Update (03 JUNE 2010): AvMed has revised their figures of affected patients to 1.2 million, from its initial 210,000. Two computers were stolen from AvMed Health Plans, compromising the information for nearly 210,000 subscribers and dependents. It sounds like disk encryption was used to protect the laptops; however, there is a fear that "one of the laptops may not have been encrypted properly."
Update (03 JUNE 2010): AvMed has revised their figures of affected patients to 1.2 million, from its initial 210,000.
Two computers were stolen from AvMed Health Plans, compromising the information for nearly 210,000 subscribers and dependents. It sounds like disk encryption was used to protect the laptops; however, there is a fear that "one of the laptops may not have been encrypted properly."
The information security breach affects 80,000 current subscribers and dependents, as well as 128,000 former subscribers and their dependents. The information dates back to April 2003. The theft of laptops occurred on December 10 of last year from a locked conference room. The rooms remained secured throughout the night until being discovered missing the next day. The implication seems to be that someone with keys to the locked room was involved, such as janitors or night security staff. It was not revealed how AvMed arrived to the conclusion that encryption software, meant to protect the information, was not installed properly. It could mean that it was only done partially, such as encrypting a partition in the computer's drive instead of using full disk encryption to protect the entire thing. Or, perhaps, the company used file encryption to protect individual files, and only realized after an investigation that important files were not protected. Or, the company could be referring to their overall encryption program: it could be that the one computer was found not to be encrypted at all, when it should have been.
The information security breach affects 80,000 current subscribers and dependents, as well as 128,000 former subscribers and their dependents. The information dates back to April 2003.
The theft of laptops occurred on December 10 of last year from a locked conference room. The rooms remained secured throughout the night until being discovered missing the next day. The implication seems to be that someone with keys to the locked room was involved, such as janitors or night security staff.
It was not revealed how AvMed arrived to the conclusion that encryption software, meant to protect the information, was not installed properly.
It could mean that it was only done partially, such as encrypting a partition in the computer's drive instead of using full disk encryption to protect the entire thing. Or, perhaps, the company used file encryption to protect individual files, and only realized after an investigation that important files were not protected. Or, the company could be referring to their overall encryption program: it could be that the one computer was found not to be encrypted at all, when it should have been.
Let's face it: figuring out what was encrypted and what wasn't is hard, and becomes harder the more equipment you've got to protect. Imagine an organization that has 1,000 employees. Chances are, there are also 1,000 computers. And while not all of them store sensitive information, management has decided to encrypt all computers because it's impossible to figure out which computers will end up with sensitive information. Now, I'm not going to argue that that is a terrible approach to security. It's quite apparent, just by taking a peek at data breach news, that people really have no idea where sensitive data ends up, so it's definitely a valid approach. However, it does create a logistical problem: how can administrators tell whether all computers have been properly protected? Just like security tends to be an afterthought to software programs, such administrative needs seem to be afterthoughts when it comes to security software as well. Not so with centrally-managed AlertBoot encryption software, which was developed with the above in mind. The audit reporting is integrated with the encryption software, allowing one to easily see login attempts, user actions, and the encryption status of computers.
Let's face it: figuring out what was encrypted and what wasn't is hard, and becomes harder the more equipment you've got to protect.
Imagine an organization that has 1,000 employees. Chances are, there are also 1,000 computers. And while not all of them store sensitive information, management has decided to encrypt all computers because it's impossible to figure out which computers will end up with sensitive information.
Now, I'm not going to argue that that is a terrible approach to security. It's quite apparent, just by taking a peek at data breach news, that people really have no idea where sensitive data ends up, so it's definitely a valid approach.
However, it does create a logistical problem: how can administrators tell whether all computers have been properly protected? Just like security tends to be an afterthought to software programs, such administrative needs seem to be afterthoughts when it comes to security software as well.
Not so with centrally-managed AlertBoot encryption software, which was developed with the above in mind. The audit reporting is integrated with the encryption software, allowing one to easily see login attempts, user actions, and the encryption status of computers.
Related Articles and Sites:http://www.gainesville.com/article/20100208/ARTICLES/100209476/1002http://www.ocala.com/article/20100208/ARTICLES/100209743?Title=AvMed-Data-of-208-000-at-risk-after-theft