Mobile Data: A Blessing or a Curse?

Benefits include reduced running costs, increased productivity and more satisfied employees. However, as highlighted by some recent high profile cases, unless laptops are provided with adequate security, these benefits can be reversed at the drop of the hat.

The FSA have recently fined a major UK financial institution almost £1,000,000 as a result of one of their laptops being stolen with confidential customer information on. The story doesn’t end there; the organisation in question also had to write to all of their customers informing them of the situation, costing another £1,000,000 (estimated).

These figures also don’t take into account the negative publicity involved. With data and ID theft so prevalent in the public domain, it is imperative that Financial Institutions have, and are seen to have, adequate protection in place for their confidential data.

If you compare the resulting outlay with the cost of implementing a solution to encrypt data on mobile devices the business case is obvious.

Let's be honest, if laptop users lose data is it really the fault of a virus, an insecure hotspot or worse? A recent Gartner study showed that 86% of all security events in wireless networks are caused by the loss or theft of mobile devices – and not by insecure data transfer.

To look at solutions to the problem of unsecured mobile devices please click here

Use the tips below to check how secure your organisation’s data is:

# 1: Set up an electronic safe

As a basic principle you should never keep valuable information without protecting it. Important papers are kept in a safe, so why not do the same with your critical electronic documents? An electronic safe is a "virtual" disk drive that securely encrypts and stores all its contents. You can easily set up an electronic safe of this kind on local hard disks and network directories, on PDAs, and even on devices such as USB sticks, smartcards, CD-ROMs and DVDs to provide secure storage of your electronic data.

# 2: Implement automatic encryption

What use is the best safe, if the valuable document is simply left unprotected on the shelf next to it? If no one takes the time to think about whether a particular document needs protecting you can never be sure what important information is left lying around. However, if you have implemented transparent whole hard disk encryption on your laptop, you don’t need to worry. It runs automatically in the background, encrypting all your data but without being noticed, so the user does not even have to think about storing data securely.

# 3: Making passwords more difficult to crack

If the worst happens, and your unencrypted computer is lost or stolen, there is still a chance that your data is not all accessible, providing that the password is difficult to crack. A mixture of characters, numbers and letters is considered the most secure – but only if passwords and keys are not stored on the hard disk. For this reason it is better if the computer prompts for a password before the operating system starts to boot – electronic security solutions enable this. This prevents unauthorised users from accessing the operating system or saved data in any way.

# 4: Use hardware to supplement password protection

Analysts working for Gartner have confirmed what IT managers already know, namely that passwords alone do not provide optimum protection for data. The alternatives have been available, and in use, for years. These include special smartcards or tokens – which look just like USB sticks – which store key information that is used in combination with a user password to unlock the computer. Only someone who has the token and knows the password can access the system and the data saved on it. Alternatively, the user's biometric data can be stored on a smartcard. For authentication, the user's fingerprint is checked directly on the card, instead of the password.

# 5: Secure hibernation mode

You can set up the system to prompt for the password again when the notebook switches back from the screen saver or from hibernation mode to normal working mode. This means your data is still secure if you stop for a break or you are making a phone call in the train or airport.

# 6: Restrict plug and play

Plug and Play devices are convenient, but carry inherent risks for data. If someone connects a USB stick, MP3 player or external hard disk drive to a notebook, it is recognised automatically and it is then easy to start exporting data and passing it on to the wrong people. It is possible to stop all memory media running on company computers apart from the company's own memory sticks. In turn, these authorised devices can be set so that they cannot run or read programs. This also removes the danger of accidentally loading a worm or virus on your network. Utimaco recommend that you only put sensitive data on USB sticks when it is encrypted, as the smaller the memory device, the greater the danger that it will get lost or stolen.

# 7: More discipline when on the move

It might sound obvious, but if you travel with a notebook, you should always make sure that you really have the notebook case, including all its contents before you leave the plane, taxi or train. A recent Utimaco survey found that in the last year alone, more than 5,000 mobile devices were handed in to the lost property departments at just ten of the largest airports in Germany, Austria and Switzerland. At airports that have a large number of short haul routes that are primarily used by business travellers, several dozen mobile devices are turned in daily. On busy days, as many as a hundred devices per day are reported.