ccess.
- Bulk shipments of laptops. The military, government agencies, and educational organisations are particularly vulnerable to laptop theft during transport.
- Expensive assets. Customised telecommunications laptops for field technicians, for example, are particularly tempting to thieves. As a result, their sensitive data are at greater risk of exposure.
- Security applications installed at the OS or BIOS level. These can be robust solutions, but are at risk of being circumvented or disabled.
- Security credentials are often stored in software. This makes them vulnerable to attacks aimed at gaining access to applications and data.
User behavior continues to increase risk
Users themselves can also cause security problems. They often keep passwords in places that a thief can access—such as on a sticky note kept with a laptop or in a wallet. In addition, assets aren’t always returned at the end of a lease or when users move to new positions or new companies. While loss of assets is costly because of end-of-lease buyouts, costs can escalate because of exposure of sensitive data stored on those unreturned systems.
Data breach costs are still rising
Companies face both direct and indirect costs in the aftermath of a data breach:
- Stiffer fines, more post-incident requirements, and higher post-incident costs. For example, the average organisational cost of a data breach increased to US$6.75 million in 2009.
- Loss of intellectual property. Seventy-one per cent of laptop thefts result in a data breach, exposing not only client and consumer data but proprietary data as well.
- Legal costs of investigation, notification, and resolution of the incident. In 2009, average per-victim cost was US$204, an increase of US$2 per customer record compared to similar costs the year before.
- Credit monitoring. A company may need to provide costly credit monitoring for individuals who could be affected by the data breach.
- Damage to the brand. Loss of public and investor confidence, business opportunities, and revenue that result from a company’s damaged reputation is responsible for US$144 (70 per cent) of the US$204 average cost of a compromised record.
Strict new regulations
To help protect clients and consumers, regulatory bodies are passing increasingly strict laws both in Europe and North America.
In the United States, most states now have a data-breach notification law or similar legislation that regulates data security and accountability. These state laws include requirements for public disclosure of breaches as well as potential fines or other sanctions.
Managing and mitigating risk: A robust, layered approach
In today’s high-risk environment, the security of assets and sensitive data requires a layered approach (see Figure 1) that reaches beyond the OS and BIOS down into hardware. By implementing intelligent hardware-based technologies (such as tying encryption to a laptop’s hardware), IT administrators can better protect sensitive data. This protection extends even after a laptop goes missing and even if a thief has access to security credentials.
Figure 1. A layered approach to protect assets and sensitive data on laptops. Security is installed at the OS level, integrated in BIOS and firmware, and also designed into hardware. This layered approach helps businesses manage and mitigate risk and improve compliance with new regulations.
Intel® AT: Intelligent, automated policy-based protection
Intel® Anti-Theft Technology (Intel® AT) adds a deep layer of protection for laptops. An intelligent and automated technology, Intel AT is built directly into laptop hardware. Intel AT can detect theft conditions and respond locally and automatically based on IT policy, or respond to a remote poison pill sent by a central server. Remote poison pills (and reactivation messages) can be sent over an IP-based or 3G-based network.
IT administrators can now be more assured that a laptop is under control of the authorised user. If lost or stolen, the laptop can be rapidly and automatically locked down based on IT policy, and its encryption inform