Physical Security Considerations for Laptop Computers and PDAs

As technology advances, we see the creation of new, smaller, and more powerful computing devices. In light of the prevalence of telecommuters and remote offices, and the frequency of business travel, these small computing devices such as laptops and PDAs require special security considerations. The theft and misuse of these devices present a high risk to the infrastructure of an organization, as they often function with the same level of access as their larger and less portable cousins. Many of these portable computers have special security methods that allow the user to protect the device and the information they store on it. The company policies that govern the use of laptops and PDAs should require putting these capabilities to use.

Company Z has established a set of Security Policy Considerations for Laptops and PDAs. These physical and configuration considerations include

· Laptops and PDAs should be configured to support power-on passwords if possible, in order to protect against unauthorized use if stolen.

· Users should log out and power off the system when not in use, instead of putting the system into standby mode. This prevents unauthorized users from impersonating you, should they gain access to the system.

· Private and sensitive data should be protected via encryption and passwords, if possible.

· Users should use different passwords on all of their portable and non-portable systems to defend against compromise of multiple systems via a stolen password.

· When temporarily leaving your workspace, care should be taken to either lock the system via a password-protected screensaver or log out completely.

· Laptops and PDAs should be physically secured by a locked cable, tether, or other security device at all times.

· If no security method is available, the system should be locked in a cabinet drawer or other secured storage area when not in use.