On March 15, Vance wrote that Ernst & Young had lost yet another laptop computer – this one stolen in January from an employee’s car. It contained financial and tax records compromising the security of “thousands” of IBM employees and ex-employees. Once again, the company refused to issue a public statement about the theft and informed the potential victims of identity theft two months after the incident. On March 23, Vance found out that Ernst & Young had admitted to BP that 38,000 employees were included in the January laptop theft.
Ashlee Vance, scourge of careless laptop users, also reported on March 22 in The Register that Fidelity Investments had announced the loss of a laptop computer containing detailed HP retirement plan data for 196,000 HP employees, including names, addresses, salaries and Social Security numbers. In contrast with the disgraceful performance of Ernst & Young, Fidelity announced the loss relatively quickly and cooperated fully with the trade press. In addition, the data on the laptop were encrypted.
The same article reported that Ernst & Young were rolling out encryption software for their corporate computers. At last.
On March 24, Vance reported that the _reason_ a Fidelity employee was carrying 196,000 records about HP employees on a laptop was… wait for it… as part of a demo intended to impress HP executives with some new software. Yep: live, highly sensitive data for a demo on a laptop computer.
So what can we learn from these unfortunate circumstances? Nothing particularly new, but perhaps readers will appreciate having fresh examples with which to enliven security-awareness and policy discussions where you can raise the following points:
* Think about whether specific data _ought_ to be on laptop computers at all in their raw form. Would anonymized versions be just as good (e.g., for demos)?
* Confidential data on corporate computers should be encrypted using whole-disk or partition-level encryption (not file-by-file encryption) with appropriate provisions for key escrow or key recovery procedures in case the user forgets the key or leaves the organization (or this plane of existence).
* Passwords alone are an inadequate form of protection for confidential data.
* Every organization should have a computer security incident response plan in place to handle potentially embarrassing cases such as data loss or loss of control over confidential information. Honesty, forthrightness, openness, clarity, and truth are not just for girl scouts – they will largely prevent embarrassment and humiliation when the truth eventually comes out.
