Geesh, every single day there is at least one news report about a stolen or lost mobile (laptop, notebook, PDA, Blackberry, etc.) computer! Today one of the reports was about a laptop computer, containing cleartext information about 11,000 hospital patients, that was stolen from a doctor’s home in Staffordshire, U.K.
A couple of days ago I posted the first section from the second article in my “IT Compliance in Realtime” journal issue for June.
Here’s the second section from that article…
————————————
Six Ways Organizations Can Lessen Mobile Computing Risks
As demonstrated over and over again in the past several months, mobile computing devices and storage media present huge risks to businesses and PII. Because of the portability of these devices, organizations are entrusting the security of the information stored upon them into the hands of the people using them.
It is necessary for an effective mobile computing device and storage media security management program to be in place.
There are many actions organizations need to take to protect the mobile computing devices, storage media, and the data stored upon them. The following is a laundry list of precautions you should take, as appropriate and applicable to your organization:
- Awareness and Training–Train your personnel and provide ongoing awareness messages regarding how to appropriately secure mobile computing devices and storage media. Make sure they know how to protect their mobile computing device passwords.
- Physical Protection–Require personnel to keep their mobile computing devices and storage media with them at all times while they are away from your facilities. Tell them not to leave the devices in cars, unattended in meeting rooms, and so on. There are portable safes or locking mechanisms you might want to consider using, based upon the risks involved with your travelers who are carrying your sensitive information.
- Policies and Device Management–Maintain an inventory of all your mobile computing devices and storage media and the people who are authorized to use them, along with the data stored upon them.
- Encryption–Require all confidential information and PII stored on mobile computing devices and storage devices to be strongly encrypted.
- Data Issues–Do not allow entire databases containing PII to be stored on mobile computing devices. If PII is necessary for some approved business reason, use only the records the end user truly needs for business purposes.
- Miscellaneous Technology Protections–Implement tools and procedures to enforce firewall requirements, malicious code prevention, authentication, hardware tracking, data inventorying, and software use policies.
————————————
Thoughts? Comments? Feedback? Please let me know!
Regarding the doctor’s stolen laptop mentioned at the beginning of this post, here is an excerpt from that news story:
“”Though not encrypted, the confidential information on the laptop was protected by a complex password system, which only a person with specialist computer knowledge would be able to crack.” He said the laptop appeared to have been stolen for its resale value, rather than for any information stored upon it.”
Aarrrrgghhh! These kind of irresponsible statements made by organizations who experienced privacy breaches as a result of poor security practices need to stop!
It really is riduculous to speculate about why an unknown thief, with unknown motives, stole a laptop and determine it was not stolen for the data. Are the people from these organizations making these silly statements psychic!?
And honestly, the “complex password system” on virtually all computers is very easy to crack and defeat within mere seconds by any person…thieves included…who is armed with one of the very large numbers of available easy-to-use password crackers (many free).
The data on the computer should have been strongly encrypted.
And for what legitimate reason did a doctor need to have the patient records of 11,000 people at his home?
I’d be willing to bet the clinic had poor or no type of information security or privacy training required for every person using a mobile computer.
Tags: awareness and training, Information Security, IT compliance, laptop theft, mobile computing, mobile computing risks, patient privacy, policies and procedures, privacy training, risk management, security training, stolen laptop