Getting physical with security

I've just been reading yet another rundown of data breaches and it continues to amaze me that so many are actually based around some sort of physical, rather than technical, issue.

I learned long ago that all computer security starts with the physical side – after all, there is no point having secure logins, firewalls and other electronic security if somebody can walk in off the street and take your servers and equipment from unlocked and insecure server rooms and desks.

The fly in the ointment at the moment is laptops. More people are using laptops, and their increased used means more people are taking what was secure data with them and exposing them to more situations where the hardware or the data could be stolen.

The physical security is still important, and the obvious tips still apply, like not using a laptop bag (since you may as well carry a flag saying rob me), never letting it out of your sight, and locking it up somewhere safe when you are not using it or carrying it with you.

On laptops though, the software side is just as important. Anything you can do to secure the information, passwords, encryption, will help. But I also think we need to look to manufacturers for more help.

What we need is a solution that is easy to use, doesn't require user thought or intervention to enforce, and yet still secures and encrypts the information.

Most users don't use a secure encryption system, but producing a drive that at a hardware level could be keyed somehow to the hardware it was installed with would go a long way to resolving some of those issues. In the right machine, the drive decrypts and works. In the wrong one, it looks blank. That would prevent thieves stealing the laptop and fitting the drive in something else to read off the data.

Until then, we need to rely on better education of users so they use encryption and don't lose the physical hardware. I can't help but feel though that that is going to be a longer and more difficult approach.