In Brief

Ideas to Head Off Runaway Data

Preventing data breaches from lost or stolen laptops

October 01, 2006 — CSO — What to do about the rash of data breaches resulting from lost or stolen laptops? We asked four former CISOs and learned they believe the problems require a three-pronged response: Educate employees and enforce policies designed to regulate their systems use. Minimize human mistakes. And plug technical security gaps.

Our panelists included Bruce Brody, former CISO of the Department of Veterans Affairs who is now VP information security at Input; Chrisan Herrod, former CSO of the Securities and Exchange Commission; Bryan Palma, former CISO of PepsiCo; and consultant Paul Wing, former head of information security and privacy at Scotiabank. They said that companies should identify which data is important to keep secure, and they offered these suggestions for companies that have done so:

• Set up policies and standards for how to protect sensitive data—and check they are being followed. First ask, "Does the information even need to be accessible through a laptop?" If so, "Who should have access?" Next, log when data is accessed and by whom, and assign staff to check that log on a monthly or quarterly basis.

• Secure sensitive data like customers' personal information using more than one technique.

Employ two-factor authentication to mobile data systems, using, for example, a fingerprint reader as well as a password; and time-out functions that require remote access devices to be limited to 30

minutes before requiring reauthorization.

• Enforce your data security policies, with employees and contractors.

–Katherine Walsh