Laptop theft is a significant
threat
A threat is a communication of intent to inflict harm or loss on another person. Intimidation is a tactic used between conflicting parties to make the other timid or psychologically insecure for coercion or control. The act of intimidation for co ...
to users of
laptop
A laptop, laptop computer, or notebook computer is a small, portable personal computer (PC) with a screen and alphanumeric keyboard. Laptops typically have a clam shell form factor with the screen mounted on the inside of the upper li ...
and
netbook
Netbook was a commonly used term that identified a product class of small and inexpensive laptops which were sold from 2007 to around 2013. These machines were designed primarily as cost-effective tools for consumers to access the Inte ...
computers. Many methods to protect the data and to prevent
theft
Theft is the act of taking another person's property or services without that person's permission or consent with the intent to deprive the rightful owner of it. The word ''theft'' is also used as a synonym or informal shorthand term for some ...
have been developed, including alarms, laptop locks, and visual deterrents such as stickers or labels. Victims of laptop theft can lose hardware, software, and essential data that has not been
backed up
Constipation is a bowel dysfunction that makes bowel movements infrequent or hard to pass. The Human feces, stool is often hard and dry. Other symptoms may include abdominal pain, bloating, and feeling as if one has not completely passed the bo ...
. Thieves also may have access to sensitive data and personal information. Some systems authorize access based on credentials stored on the laptop including
MAC address
A media access control address (MAC address) is a unique identifier assigned to a network interface controller (NIC) for use as a network address in communications within a network segment. This use is common in most IEEE 802 networking techno ...
es,
web cookie
HTTP cookies (also called web cookies, Internet cookies, browser cookies, or simply cookies) are small blocks of data created by a web server while a user is browsing a website and placed on the user's computer or other device by the user's we ...
s,
cryptographic key
A key in cryptography is a piece of information, usually a string of numbers or letters that are stored in a file, which, when processed through a cryptographic algorithm, can encode or decode cryptographic data. Based on the used method, the key c ...
s and stored
password
A password, sometimes called a passcode (for example in Apple devices), is secret data, typically a string of characters, usually used to confirm a user's identity. Traditionally, passwords were expected to be memorized, but the large number of ...
s.
According to the
FBI
The Federal Bureau of Investigation (FBI) is the domestic Intelligence agency, intelligence and Security agency, security service of the United States and its principal Federal law enforcement in the United States, federal law enforcement age ...
, losses due to laptop theft totaled more than $3.5 million in 2005. The
Computer Security Institute/FBI Computer Crime & Security Survey found the average theft of a laptop to cost a company $31,975. In a study surveying 329 private and public organizations published by Intel in 2010, 7.1% of employee laptops were lost or stolen before the end of their usefulness lifespan. Furthermore, it was determined that the average total negative economic impact of a stolen laptop was $49,256—primarily due to compromised data, and efforts to retroactively protect organizations and people from the potential consequences of that compromised data. The total cost of lost laptops to all organizations involved in the study was estimated at $2.1 billion. Of the $48B lost from the U.S. economy as a result of
data breach
A data breach is a security violation, in which sensitive, protected or confidential data is copied, transmitted, viewed, stolen or used by an individual unauthorized to do so. Other terms are unintentional information disclosure, data leak, info ...
es, 28% resulted from stolen laptops or other portable devices.
In the 2011, Bureau Brief prepared by the
NSW Bureau of Crime Statistics and Research
The Bureau of Crime Statistics and Research (BOCSAR), also known as NSW Bureau of Crime Statistics and Research, is an agency of the Department of Communities and Justice responsible for research into crime and criminal justice and evaluation o ...
it was reported that thefts of laptops have been on the increase over the last 10 years, attributed in part by an increase in ownership but also because they are an attractive proposition for thieves and opportunists. In 2001 2,907 laptops were stolen from New South Wales dwellings, but by 2010 this had risen to 6,492, second only to cash of items taken by thieves. The Bureau reports that one in four break-ins in 2010 resulted in a laptop being stolen. This startling trend in burglaries lends itself to an increase in identity theft and fraud due to the personal and financial information commonly found on laptops. These statistics do not take into account unreported losses so the figures could arguably be much higher.
Businesses have much to lose if an unencrypted or poorly secured laptop is misappropriated, yet many do not adequately assess this risk and take appropriate action. Loss of sensitive company information is of significant risk to all businesses and measures should be taken to adequately protect this data. A survey conducted in multiple countries suggested that employees are often careless or deliberately circumvent security procedures, which leads to the loss of the laptop. According to the survey, employees were most likely to lose a laptop while travelling at hotels, airports, rental cars, and conference events.
Behling and Wood examined the issue of laptop security and theft. Their survey of employees in southern New England highlighted that not only were security measures fundamentally basic but that training employees in security measures was limited and inadequate.
* 100% of the surveyed employees had access to company information via a laptop from remote sites that included their own homes.
* 78% were authorized to store company data on their laptop.
* 36% of businesses did not provide security training.
They concluded that trends in laptop thefts needed to be monitored to assess what intervention measures were required.
Inside protection
Passwords are no longer adequate to protect laptops. There are many solutions that can improve the strength of a laptop's protection.
Full disk encryption
Disk encryption is a technology which protects information by converting it into unreadable code that cannot be deciphered easily by unauthorized people. Disk encryption uses disk encryption software or hardware to encrypt every bit of data that g ...
(FDE) is an increasingly popular and cost-effective approach.
Full disk encryption
Disk encryption is a technology which protects information by converting it into unreadable code that cannot be deciphered easily by unauthorized people. Disk encryption uses disk encryption software or hardware to encrypt every bit of data that g ...
can be taken on from a software-based approach, a hardware-based approach, or both-end-based approach. FDE provides protection before the operating system starts up with
pre-boot authentication
Pre-boot authentication (PBA) or power-on authentication (POA) serves as an extension of the BIOS, UEFI or boot firmware and guarantees a secure, tamper-proof environment external to the operating system as a trusted authentication layer. The PB ...
, however precautions still need to be taken against
cold boot attack
In computer security, a cold boot attack (or to a lesser extent, a platform reset attack) is a type of side channel attack in which an attacker with physical access to a computer performs a memory dump of a computer's random-access memory (RAM) b ...
s.
There are a number of tools available, both commercial and open source that enable a user to circumvent passwords for Windows, Mac OS X, and Linux. One example is TrueCrypt which allows users to create a virtual encrypted disk on their computer.
Passwords provide a basic security measure for files stored on a laptop, though combined with
disk encryption software
Disk encryption software is computer security software that protects the confidentiality of data stored on computer media (e.g., a hard disk, floppy disk, or USB device) by using disk encryption.
Compared to access controls commonly enforced by ...
they can reliably protect data against unauthorized access.
Remote Laptop Security
Remote may refer to:
Arts, entertainment, and media
* ''Remote'' (1993 film), a 1993 movie
* ''Remote'' (2004 film), a Tamil-language action drama film
* ''Remote'' (album), a 1988 album by Hue & Cry
* Remote (band), ambient chillout band
* ...
(RLS) is available to confidently secure data even when the laptop is not in the owner's possession. With Remote Laptop Security, the owner of a laptop can deny
access rights to the stolen laptop from any computer with
Internet
The Internet (or internet) is the global system of interconnected computer networks that uses the Internet protocol suite (TCP/IP) to communicate between networks and devices. It is a '' network of networks'' that consists of private, pub ...
access.
Physical protection
A number of
computer security
Computer security, cybersecurity (cyber security), or information technology security (IT security) is the protection of computer systems and networks from attack by malicious actors that may result in unauthorized information disclosure, the ...
measures have emerged that aim at protecting data. The
Kensington Security Slot
A Kensington Security Slot (also called a K-Slot or Kensington lock) is part of an anti-theft system designed in the mid 1980s and patented by Kryptonite in 1999–2000,''Security anchor/tether assemblage for portable articles'': and (Corneli ...
along with a locking cable provides physical security against thefts of opportunity. This is a cord that is attached to something heavy that cannot be moved, and is then locked into the case of the laptop, but this is not 100% secure.
The
Noble security lock slot
A noble is a member of the nobility.
Noble may also refer to:
Places Antarctica
* Noble Glacier, King George Island
* Noble Nunatak, Marie Byrd Land
* Noble Peak, Wiencke Island
* Noble Rocks, Graham Land
Australia
* Noble Island, Gr ...
is a different way to attach a security cable.
Centralization of laptop data
Another possible approach to limiting the consequences of laptop theft is to issue
thin client
In computer networking, a thin client is a simple (low-performance) computer that has been optimized for establishing a remote connection with a server-based computing environment. They are sometimes known as ''network computers'', or in th ...
devices to field employees instead of conventional laptops, so that all data will reside on the server and therefore may be less liable to loss or compromise. If a thin client is lost or stolen, it can easily and inexpensively be replaced. However, a thin client depends on network access to the server, which is not available aboard airliners or any other location without network access.
This approach can be coupled with strong authentication as such
single sign-on
Single sign-on (SSO) is an authentication scheme that allows a user to log in with a single ID to any of several related, yet independent, software systems.
True single sign-on allows the user to log in once and access services without re-enterin ...
(SSO).
Major laptop thefts
In 2006 a laptop in custody of a data analyst was stolen that contained personal and health data of about 26.5 million active duty troops and veterans. The agency has estimated that it will cost between $100 million to $500 million to prevent and cover possible losses from the data theft. In 2007, the
United States Department of Veterans Affairs
The United States Department of Veterans Affairs (VA) is a Cabinet-level executive branch department of the federal government charged with providing life-long healthcare services to eligible military veterans at the 170 VA medical centers a ...
agreed to pay $20 million to current and former military personnel to settle a class action lawsuit.
In 2007 the
Financial Services Authority
The Financial Services Authority (FSA) was a quasi-judicial body accountable for the financial regulation, regulation of the financial services industry in the United Kingdom between 2001 and 2013. It was founded as the Securities and Investmen ...
(FSA) fined the UK’s largest building society,
Nationwide, £980,000 for inadequate procedures when an employees’ laptop was stolen during a domestic burglary. The laptop had details of 11 million customers’ names and account numbers and, whilst the device was password protected, the information was unencrypted. The FSA noted that the systems and controls fell short, given that it took the Nationwide three weeks to take any steps to investigate the content on the missing laptop. The substantial fine was invoked to reinforce the FSA’s commitment to reducing financial crime.
In 2010 VA reported the theft of the laptop from an unidentified contractor; the computer contained
personally identifiable information
Personal data, also known as personal information or personally identifiable information (PII), is any information related to an identifiable person.
The abbreviation PII is widely accepted in the United States, but the phrase it abbreviates ha ...
on 644 veterans, including data from some VA medical centers' records.
After learning about the unencrypted laptop, VA investigated how many VA contractors might not be complying with the encryption requirement and learned that 578 vendors had refused to sign new contract clauses that required them to encrypt veteran data on their computers, an apparent violation of rules.
Common locations
LoJack for Laptops
Absolute Home & Office (originally known as CompuTrace, and LoJack for Laptops) is a proprietary laptop theft recovery software ( laptop tracking software). The persistent security features are built into the firmware of devices. ''Absolute Home & ...
has compiled a list of the top ten places from which laptops are stolen:
# Public Schools (K-12)
# Residential Properties
# Automobiles (excluding taxis)
# Businesses/Offices
# Universities and Colleges
# Restaurants and Cafes
# Hotels and Motels
# Dormitory
# Airports
# Public Transit (taxi, bus, train)
To provide some context, the Ponemon Institute released a study that indicates over 600,000 laptops will be lost or stolen at US airports every year, with 65-69% of them remaining unclaimed.
Ponemon Institute, Airport Insecurity: The Case of Lost Laptops, June 2008
/ref>
See also
* Device tracking software
Device tracking software is software installed in an electronic device that is capable of reporting the device's location remotely. Depending upon the software and the device on which it is installed, the software may obtain the location of the dev ...
* IT risk
Information technology risk, IT risk, IT-related risk, or cyber risk is any risk related to information technology. While information has long been appreciated as a valuable and important asset, the rise of the knowledge economy and the Digital Re ...
* Pre-boot authentication
Pre-boot authentication (PBA) or power-on authentication (POA) serves as an extension of the BIOS, UEFI or boot firmware and guarantees a secure, tamper-proof environment external to the operating system as a trusted authentication layer. The PB ...
* Prey (software)
Prey is a software and online platform for mobile device tracking, management, and protection available for laptops, tablets, and mobiles. The software and service is developed by the Chilean company Prey Inc., successor of the funding company For ...
References
External links
*
The spy who lost me
- laptop thefts from the British Ministry of Defence
{{unsourced, date=February 2021
A ministry of defence or defense (see spelling differences), also known as a department of defence or defense, is an often-used name for the part of a government responsible for matters of defence, found in states ...
2005 CSI/FBI Computer Crime and Security Survey
- statistics and information about computer crime
{{Authority control
Computer security exploits
Theft
Theft
Theft is the act of taking another person's property or services without that person's permission or consent with the intent to deprive the rightful owner of it. The word ''theft'' is also used as a synonym or informal shorthand term for some ...