Laptop-tracking technology rarely used among SMBs

Laptop theft isn't just a problem for large, high-profile companies. IP-based laptop-tracking technology can help SMBs, too.

Laptops get ripped off all the time. Just ask officials from the Chicago Public Schools (CPS) district. Earlier this month, CPS reported that two of the district's laptops, which contained the names and Social Security numbers of about 40,000 current and former employees, were stolen from one of its downtown administrative offices. The school district is ready to pony up a $10,000 reward for information leading to an arrest or the recovery of the computers.

There was a laptop stolen right from under our noses at our warehouse.
Todd Rosner
Director of ITMediaco
It's almost epidemic. The average business loses about 5% of its laptop inventory to theft. Top law enforcement agencies aren't even immune. The FBI reportedly experiences three to four laptop thefts a month.

Even more alarming: From 2005 to 2006 there was an 81% increase in the number of companies reporting stolen laptops containing sensitive information, according to Ponemon Institute LLC, a research think tank dedicated to advancing privacy and data protection practices.

Given that experts contend laptop thieves are opportunists after hardware rather than the sensitive data found on them, wouldn't a technology that can track that stolen hardware be helpful? Oh, wait -- there is one, and it's most likely installed on your laptop. It's probably just not activated.

If your laptop has a tracking device, there are companies that can track it. Absolute Software Corp. in Vancouver, for instance, installs a software agent on its customers' laptops that calls in daily to a company's IT desk via an Internet connection. If the laptop is reported stolen, Absolute's Computrace product will instruct it upon its first subsequent connection to the Internet to send Absolute its IP address every 15 minutes. With that information, Absolute's staff, working with law enforcement, tracks down the laptop.

It's like a LoJack for your laptop.

Absolute's product also includes technology that customers can use to destroy data remotely in case the laptop can't be recovered in time. The deletion technology can be policy-based -- for example, IT can instruct the laptop to delete sensitive data if it remains off the corporate network for a certain period of time.

This laptop-tracking technology is used often in large companies because it's sold as a feature by manufacturers. Smaller companies are less aware of the tracing technology because they purchase products through resellers that are less likely to play up the feature as a selling point, experts said.

Khalid Kark, a senior analyst at Cambridge, Mass.-based Forrester Research Inc., said cost pressures also inhibit smaller companies from investing in security products for laptops.

"Maybe they can implement one or two pieces of the solution, but they might not have the budget to implement a strategy across the board," Kark said. "Smaller companies are not paying attention to this, or they might be happy to solve just one piece of the puzzle."

A year and a half ago, Todd Rosner noticed a surge in laptop theft within his organization.

Rosner is the director of IT at Mediaco, a small multimedia and audiovisual production company in Burnaby, British Columbia. About 75% of his company's 60 full-time employees have laptops.

"[The thefts] were just ongoing all of a sudden," Rosner said. "We had to stop the hemorrhaging. There was a laptop stolen right from under our noses at our warehouse. Some guy just walked past our building and saw a laptop, so he rolled under a loading bay door and snuck in without a person in the cabling aisles seeing him and stole the laptop. We had a few smash and grabs from automobiles. And there've been cases where people left their laptops on planes or had them stolen from their own homes."

Rosner said he has recovered about five stolen laptops since he started using Absolute's Computrace. He said he has spent about $3,000 on Absolute Software's product during the past year and a half, and it has recovered about $6,000 worth of hardware. There was one laptop Absolute was able to track down but couldn't recover.

More on IT security
Midmarket CIOs take heat for security snafus

Fidelity laptop snafu spotlights need for security policies
"Organized crime is so advanced right now," Rosner said. "We had one that went almost instantly to Nigeria after it was stolen. In certain areas of the world they can't work with ISPs and police to recover the laptops."

Rosner's only option was to delete the data on the computer taken to Nigeria.

"The data you always want to protect for sure," Rosner said. "There are some people who have more important data relative to the company than other people will. We initiated the data delete option. You've got to make sure everybody has consistent backups here. If our CEO gets his laptop stolen, initially we'll report it as stolen. Then we initiate the data delete. Then the next time it makes a call in to Computrace, Computrace runs an application that tells it what files to delete."

Kark said no one one technology can totally secure a company's laptops. A total solution requires technologies from several vendors.

"Absolute has a few of these things, but they don't have everything," Kark said. "I think it's very difficult to have everything in one product."

Kark said companies need to encrypt their data, too. Data deletion isn't enough.

"Yes, the technologies are there that can help you do pieces of this problem," Kark said. "But the problem is not really data encryption. The problem is the people, especially senior executives. To address that, you need a combination of technology and awareness, a process that works together to look at this issue."

Let us know what you think about the story; email: Shamus McGillicuddy, News Writer

Read more on IT risk management