Itís an issue that has caught out a number of very high-profile organisations, from the UK financial institution, the Nationwide Building Society, to MI5, the British security service. Both have suffered embarrassing losses of laptops, with the potential for damaging data leaks from those devices.
Whatís more, the problem is growing. In the 2006 FBI security survey in America, theft of laptops and mobile devices was second only to viruses as the most common type of attack detected over the previous year. Nearly 50% of those responding to the survey had suffered, with an average loss per respondent of over $30,000 USD Ė up from under $20,000 the previous year.
So how should mobile data security be addressed? Broadly, this means looking at three key issues. The first issue is hard disk encryption of laptops, and smart devices such as PDAs, mobile phones and USB devices. Second is the requirement to audit and control data transfer and access to removable media, for example USB keys or iPods. The final issue is control of the security policy running on the userís endpoint device Ė irrespective of type of device.
Letís now look at each of these issues separately Ė and how security administrators can best control the use of mobile technologies to give the widest access to corporate resources while maintaining control to the organisationís security policy.
Disk Encryption: full-disk or file?
Once you have decided it is necessary to protect your mobile devices then you will need to decide on whether to implement full-disk encryption (FDE) or file-based encryption. The latter is tempting, because Windows XP comes with file-based encryption built in Ė in common with Linux, and the Macintosh operating system. While these methods mean that anything stored in specific folders or directories is encrypted automatically, there is a significant security flaw. They rely on users putting files in the encrypted folders themselves.
Thatís fine in theory, but as an IT professional do you want to rely on users to know what is sensitive information and two to place it into the appropriate folder. Even for the sharpest end-users the issue is further complicated by popular applications such as Outlook and Web browsers, which scatter attachments across file systems, often in obscure places. Folder-level encryption helps only if the IT department can tightly control all files and applications.
File encryption is only as good as your end-usersí level of interest or knowledge. Simply put would you leave updating the corporate AV software, or software patching to your users? The key advantage of full disk encryption is that it automates the process and secures the entire disk, so mobile users donít have to worry about it Ė and also cannot interfere with it. Enterprise data encryption solutions also offer central management with tools for resetting passwords when the user forgets or leaves so the corporate data remains a corporate asset. Letís look at some of the factors it is worth considering with a full disc encryption product.
Performance and standards matters
Increasingly, compliance emphasis is being placed on encryption that meets the Federal Information Processing Standard (FIPS) developed by the United States Federal government. This entails the use of either Triple DES (Data Encryption Standard) or 256-bit AES (Advanced Encryption Standard) as the encryption algorithm.