Category Archives: Government

Government departments release data on missing IT equipment

Posted on by

Ministry of Defence lost 1,058 items of equipment in 2011-12

Government departments saw 2,070 pieces of IT equipment lost or stolen in 2011-12, according to written answers in the House of Commons.

With the exception of the Department for Education and the Cabinet Office, all central departments have now written formal responses to requests regarding how many pieces of IT equipment were lost or stolen during 2010-11 and 2011-12.

408 of the missing items for 2011-12 were computers and 499 were mobiles, of which 422 were BlackBerrys. 1,163 were categorised as ‘other’.

The requests were lodged by Gareth Thomas MP, Labour’s shadow minister for the Cabinet Office.

Over half of the missing pieces of IT equipment across government were accounted for by the Ministry of Defence (MoD), which lost 1,058 items in total, including 206 computers, 24 mobiles and 34 BlackBerrys. Unlike some other departments, these figures are raw data and do not include any recovered property.

794 pieces of equipment were categorised as ‘other’. This category refers to IT items such as CDs, DVDs, and removable memory such as USB sticks.

Explaining why the figures for the department were so high, an MoD spokesperson said, “The MOD employs more than 250,000 individuals operating all round the world, with frequent movement of forces and equipment between locations in support of operations.”

The spokesperson added, “The MoD takes the loss or theft of equipment very seriously and works hard to detect and deter theft. There are robust processes in place to raise awareness of the need for vigilance in all aspects of security and we actively encourage individuals to report loss or theft. This work has resulted in a rise in the number of reports over the last year.

“Where theft does occur and a suspect is identified, prosecution or internal disciplinary action will follow as appropriate.”

After the MoD, the departments that lost the most equipment include the Ministry of Justice (268) and the Department for Communities and Local Government (151).

However, the Department for Culture, Media and Sport and HM Treasury reported just 10 losses apiece for 2011-12.

In comparison, the Department for Transport and the Department for Business, Innovation and Skills lost 102 pieces of IT equipment each, while the Department for Work and Pensions (DWP) reported 97 items missing. The Department of Health mislaid 63 items, while the Home Office lost 49.

A direct comparison is not possible for the DWP and the Home Office, as they reported data covering each calendar year rather than the financial year. DWP reported 97 losses in 2011 and 48 for 2012. The Home Office mislaid 53 items in 2011; however four of these were recovered. They did not provide data for 2012.

The Northern Ireland Office reported no equipment losses at all for the period. The Wales Office said that there had been one such loss, and the Scotland Office reported four losses.

Shadow Cabinet Office Minister Gareth Thomas MP said, “It’s incredible that so many computers, blackberries and other pieces of IT equipment have been lost.
“With hundreds of pieces of IT equipment being lost across Whitehall, and over a thousand pieces missing at the MOD alone, Ministers should be doing all they can to make sure vital equipment and data are kept secure.”

51% of UK networks compromised by BYOD

Posted on by

Half of UK business networks have already been compromised by the bring-your-own device (BYOD) phenomenon of workers using personal devices for work-related activities and for attaching to corporate networks.

That’s the assessment of new research from Virgin Media Business, which found that in 2012, a full 51% of the UK’s secure IT networks were breached due to employees using personal devices.

In surveying 500 British CIOs, Virgin Media Business found that smaller businesses experienced 25% fewer breaches of security compared to larger organizations.

“Last year was clearly a bumpy road for companies introducing personal devices at work,” said Tony Grace, COO at Virgin Media Business. “That’s natural enough as no one has so far been able to come up with the magic solution. CIOs shouldn’t see this as a burden and in 2013 they can take the lessons learned and turn these personal devices into business enablers to really help drive the bottom line.”

In 2012 the consumerization of IT and BYOD have gone from being buzzwords and theories, to being everyday matters and issues for CIOs. “Security, connectivity and user policies are the three key factors needed to embrace new technology successfully, but this isn’t anything new,” the research found. “With just 20% of big businesses allowing staff to use their own kit in the office, there needs to be a shift in mindset.”

The issue will only grow larger: Virgin Media noted that a tablet was sold every second in the run up to Christmas, up 112% from last year, meaning January is likely to see a clear influx of the devices in the workplace, driving a need for clear policies on BYOD.

“With sales of tablets expected to have gone through the roof over Christmas, it looks like personal devices in the workplace is here to stay,” said Grace. “But with just a fifth of large firms having a BYOD policy, businesses will continue to experience security breaches until connectivity, security and user policies are put in place.”

Security Guardian was designed to make BYOD work at minimal cost.

This article is featured in: Compliance and Policy  •  Industry News  •  Internet and Network Security  •  Malware and Hardware Security  •  Wireless and Mobile Security

 

Ultimate Mobile Data Security

Posted on by

Perfect for the forgetful secret agent… the memory stick that self-destructs by remote control

A data protection company has come up with the perfect piece of kit for the spy who’s more Johnny English than James Bond.

ExactTrak Ltd has developed a memory stick that can be tracked by GPS if it becomes separated from its owner – and can even be destroyed by remote control.

The memory stick, called Security Guardian, is slightly larger than your garden variety device and includes an encrypted memory chip and a SIM card, which means that it can be tracked by GPS and GSM triangulation.

Scroll down for video

Data protection: ExactTrak's Security Guardian includes a SIM card, so that the memory stick can be tracked if it becomes separated from its ownerData protection: ExactTrak’s Security Guardian includes a SIM card, so that the memory stick can be tracked if it becomes separated from its owner

If sensitive information is on board the stick when it is misplaced or stolen, the owner has a variety of ways of disabling or destroying information so that it cannot be viewed or shared.

Owners can sign in to their account and block files and information. Alternatively, they can text a specific code to the stick itself, which will disable the device or lock the files within.

And, if all else fails, users can send a high-voltage charge directly into the stick, melting the internal chip and erasing everything contained on it.

Tracking device: The memory stick can be located by GPS and GSM triangulation. But if that's not good enough, files can be blocked or deleted via remote controlTracking device: The memory stick can be located by GPS and GSM triangulation. But if that’s not good enough, files can be blocked or deleted via remote control

Killer blow: If all else fails, users can send a high-voltage charge directly to the memory stick, frying the internal chip and obliterating all information on it Killer blow: If all else fails, users can send a high-voltage charge directly to the memory stick, frying the internal chip and obliterating all information on it

This killer bolt can be delivered without an internet connection – regardless of whether the device is connected to a computer or not.

The growing interest in data protection follows a number of high-profile cases where sensitive Government information was left on public transport – including a case in 2009 when a Government contractor lost a memory stick containing the information of 84,000 prisoners.

A 2008 report found that more than 3,200 laptops and mobile phones containing sensitive information had been lost or stolen from government departments.

In their sales pitch, ExactTrak claims that 65 per cent of recorded data losses are due to laptops and USB memory devices that go missing

In their sales pitch, ExactTrak claims that 65 per cent of recorded data losses are due to laptops and USB memory devices that go missing.

In a survey by the Ponemon Institute for Intel, 56 per cent of IT managers admitted that they turned off or disable their encryption. A further 35 per cent admitted to sharing passwords with colleagues.

ExactTrak is currently working with Government and corporate clients, developing a range of products that provide mobile data security and asset recovery.

But it’s not reserved for security services, ExactTrak’s website says: ‘Location monitoring and data security services can be delivered either via secure access to our monitoring platform, hosted on the Fujitsu Global Cloud Platform, or can be located within your organisation behind your own firewall.

Data losses on USB sticks – it’s raining again

Posted on by

The problem of lost USB sticks has been back in the news recently with data losses moving from laptops to the storage devices.

In January, the Information Commissioner’s Office (ICO) and the Office of the Data Protection Supervisor (ODPS) for the Isle of Man jointly criticised Praxis Care after an unencrypted memory stick was lost last year. It contained personal information relating to 107 Isle of Man residents and 53 individuals from Northern Ireland.

Last week, the details of more than 1,000 school pupils were lost when a USB stick was misplaced by a member of East Lothian Council.

It was at the end of 2009 that I looked back at ‘a tricky 12 months for the USB stick’ when it was blamed for data loss and Conficker. While the problem has not been eradicated completely, it does seem to be slipping back somewhat.

I recently spoke with a new company offering what it calls the ‘Fort Knox’ of USB memory sticks: I know what you are thinking, heard it all before. Well what caught my attention was that this was less a memory stick and more a tracking device, with GPS and GSM modules to track where it is and deliver this information securely to a management console hosted securely on Fujitsu’s Global Cloud Platform.

It also features remote wipe capabilities of any data on the device, whether it’s plugged in to a USB socket or not.

Named Security Guardian, creator ExactTrak said that its inbuilt software is linked to an online monitoring platform that protects against the biggest problem with mobile data security: human error.

Managing director Norman Shaw told SC Magazine that Security Guardian is been adopted by users due to it being encryption technology-agnostic and available with either 16 or 32GB storage.

He said: “We applied intelligent elements to communicate with the device and we can turn the device on or off and delete the memory. We can know where it is geographically.
“We met with the ICO and they said that it is all very well having encryption but 50 per cent of people share passwords. One of the technologies on this is that if you share a password, you can remotely remove or turn data off. A problem is that data losses are often not reported for months; we say this can overcome the stigma of losing data by saying ‘we lost the device but we deleted the contents of it’.”

Shaw said that this is sold not as a product but as a service, and a recent partnership with Fujitsu saw its Global Cloud Platform selected to host the back-end infrastructure.

The heart of the Security Guardian solution is the management console which provides remote access to the devices and maintains a verifiable audit trail detailing when and where data was accessed. ExactTrak said it needed a partner that could host the management console while providing the utmost levels of security, scalability and availability, and it selected Fujitsu’s Global Cloud Platform as a secure portal and because it could offer “global scalability almost instantly”.

Shaw said: “Once data is on the device it is encrypted. We have Trusted Client technology from Becrypt and the cloud capability from Fujitsu and it is all dynamic data on the device, so what is on there is secure.”

In my recent conversation with Thales, it was suggested that technology should make encryption transparent, and “if you know you are using it then it has gone wrong”. I asked Shaw if he felt there was a problem with encrypted data and that people were not using it.

He said: “Some people realise the problem of encryption, so how do you prove that it was turned on? You say that a laptop was encrypted, but then it appears on eBay and it turns out that it wasn’t encrypted at all.

“With our solution you can say that the data was turned on or off on the management console with a verifiable audit trail and the ICO can say the matter is closed.”

There are solutions out there to prevent data loss and most of them offer different levels of security and capability, and what ExactTrak offers is certainly different – the capability to react after the incident.

Original article from SC Magazine  Feb 2012

Could High Profile Data Losses Be A Thing Of The Past?

Posted on by

Over the past year a number of organisations have suffered high profile data losses, leading to hefty fines and considerable damage to their reputation. With the EU data protection law set to change imminently, the importance of effective strategies to prevent data loss and the ability to detect and respond to data breaches quickly has become of paramount importance to businesses.

The European commission has put forward  proposals that greatly strengthen data privacy laws and see a single set of rules on data protection applied across the EU. The new law would mean increased responsibility and accountability for those processing personal data, with organisations required to inform their national supervisory authority of serious data breaches as soon as possible – within 24 hours where feasible.

This, coupled with the high profile media coverage of data loss incidents, is forcing businesses to become more aware of the risk their operations are exposed to without adequate data security policies.

Additionally, each time we hear about data loss cases such as a lost USB memory stick or a stolen laptop containing sensitive information, which accounts for over 65% of recorded data losses, we are quickly reminded that these are often the result of human error.

One recent story condemns East Lothian Council who lost the personal data of over 1,000 pupils because one employee downloaded the information to a memory stick and subsequently lost it. Another example is Irish telecoms firm eircom, who recently confirmed the theft of three laptops containing personal information of over 7,000 customers.

The laptops were not encrypted and as a result the organisation has been heavily criticised by the Data Protection Commissioner for failing to employ standard data security measures and faces a very hefty fine.

In the UK, unlike some European countries, if the data loss has been caused by the actions of an individual employee, the penalty fine will be issued to the data controller within the company and the company itself will be liable to pay.

This, alongside the fact that human error will inevitably continue and the use of USB memory sticks is only set to proliferate, means that businesses need to adopt technology solutions that work within those parameters to protect themselves.

Even if your organisation uses encryption products, you still have significant exposure. Many surveys and reports have found that encryption is often turned off and there is no way to be able to prove the product was encrypted without recovering it. The sharing of passwords is also a very common potential exposure.

Of course, people can and will always make mistakes but businesses can protect themselves through readily available technology solutions. USB keys exist today that can have their memory turned on, off or deleted remotely and can be located through inbuilt GPS technology. Businesses have the power to avoid future data losses but the solution is just as much a people one as it is a technology one.

Norman Shaw. CEO ExactTrak Ltd. manufacturers of Security Guardian

Published in Business Computing World    Feb 2012