While most IT security focuses on technology, network connectivity, firewalls, antivirus, and patching, you cannot overlook the importance of physical security.
It doesn’t mean that you should hire bodyguards or enrol in martial arts classes, but it does mean that your staff travelling with business IT resources should be aware of their surroundings and take basic precautions to safeguard the equipment and data in their care.
Here are some of these basic physical security best practices:
Users should maintain situational awareness of their surroundings at all times and pay attention to potential threats.
They should not talk loudly on the phone or with colleagues about sensitive topics when others are within earshot.
They should not pull out their phone and pay more attention to it than to walking down the street or standing at a train platform.
They should not set up their laptop where someone can easily grab it and run off, and they should not travel alone in ‘sketchy’ areas.
There will be times when users cannot maintain direct physical control of IT resources, such as when their laptop goes through the X-ray machine at the airport.
But they can maintain visual contact with their equipment and ensure that they are not letting their laptop go through the X-ray machine until they are able to go through the metal detector too.
Users should also ensure that any portable media that is not directly connected to their computer and within sight is either in their pocket, or put away out of sight in their bag, which must remain within their control. It only takes a second for someone to grab a USB key and walk off with it.
Don’t provide anyone with the opportunity to grab something of yours while you are not looking.
Accidents will happen. Thefts occur too. By encrypting all data on all portable storage and laptop hard drives, when something does grow wings and flies away, at least the sensitive data stored on the hardware will not be readily accessible to the new ‘owner’.
Make sure you use strong encryption, a very strong password, and you don’t leave the password written down on a Post-It note that flies away with the stolen goods.