The loss of a single laptop poses a serious risk to a corporation: proprietary information, personal data and trade secrets can fall into the wrong hands. Moreover, for licensing and compliance purposes, IT managers need to know where their assets are, who is using them, and what software and information is residing on them.
An effective way to think about a layered approach to mobile security and data protection is CPR: Compliance, Protection and Recovery.
Protecting data on a lost or stolen computer is a good first step, but recovering the asset, and stopping the internal theft, is equally important in effectively mitigating a company’s total exposure.
A layered approach consists of:
1. Compliance The ability to comply with applicable mobile data protection regulations and to provide an easily accessible audit trail.
2. Protection The ability to prevent mobile data losses from occurring.
3. Recovery The ability to recover lost or stolen mobile data, to retrieve lost or stolen devices and return them to the control of the organization, and to facilitate prosecution.
A multi-faceted mobile data protection system should consist of the following:
REAL-TIME ASSET TRACKING
REMOTE DATA DELETE
DATA ENCRYPTION
AUDIT LOGS
COMPLIANCE CHECKLIST
1. Knowledge of the relevant statutes for your industry and jurisdiction
2. The ability to track mobile computers, their usage and the types of information on them, including the ability to locate assets on demand
3. Recovery software for retrieving lost or stolen assets.
PROTECTION CHECKLIST
1. The ability to locate and recover lost or stolen mobile computing assets
2. The ability to protect sensitive data through strong user authentication and encryption
3. The ability to delete data remotely from mobile computers that have been lost or stolen
COMPUTER SECURITY CHECKLIST
1. The ability to locate lost or stolen assets for recovery
2. Effective human resources policies that enable strong disciplinary action for misuse of corporate assets
3. The ability to delete data remotely from mobile computers that have been lost or stolen
Starting today, what steps can an organization take to put in place a better, more compliant environment for protecting data, especially in mobile devices? Here are some quick tips on protecting data:
1. Educate employees on the need to avoid leaving laptops unattended. If they must be left in a vehicle, they should be locked in the trunk.
2. Explain the importance of data security for corporate compliance purposes and the benefits of a best practices approach to data protection.
3. Ensure that all laptop computers are locked in cupboards or other secure facilities at work or at home when not in use.
4. Provide cable locks for laptops that must be left unattended.
5. Implement a sign-in system for visitors and do not let unaccompanied visitors into work areas.
6. Install an asset tracking and recovery tool such as ComputraceComplete to track and recover computers that are lost or stolen, and monitor any changes or disappearances in computer memory, hard drives or peripherals.
7. Deploy a data encryption tool to protect sensitive data.
8. Use a data delete tool to remove remote sensitive information from a lost, stolen or end-of-life or lease device.
ftsu
ReplyDelete