Laptops get ripped off all the time. Just ask officials from the
Chicago Public Schools (CPS) district. Earlier this month, CPS
reported that
two of the district's laptops, which
contained the names and Social Security numbers of about 40,000
current and former employees, were stolen from one of its
downtown administrative offices. The school district is ready to
pony up a $10,000 reward for information leading to an arrest or
the recovery of the computers.
 | | | | | There was a laptop stolen right
from under our noses at our warehouse.
Todd Rosner
Director of ITMediaco |
| | | | | |
| |
|
It's almost epidemic. The average business loses about 5% of its
laptop inventory to theft. Top law enforcement agencies aren't even
immune. The FBI reportedly experiences
three to four laptop thefts a month.
Even more alarming: From 2005 to 2006 there was an 81% increase
in the number of companies reporting stolen laptops containing
sensitive information, according to Ponemon Institute LLC, a
research think tank dedicated to advancing privacy and data
protection practices.
Given that experts contend laptop thieves are opportunists after
hardware rather than the sensitive data found on them, wouldn't a
technology that can track that stolen hardware be helpful? Oh, wait
-- there is one, and it's most likely installed on your laptop.
It's probably just not activated.
If your laptop has a tracking device, there are companies that
can track it. Absolute Software Corp. in Vancouver, for instance,
installs a software agent on its customers' laptops that calls in
daily to a company's IT desk via an Internet connection. If the
laptop is reported stolen, Absolute's Computrace product will
instruct it upon its first subsequent connection to the Internet to
send Absolute its IP address every 15 minutes. With that
information, Absolute's staff, working with law enforcement, tracks
down the laptop.
It's like a LoJack for your laptop.
Absolute's product also includes technology that customers can
use to destroy data remotely in case the laptop can't be recovered
in time. The deletion technology can be policy-based -- for
example, IT can instruct the laptop to delete sensitive data if it
remains off the corporate network for a certain period of time.
This laptop-tracking technology is used often in large companies
because it's sold as a feature by manufacturers. Smaller companies
are less aware of the tracing technology because they purchase
products through resellers that are less likely to play up the
feature as a selling point, experts said.
Khalid Kark, a senior analyst at Cambridge, Mass.-based
Forrester Research Inc., said cost pressures also inhibit smaller
companies from investing in security products for laptops.
"Maybe they can implement one or two pieces of the solution, but
they might not have the budget to implement a strategy across the
board," Kark said. "Smaller companies are not paying attention to
this, or they might be happy to solve just one piece of the
puzzle."
A year and a half ago, Todd Rosner noticed a surge in laptop
theft within his organization.
Rosner is the director of IT at Mediaco, a small multimedia and
audiovisual production company in Burnaby, British Columbia. About
75% of his company's 60 full-time employees have laptops.
"[The thefts] were just ongoing all of a sudden," Rosner said.
"We had to stop the hemorrhaging. There was a laptop stolen right
from under our noses at our warehouse. Some guy just walked past
our building and saw a laptop, so he rolled under a loading bay
door and snuck in without a person in the cabling aisles seeing him
and stole the laptop. We had a few smash and grabs from
automobiles. And there've been cases where people left their
laptops on planes or had them stolen from their own homes."
Rosner said he has recovered about five stolen laptops since he
started using Absolute's Computrace. He said he has spent about
$3,000 on Absolute Software's product during the past year and a
half, and it has recovered about $6,000 worth of hardware. There
was one laptop Absolute was able to track down but couldn't
recover.
"Organized crime is so advanced right now," Rosner said. "We had
one that went almost instantly to Nigeria after it was stolen. In
certain areas of the world they can't work with ISPs and police to
recover the laptops."
Rosner's only option was to delete the data on the computer
taken to Nigeria.
"The data you always want to protect for sure," Rosner said.
"There are some people who have more important data relative to the
company than other people will. We initiated the data delete
option. You've got to make sure everybody has consistent backups
here. If our CEO gets his laptop stolen, initially we'll report it
as stolen. Then we initiate the data delete. Then the next time it
makes a call in to Computrace, Computrace runs an application that
tells it what files to delete."
Kark said no one one technology can totally secure a company's
laptops. A total solution requires technologies from several
vendors.
"Absolute has a few of these things, but they don't have
everything," Kark said. "I think it's very difficult to have
everything in one product."
Kark said companies need to encrypt their data, too. Data
deletion isn't enough.
"Yes, the technologies are there that can help you do pieces of
this problem," Kark said. "But the problem is not really data
encryption. The problem is the people, especially senior
executives. To address that, you need a combination of technology
and awareness, a process that works together to look at this
issue."
Let us know what you think about the story; email:
Shamus McGillicuddy,
News Writer