NASA has taken a simple step which will help improve their data security procedures by ensuring that all laptops containing sensitive data are encrypted before taken off-site. This latest security measure has been enforced after the latest incident that saw a laptop and several documents containing ‘sensitive personally identifiable information’ being stolen from an employee’s car.
NASA commented on the incident, stating that the incident occurred on 31st October 2012 and that the laptop that was stolen was password protected but not encrypted. As a result, the data that is on the laptop is much more likely to be compromised than if it were encrypted (in which case data would have been scrambled and require a complicated code to unscramble it).
NASA is utilising the services of the data breach specialist company, ID Experts, in an attempt to limit the overall impact that the incident could have. The affected individuals will receive letters informing them of the data breach and the personally identifiable information that was on the laptop. This letter will also contain information in how they can help protect their personal identity by utilising the services that ID Experts offer at no cost to themselves. There is a concern that the affected people will be contacted asking to confirm personal information so NASA have made clear that no officials from NASA or ID Experts will be contacting them to confirm such information.
Linda Cureton, NASA’s Chief Information Officer has stated that they are aiming to encrypt as many laptops as possible by Wednesday and a one month deadline has been put in place to encrypt all relevant laptops. Employees have also been forbidden from storing data of a sensitive nature on other portable devices such as mobile phones and tablets.
It is concerning that it has taken NASA so long to start to implement more stringent data security measures – taking a simple step such as encrypting data can go a long way in helping to protect sensitive data.
This incident will remind other businesses that they should implement adequate data protection policies such as ensuring that employees encrypt their data on laptops and other portable devices. Such policies can significantly help protect confidential business and personal data. Accompanying this, an adequate data backup method is beneficial. Should a portable device be lost or stolen, the data can be securely recovered and reduce the overall impact that such an incident could have on the running of your business.
Do you backup and encrypt data on your portable devices? Do you feel the need to backup and encrypt data on your portable devices?
