• Calendar
• A-Z Index

Find it

• About ITS
• Policies
• Feedback
• Search ITS
• ITS A-Z Index
• System Status

Securing laptops and mobile devices

Overview

Mobile technology (portable devices) adds another dimension to issues related to information security. Physical security is paramount. Never leave portable computing devices (or portable storage media) unattended and unlocked. Make sure access to data on the device and physical access to the device itself is appropriately restricted. Portable devices such as PDAs, USB memory sticks and laptops are all especially vulnerable to loss or theft. Protective measures include storing devices in a locked briefcase or cabinet, using password protection and encryption.

Please see best practice recommendations for additional security measures to assist in securing portable computing devices.

Encryption software

Encryption is a very important tool to safeguard protected and confidential data, but it is a powerful tool that needs to be installed and used with caution. Information that is directly related to the business of Yale University (finance & administration, HR, student affairs, legal, primary source clinical and research data) should only be encrypted using a University approved method which provides the ability for Yale to recover the data in the event of an emergency. Please be sure that you have read and understand the University Endorsed Encryption Implementation Procedure before you implement any encryption option.

Pretty Good Privacy (PGP) encryption software (using Yale ADK -Additional Encryption Key) is available from the Software Library. PGP Desktop Pro provides both file and whole disk encryption.

Physical locks and security

Portable devices, such as laptops, are particularly vulnerable to theft and resale, and should be properly secured with a lock. Many laptops have slots made to connect a lock. These locks are available at most computer stores.

Minimize physical security risks by:

• Never leaving your mobile gear unattended, even for a moment. If you must leave your mobile gear in a car - put it in the trunk and lock the trunk.
• Use a carrying case for your laptop that is sturdy and doesn't scream 'laptop inside'.
• If you are going out for coffee or lunch - lock your gear in a desk or an office that can be locked.
• Secure the locations of mobile devices as well, and remember access control procedures:
  • regular review of people who have key, swipe, PIN card access
  • change PINs regularly and/or when people leave their position
  • know who has access to enable/disable fire doors
  • locks on each office, not simply the area/suite
  • procedures to coordinate physical security options for buildings not owned by the University

Click here to show/hide the physical security comparison table

Password protection

Passwords are the keys used to access personal information stored on computers and in online accounts. In controlling access to anything, trade-offs are made between security and convenience. If a resource is protected by a password, then security is increased with a consequent loss of convenience for users. You can use one or more password types to guard access to your computer or mobile device.

Include techniques such as:

• Never setting programs to automatically logon (e.g., email, VPN, or any authentication information to Yale and non-Yale systems including banking, other affiliated institutions, etc…).
• Never save (unencrypted) passwords on your local drive (e.g., in a file, as an address book entry or browser bookmark).
• When choosing a smartphone, PDA or other mobile technology that incorporates email, only choose an email client that supports SSL/TLS.

Click here to show/hide the password protection comparison table

Recovery preparation

There are steps you can take to safeguard your device and data which will make recovery a smooth operation.

Recommendations include:

• Keep all sensitive data, files and email on a secure Yale server.
• When choosing a smartphone, PDA or other mobile technology that incorporates email, only choose hardware/software that keeps email on Yale servers (no storage on vendor mail servers).

Click here to show/hide the recovery preparation comparison table

Repurpose and recycle mobile devices

Mobile devices are often handed down from one user to another, and little thought is given to the data and security when disposing of these devices.

The following techniques apply:

• Read the Yale guidelines in place for the Disposal of Media Containing Confidential or Protected Health Information.
  
• If you store unencrypted protected or confidential information on your computer's hard drive, the drive should never be returned to the manufacturer or a non-Yale service center for repair or warrantee replacement.
• Always backup regularly and configure your computer, so that you understand what directories contain files, data, and email.

Click here to show/hide the repurpose and recycle table

Recommended security profiles

 

Click here to show/hide the recommended security profiles table

Lost/stolen electronic media or computing device

If you need to report lost or stolen electronic media or a computing device please complete our lost/stolen form and send it to security@yale.edu.