It’s an issue that has caught out a number of very high-profile organisations, from the UK financial institution, the Nationwide Building Society, to MI5, the British security service. Both have suffered embarrassing losses of laptops, with the potential for damaging data leaks from those devices.
What’s more, the problem is growing. In the 2006 FBI security survey in America, theft of laptops and mobile devices was second only to viruses as the most common type of attack detected over the previous year. Nearly 50% of those responding to the survey had suffered, with an average loss per respondent of over $30,000 USD – up from under $20,000 the previous year.
So how should mobile data security be addressed? Broadly, this means looking at three key issues. The first issue is hard disk encryption of laptops, and smart devices such as PDAs, mobile phones and USB devices. Second is the requirement to audit and control data transfer and access to removable media, for example USB keys or iPods. The final issue is control of the security policy running on the user’s endpoint device – irrespective of type of device.
Let’s now look at each of these issues separately – and how security administrators can best control the use of mobile technologies to give the widest access to corporate resources while maintaining control to the organisation’s security policy.
Disk Encryption: full-disk or file?
Once you have decided it is necessary to protect your mobile devices then you will need to decide on whether to implement full-disk encryption (FDE) or file-based encryption. The latter is tempting, because Windows XP comes with file-based encryption built in – in common with Linux, and the Macintosh operating system. While these methods mean that anything stored in specific folders or directories is encrypted automatically, there is a significant security flaw. They rely on users putting files in the encrypted folders themselves.
That’s fine in theory, but as an IT professional do you want to rely on users to know what is sensitive information and two to place it into the appropriate folder. Even for the sharpest end-users the issue is further complicated by popular applications such as Outlook and Web browsers, which scatter attachments across file systems, often in obscure places. Folder-level encryption helps only if the IT department can tightly control all files and applications.
By subscribing to our early morning news update, you will receive a daily digest of the latest security news published on Help Net Security.
With over 500 issues so far, reading our newsletter every Monday morning will keep you up-to-date with security risks out there.