Twelve desktop computers were stolen from the human resource offices of the Oakland school district. And while there were security policies in place, district spokesman Troy Flint pointed out that “there's only so much you can do when people are determined to accomplish an objective.” This is another case where the use of full disk encryption would have limited the damage to the loss of the hardware only, since the use of encryption services like AlertBoot ensures data security.
While an official number hasn’t been announced, there are estimates that the personal information of 100 new hires is to be found in those computers. I would assume that names, addresses, and Social Security numbers would be compromised, at least, the last one being required by federal law. Officials are still trying to determine what information may be compromised, and want to get in touch with those affected prior to releasing the details to the media.
How’d the thieves break in? The office where the computers were located was on the second floor, so the thieves scaled a wall and used wire cutters to get through a metal screen on a window. The alarm system was not triggered (perhaps they didn’t have one set up in the upper floor?) Security guards are not employed to monitor the building 24/7, and there were no internal security cameras. Makes me wonder what type of security policies these guys had in place. Sure, there’s “only so much you can do”…but, it sounds like they had the bare minimum. Granted, the risk of someone breaking in into their building would have seemed low, so going crazy with security details may not have been an option—in terms of energy or money—but shouldn’t the bare minimum also have included something like computer encryption? I often allude to it being the bare minimum when it comes to data security, since I’d put it as part of the foundation of data security, along with the use of firewalls, locked doors, and what not.
I mean, a screen on a window was the only barrier preventing access to the second floor. Seems to me they would have needed something much more substantial. Any cries of “well, who’d have thought that…blah blah blah?” would fall on deaf ears, if it were up to me. While there may not be a way to precisely point out when someone’s going to break in to your offices, or how, things going missing from an office are just a matter of time. This is no different from a guy complaining that he didn’t think his laptop computer would be stolen from the trunk of his car because it never happened before. To him, that is. It’s happened to plenty of other people—it will probably happen to you as well, sooner or later. Likewise with office burglaries. In fact, that the reason why data encryption is such a formidable way of securing your data: it’s the ultimate defensive weapon. Stolen cars; muggings; office burglaries; renegade, schizo-klepto employees; a wormhole in the space‑time continuum…the loss of the computer becomes irrelevant when it comes to protecting data if it’s already encrypted.
Related Articles:
http://www.sfgate.com/cgi-bin/article.cgi?f=/c/a/2008/09/03/MN8F12NM56.DTL
http://www.mercurynews.com/breakingnews/ci_10372819