A couple of months ago, a NASA laptop containing personal information about employees was stolen. Apparently, this is not a rare occurrence. If you google for “stolen laptop containing personal information,” you get thousands of hits. Ugh.
I used to lose sleep at night because so many of my staff use laptops as their primary work machine. All of my Project Managers, New Biz team members and Directors carry laptops. We even have Netbooks that staff can check out if they are headed to a meeting. The risks are obvious. Laptops contain company confidential proposals and reports. They have passwords stored in browsers to make it easier to visit websites. They store passwords so we can VPN into our intranet and check e-mail.
While Matrix Group has an amazing track record of zero loss/zero theft of laptops and PCs (knock on wood), I still lost sleep. What would happen if a laptop were lost or stolen? Forget the cost of the machine. What would it take to recover from the loss? How quickly could credentials be changed? How much damage would we suffer if confidential information were released publicly? Would we even know about all of the passwords that would need to be changed?
Today, all Matrix Group laptops have encrypted hard drives. Windows laptops use TrueCrypt, a free, open source tool for encrypting hard drives. Mac users take advantage of the built-in encryption capabilities through FileVault2. Yes, laptop users need to login to their machines twice: once to unencrypt the hard drive and a second time to login to the machine/network. We also use strong, long passwords so it takes a few extra seconds to type our passwords. And yes, there is a bit of lag while we wait for the hard drives to become available.
Is encrypting the hard drives worth the effort, hassle and wait time?
Absolutely! My encryption password is 34 characters long and contains letters, characters and numbers. While I know that any password can be cracked but it will take a really, really long time to crack my password. So, for all intents and purposes, if my laptop were to get lost or be stolen, the machine would be a nice paperweight until the hard drive is reformatted. Although I love my Sony laptop (I have a nice one with a carbon fiber body and a solid state drive), I can always get another one. It’s the data that I really care about.
The Ponemon Institute last year reported that 329 organizations surveyed lost more than 86,000 laptops over the course of a year. The Institute further calculated each loss to be worth $49,246, which meant these 329 companies alone lost over $4 billion! (Can you even imagine how 329 companies lost 86,000 laptops? What are they doing to these things?)
So, my question to you is: what would happen to you and your organization if your laptop were lost or stolen?
Addendum to this blog post from December 7, 2016: In 2014, development on TrueCrypt was discontinued. When I upgraded my laptop to Windows 10, I started using device encryption from Microsoft. Here’s a great article from comparitech that answers questions about TrueCrypt and provides alternatives for encrypting your drives. Whatever you do, use something to protect your drives, especially laptop drives. Don’t just “hope” your laptop doesn’t get stolen and “hope” that the folks who steal your laptop don’t care about your data.
