I had an interesting but tragic customer interaction last year. It was for an accounting firm and their representative was a little more than agitated when he walked into our office. Although his company has their own IT department, they occasionally use our services to audit their external internet security.

I had suggested on more than one occasion that an internal audit would also be a good idea, but that wasn’t in the budget at the time. An external White Hat attack is a very good idea for every business, even if you don’t think compliance is important (but it is). For health and financial companies, the internal and external audits are requirements, especially in Oregon where the new Identity Protection Act is starting to take on some sharp teeth.

An internal audit checks more than just outside access coming in. It checks on the way the workstations and servers are set up. We also look at what it would take to walk up to their computers and walk out with them without being caught, or install a virus or key logger to steal information. We look at security cameras, locks on doors, and anything else a thief would think of when coming to a business.

In this particular instance, the company had a laptop stolen. It was a laptop that had a TPM (Trusted Platform Module) chip inside. Many companies are going to this model and it does assist in security and compliance. The TPM is embedded in the motherboard and a link is established between it and the hard drive. If the link is ever broken the encrypted data is unreadable. When a user logs in, the login itself is encrypted. In can be encrypted using a username and password or a fingerprint. It also supports other third party devices such as proximity detectors.

This is all great high tech stuff, and if the laptop is stolen it’s very unlikely the thief would be able to break the encryption. But wait! In their case only the login was encrypted. To show our point we took a different laptop (same model) from the customer, and removed its hard drive. We then plugged the hard drive into another computer and we could read all the data we wanted. We didn’t need the password because only the login was encrypted, not the data. The customer now had a lot of phone calls to make to their clients to let them know their data was likely compromised. The price tag of that loss was said to be in the tens of thousands. Not to mention the loss of customer confidence. By comparison, an internal audit would only have cost them a few thousand dollars.

There are a couple of ways a TPM enabled computer can protect the data. You can use file and folder encryption or full hard drive encryption. File and folder encryption would allow you to encrypt the data in any file or folder of your choosing. The programs and the operating system would remain unencrypted which is fully compliant. The drawback is that you have to remember the password to each folder or file you encrypt, and it’s not as seamless as the next option. Full hard drive encryption does what it says. Everything on the computer hard drive is encrypted. The advantage of seamless computing is great. The disadvantage is that the computer runs more slowly since every file has to be decrypted in order to run and then re encrypted when done. The cost is more for the software as well.

You don’t need a TPM to encrypt your hard drive. You could use a software only encryption, but this is slower than using the TPM which does a lot of the work for you. Software encryption relies more on the hard drive and the processor, which can get intense.

Which ever way you choose, you do need to choose something that’s secure, especially if you have employees who take computers out of the office where they can get stolen. Encrypting the data and not just the login will ensure you don’t have to call all of your customers when one of your staff’s computers disappears from sight.

Robert McMillen is the President of All Tech 1, LLC, a Gold Certified VAR in Portland, OR. He also hosts the All Tech Radio show heard all over the world. You can visit them at http://alltech1.com or email Robert directly at [email protected].