This entry is part of the series Ten things you can do to improve IT security and reliability without spending money

Here’s a funny thing about laptop computers—they have a bad habit of getting lost or stolen.  Even laptops that are not ordinarily taken out of the office have this same habit.

At a minimum, you should be insisting that any laptops in your organization are protected with strong passwords—meaning they cannot be started up and used without first entering a password.

An improvement on this is to use biometrics, like the fingerprint readers that come pre-installed in many different models, including this laptop that I am using.   (There are add-in devices that you can get that will retro-fit a laptop with biometric protection.   But we haven’t located any that are available for free.)

If laptops have confidential data, human resources data, or personally identifiable information, we recommend encryption as an added layer of protection.

First, a quick word about personally identifiable information (or PII).  Personally identifiable information refers to any information that can be used to uniquely identify, contact or locate a single person. The privacy regulations concerning PII are getting increasingly strict, at both the state and federal levels.  So if you have a list of names and addresses of employees or of sponsor and donors, on your laptop, we strongly recommend that the laptop be encrypted.  And if any of those names include any Massachusetts residents, you may be subject to a new law enacted last year in Massachusetts that REQUIRES you to use encryption.

Here is a Microsoft article about laptop security which includes links to articles on how to encrypt laptops that use the more recent Windows version (see http://www.microsoft.com/atwork/security/laptopsecurity.aspx).