Fri, Sep 05, 2008

Business

Laptop thefts spur tighter security

Company rules make workers more obligated
By Pamela Yip
The Dallas Morning News
Tucson, Arizona | Published: 07.30.2006
DALLAS — If you use a laptop computer to do your job, you soon may have to deal with tougher security policies instituted by your IT department.
The recent rash of data breaches from stolen laptops is spurring companies to tighten policies on how employees use laptops and the information that's stored on them, say lawyers, consultants and company representatives with expertise in information technology and data security.
"The Veterans Affairs one was the one that really grabbed people's attention, just because it's so massive," said William Nolan, an employment attorney and partner at Squire, Sanders & Dempsey in Columbus, Ohio.
Burglars stole a laptop from the Maryland home of a data analyst at the Department of Veterans Affairs in May. The computer contained Social Security numbers and other personal data on 26.5 million veterans and military troops.
Even companies that don't deal with consumer data are paying more attention to laptop security, worried about everything from the loss of trade secrets to simply the value of the computer.
The push for laptop security is being driven by several factors. The main one is that laptops are becoming so pervasive.
Many employees who formerly used a personal computer at work and their own PC at home now use a laptop exclusively, even at the office, so they can do their jobs wherever their busy schedules take them.
"There's a trend toward the mobile work force," said John Livingston, chief executive of Absolute Software in Vancouver, B.C., which helps companies track and recover stolen laptops. "That's an overwhelming trend that's not going to go away."
A second factor is laws such as the Sarbanes-Oxley Act of 2002, which was a response to the corporate fraud at Enron Corp. and WorldCom Inc.
The law holds companies to higher standards in financial reporting, and many are including data security as they tighten internal controls.
Other laws requiring data security are the federal Gramm-Leach-Bliley Act of 1999, which governs financial services companies, and the Health Insurance Portability and Accountability Act of 1996.
But it was a law passed by California in 2002 that brought the issue into the spotlight. The law requires any business, nonprofit organization or state agency to notify California residents if there's a possibility that their personal information was accessed without permission.
That has spurred the announcements of potential data breaches, bringing widespread attention to the problem.
Many organizations have learned painful lessons about how vulnerable laptops can be.
The Veterans Affairs Department dealt with a firestorm of criticism after it announced the potential loss of data on millions of veterans.
The agency promised to provide free credit-monitoring ser-vices to those affected.
The laptop and hard drive were recovered after an informant, motivated by a $50,000 reward, pointed police to them. The sensitive data on the laptop hadn't been copied, the FBI said.
Boeing instituted tougher policies after a laptop containing employees' Social Security numbers and addresses was stolen from an employee last November.
The employee was authorized "to be working with that type of data but was not following our security procedures," spokesman Tim Neale said.
In April, a laptop was stolen from a Boeing human-resources employee at an airport.
The computer contained Social Security numbers and, in some cases, addresses and phone numbers of 3,600 current and former employees. In both cases, Boeing said, the information wasn't encrypted.
Boeing has reinforced its policy that employees access sensitive information through company servers instead of downloading data to their laptops.
More companies are requiring employees to sign computer usage agreements that spell out how workers will use their laptop and the information on it, said Jennifer Berman, managing director at CBIZ HR Advisory & Training Services, a business consulting firm in Chicago..
"That usage agreement should cover everything from the hardware to the software," she said.