Laptop-tracking technology rarely used among SMBs

By Shamus McGillicuddy, News Writer 17 Apr 2007 | SearchSMB.com

Technology news and tips for midmarket CIOs Digg This!     StumbleUpon     Del.icio.us

There was a laptop stolen right from under our noses at our warehouse. Todd Rosner Director of IT, Mediaco

It's almost epidemic. The average business loses about 5% of its laptop inventory to theft. Top law enforcement agencies aren't even immune. The FBI reportedly experiences three to four laptop thefts a month.

Even more alarming: From 2005 to 2006 there was an 81% increase in the number of companies reporting stolen laptops containing sensitive information, according to Ponemon Institute LLC, a research think tank dedicated to advancing privacy and data protection practices.

Given that experts contend laptop thieves are opportunists after hardware rather than the sensitive data found on them, wouldn't a technology that can track that stolen hardware be helpful? Oh, wait -- there is one, and it's most likely installed on your laptop. It's probably just not activated.

If your laptop has a tracking device, there are companies that can track it. Absolute Software Corp. in Vancouver, for instance, installs a software agent on its customers' laptops that calls in daily to a company's IT desk via an Internet connection. If the laptop is reported stolen, Absolute's Computrace product will instruct it upon its first subsequent connection to the Internet to send Absolute its IP address every 15 minutes. With that information, Absolute's staff, working with law enforcement, tracks down the laptop.

It's like a LoJack for your laptop.

Absolute's product also includes technology that customers can use to destroy data remotely in case the laptop can't be recovered in time. The deletion technology can be policy-based -- for example, IT can instruct the laptop to delete sensitive data if it remains off the corporate network for a certain period of time.

This laptop-tracking technology is used often in large companies because it's sold as a feature by manufacturers. Smaller companies are less aware of the tracing technology because they purchase products through resellers that are less likely to play up the feature as a selling point, experts said.

Khalid Kark, a senior analyst at Cambridge, Mass.-based Forrester Research Inc., said cost pressures also inhibit smaller companies from investing in security products for laptops.

"Maybe they can implement one or two pieces of the solution, but they might not have the budget to implement a strategy across the board," Kark said. "Smaller companies are not paying attention to this, or they might be happy to solve just one piece of the puzzle."

A year and a half ago, Todd Rosner noticed a surge in laptop theft within his organization.

Rosner is the director of IT at Mediaco, a small multimedia and audiovisual production company in Burnaby, British Columbia. About 75% of his company's 60 full-time employees have laptops.

"[The thefts] were just ongoing all of a sudden," Rosner said. "We had to stop the hemorrhaging. There was a laptop stolen right from under our noses at our warehouse. Some guy just walked past our building and saw a laptop, so he rolled under a loading bay door and snuck in without a person in the cabling aisles seeing him and stole the laptop. We had a few smash and grabs from automobiles. And there've been cases where people left their laptops on planes or had them stolen from their own homes."

Rosner said he has recovered about five stolen laptops since he started using Absolute's Computrace. He said he has spent about $3,000 on Absolute Software's product during the past year and a half, and it has recovered about $6,000 worth of hardware. There was one laptop Absolute was able to track down but couldn't recover.

More on IT security Midmarket CIOs take heat for security snafus Fidelity laptop snafu spotlights need for security policies

"Organized crime is so advanced right now," Rosner said. "We had one that went almost instantly to Nigeria after it was stolen. In certain areas of the world they can't work with ISPs and police to recover the laptops."

Rosner's only option was to delete the data on the computer taken to Nigeria.

"The data you always want to protect for sure," Rosner said. "There are some people who have more important data relative to the company than other people will. We initiated the data delete option. You've got to make sure everybody has consistent backups here. If our CEO gets his laptop stolen, initially we'll report it as stolen. Then we initiate the data delete. Then the next time it makes a call in to Computrace, Computrace runs an application that tells it what files to delete."

Kark said no one one technology can totally secure a company's laptops. A total solution requires technologies from several vendors.

"Absolute has a few of these things, but they don't have everything," Kark said. "I think it's very difficult to have everything in one product."

Kark said companies need to encrypt their data, too. Data deletion isn't enough.

"Yes, the technologies are there that can help you do pieces of this problem," Kark said. "But the problem is not really data encryption. The problem is the people, especially senior executives. To address that, you need a combination of technology and awareness, a process that works together to look at this issue."

Let us know what you think about the story; email: Shamus McGillicuddy, News Writer

Tags: Information security management for the midmarket,  Risk management for the midmarket,  Security tools for the midmarket,  VIEW ALL TAGS

Digg This!     StumbleUpon     Del.icio.us

RELATED CONTENT Information security management for the midmarket Using key risk indicators to sell your information security program IT security spending a bright spot in '09, with more growth predicted Gartner: Vetting security of third-party partners in five steps Locking down security in the move to electronic medical records Security and risk management in the midmarket Identity and access management planning guide for the midmarket Information systems management for the midmarket CIOs share advice on doing more with less Get smart about patching security vulnerabilities A CIO's advice for implementing single sign-on solutions Risk management for the midmarket Using key risk indicators to sell your information security program Gartner: Vetting security of third-party partners in five steps Security and risk management in the midmarket Identity and access management planning guide for the midmarket Get smart about patching security vulnerabilities Log management tool saves big on network fixes, integrates with IPS Unified communications: Securing access to OCS Disaster recovery and business continuity planning: Know the risks Database security: Who should have access? San Francisco network lockup justifies CIO fears Security tools for the midmarket IT security spending a bright spot in '09, with more growth predicted Security and risk management in the midmarket Identity and access management planning guide for the midmarket A CIO's advice for implementing single sign-on solutions Options for outsourcing security grow, offer IT budget savings Network access control: Pointers for getting the knack of NAC Unified communications: Securing access to OCS Unified communications security: How safe is it? Database security: Who should have access? San Francisco network lockup justifies CIO fears

RELATED RESOURCES 2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems Search Bitpipe.com for the latest white papers and business webcasts Whatis.com, the online computer dictionary