Newton’s first law of motion states that a moving body will want to keep moving. The same law also seems to apply to business data, and the problem is trying to stop that mobile data moving further than you want it to.

It’s an issue that has caught out a number of very high-profile organisations, from the UK financial institution, the Nationwide Building Society, to MI5, the British security service. Both have suffered embarrassing losses of laptops, with the potential for damaging data leaks from those devices.

What’s more, the problem is growing. In the 2006 FBI security survey in America, theft of laptops and mobile devices was second only to viruses as the most common type of attack detected over the previous year. Nearly 50% of those responding to the survey had suffered, with an average loss per respondent of over $30,000 USD – up from under $20,000 the previous year.

So how should mobile data security be addressed? Broadly, this means looking at three key issues. The first issue is hard disk encryption of laptops, and smart devices such as PDAs, mobile phones and USB devices. Second is the requirement to audit and control data transfer and access to removable media, for example USB keys or iPods. The final issue is control of the security policy running on the user’s endpoint device – irrespective of type of device.


Let’s now look at each of these issues separately – and how security administrators can best control the use of mobile technologies to give the widest access to corporate resources while maintaining control to the organisation’s security policy.

Disk Encryption: full-disk or file?

Once you have decided it is necessary to protect your mobile devices then you will need to decide on whether to implement full-disk encryption (FDE) or file-based encryption. The latter is tempting, because Windows XP comes with file-based encryption built in – in common with Linux, and the Macintosh operating system. While these methods mean that anything stored in specific folders or directories is encrypted automatically, there is a significant security flaw. They rely on users putting files in the encrypted folders themselves.

That’s fine in theory, but as an IT professional do you want to rely on users to know what is sensitive information and two to place it into the appropriate folder. Even for the sharpest end-users the issue is further complicated by popular applications such as Outlook and Web browsers, which scatter attachments across file systems, often in obscure places. Folder-level encryption helps only if the IT department can tightly control all files and applications.