Computerworld - I recently attended the RSA Conference in San Francisco, looking for information on encryption and identity management products. I also attended sessions on identity management, vulnerability assessment, security information management and wireless security. All were well attended. On the show floor, meanwhile, many vendors had found a way to put a Sarbanes-Oxley spin on their products.
One of my focus areas this year is mobile device protection, particularly disk encryption. I decided that we needed such a product because 20 to 30 mobile devices go missing from my company each year. Most of those are laptops, along with a few handheld computers and BlackBerry e-mail devices.
A few of the company laptops that disappeared last year were assigned to executives and contained sensitive information. In one case, an executive responsible for software engineering lost a machine that contained the design documents for a new product line, as well as employee contact lists, financial reports and merger and acquisition information. All the data resided within an unencrypted directory. In the wrong hands, that data could have had a significant negative impact on our company. In another case, a salesperson reported that a laptop containing confidential price lists and a locally cached customer list had been stolen.
Now I'm looking for an encryption product to deploy first on the machines of these "high-risk" employees, as we refer to them, with an eye toward potentially installing it on the thousands of machines in use throughout the company. My initial choice is to use the Encrypted File System feature that comes with Windows. Since all of our laptops use Windows 2000 or XP, both of which include EFS, that approach makes a lot of sense.
EFS is fairly easy to deploy, allows for a key escrow capability, includes strong encryption and can be made seamless to the user. If we want to do so, we can also add two-factor authentication to further improve security. However, standardizing on EFS leaves out other mobile devices.
Finding a single encryption product that can address all of these devices would be ideal, but I suspect we will need to deploy several different ones. Unfortunately, few vendors at the show had products in this area, and I'm not too excited about the products I did see. I'll call in other vendors once I complete my risk analysis.
Identity Crisis
I also spent some time with identity management product vendors. Compliance with regulations like Sarbanes-Oxley is a big issue for my company. Identity management tools address the need by controlling
Free Insider GuideCopyright © 1994 - 2012 Computerworld Inc. All rights reserved. Reproduction in whole or in part in any form or medium without express written permission of Computerworld Inc. is prohibited. Computerworld and Computerworld.com and the respective logos are trademarks of International Data Group Inc.
