# Presentation: 247962

## U.S. Department of Commerce

**IT Security Considerations for Commerce Travelers Briefing**
**January 25, 2005**
**Nancy A. DeFrancesco, CISSP, CISA, CIA**
**IT Security Program Manager**

## Overview

- Understanding IT security threats, vulnerabilities, and risks to portable IT devices
- Requirements and tips for protecting portable IT devices
- Requirements and tips for protecting sensitive information

## Threats, Vulnerabilities, and Risks

**Threats**
- Mother nature

- Spies/Hackers

- Thieves

## Threats, Vulnerabilities, and Risks

**Threats (continued)**
- YOU!!!

## Threats, Vulnerabilities, and Risks

- Vulnerabilities
- Due to small size, portable devices may be misplaced, left unattended, exposed to adverse environmental conditions, or stolen.
- User authentication may be disabled, a common default mode, divulging the contents of the device to anyone who possesses it.
- Even if user authentication is enabled, the authentication mechanism may be weak or easily circumvented or viewed by “shoulder-surfers.”

## Threats, Vulnerabilities, and Risks

- Vulnerabilities
- Wireless transmissions may be intercepted and, if unencrypted or encrypted under a flawed protocol, their contents made known.
- The ease with which handheld devices can be interconnected wirelessly, combined with weak or no authentication of the parties involved, provides new avenues for the introduction of viruses or other types of malicious code, and also other forms of attack such as a man-in-the-middle attack.

## Threats, Vulnerabilities, and Risks

- Risks
- Compromised Confidentiality – unauthorized disclosure of sensitive information
- Compromised Integrity – unauthorized modification of information
- Compromised Availability – lost or damaged portable IT devices causing inability to accomplish official duties/ mission

## Tips

- Protect portable IT devices to ensure Availability
- DOC requires adequate physical and environmental protection of Commerce IT resources
- Properly secure your IT devices.
- Prepare for adverse weather
- Will it be raining/flooding?  Have zip-lock plastic bags handy!
- Going to a very hot or very cold location? Avoid exposing IT devices to excessive temperature extremes!
- Protect against power interruptions and differences in power current. Power strips alone will not protect you from power outages, but there are products that do offer an uninterruptible power supply when there are power surges or outages.
- Check the security of the device on a regular basis.

## Tips

- Protect portable IT devices to ensure Availability
- TSA recommends that travelers
- Place mobile phones and PDAs **IN** carry-on.
- Take laptops with you as a carry-on “personal item” and take the laptop **OUT** of the case before placing on the X-ray belt.
- Use baggage locks “accepted and recognized by TSA.”
**LABEL** your laptop computer.  Tape a business card or other identifying information beneath your laptop to avoid loss or the accidental "exchange" by travelers.

## Tips

- Protect portable IT devices to ensure Availability
- The US-CERT recommends that travelers
- Consider storing important data separately – There are many forms of storage media, including floppy disks, zip disks, CDs, DVDs, and removable flash drives (also known as USB drives or thumb drives). By saving your data on removable media and keeping it in a different location (e.g., in your suitcase instead of your laptop bag), you can protect your data even if your laptop is stolen. You should make sure to secure the location where you keep your data to prevent easy access.

## Tips

- Protect portable IT devices to ensure Availability
- The US-CERT (continued)
- Consider a device alarm or lock - Many companies sell alarms or locks that you can use to protect or secure your laptop. If you travel often or will be in a heavily populated area, you may want to consider investing in an alarm for your laptop bag or a lock to secure your laptop to a piece of furniture.
- Downplay your laptop or PDA - There is no need to advertise to thieves that you have a laptop or PDA. Avoid using your portable device in public areas, and consider non-traditional bags for carrying your laptop.

## Tips

- Protect portable IT devices to ensure Availability
- The US-CERT (continued)
- Keep your laptop or PDA with you at all times - When traveling, keep your laptop with you. Meal times are optimum times for thieves to check hotel rooms for unattended laptops or other portable devices that are likely to contain sensitive information.
- Report loss or theft to your organization and to the appropriate local authorities. These parties may include representatives from law enforcement agencies, as well as hotel or conference staff.

## Tips

- Protect Sensitive Information from Compromise
- DOC requires implementation of adequate data integrity, software, and technical controls, including
- Use passwords – Take advantage of password security features on IT devices.
- Don't choose options that allow your computer to remember passwords and use different passwords for different programs.
- Use hard-to-guess passwords. Mix upper case, lower case, numbers, or other characters not easy to find in a dictionary, and make sure they are at least eight characters long.
- Regularly download security updates and patches for operating systems and other software.

## Tips

- Protect Sensitive Information from Compromise
- DOC requires (continued)
- Install and maintain anti-virus software - Make sure to keep your virus definitions up to date.
- Back up any data you have on your computer onto a CD-ROM, DVD-ROM, or network.
- Not only will this ensure that you will still have access to the information if your device is stolen, but it could help you identify exactly which information a thief may be able to access. You may be able to take measures to reduce the amount of damage that exposure could cause.
- Disconnect from the Internet when not in use.

## Tips

- Protect Sensitive Information from Compromise
- DOC requires (continued)
- Install and maintain a firewall, especially if you are traveling and utilizing different networks. Firewalls can help prevent outsiders from gaining unwanted access.
- Encrypt files - By encrypting files, you ensure that unauthorized people can't view data even if they can physically access it.
- You may also want to consider options for full disk encryption, which prevents a thief from even starting your laptop without a passphrase. When you use encryption, it is important to remember your passwords and passphrases; if you forget or lose them, you may lose your data.

## Tips

- Protect Sensitive Information from Compromise
- DOC requires (continued)
- Do NOT use portable IT devices for the transmission or storage of national security information unless you _and_ the device have been previously cleared for national security information by the Department of Commerce.
- Check security on a regular basis. When you arrive at a new location, reevaluate your computer security.
- Make sure you know what to do if your portable device becomes compromised. If your device contained sensitive government information, immediately report the loss or theft to your organization so that they can act quickly.

## Tips

- Resources for Government Travelers
- DHS/U.S. Computer Emergency Readiness Team (_[http://www.us-cert.gov](http://www.us-cert.gov/)_ )
- Tips for securing your portable devices and configuring web browsers
- DHS/Transportation Security Administration (_[http://www.](http://www.tsa.gov/public/display?theme=1)__[tsa](http://www.tsa.gov/public/display?theme=1)__[.gov/public/display?theme=1](http://www.tsa.gov/public/display?theme=1)_)
- Security tips for travelers
- DHS/U.S. Customs and Border Protection (_[http://www.customs.ustreas.gov/xp/cgov/travel/](http://www.customs.ustreas.gov/xp/cgov/travel/)_ )
- Tips for transporting devices across borders
- U.S. Department of State ( _[http://travel.state.gov/](http://travel.state.gov/)_)
- International travel tips and travel warnings
- DOT/Federal Aviation Administration (_[http://www.](http://www.faa.gov/passengers)__[faa](http://www.faa.gov/passengers)__[.gov](http://www.faa.gov/passengers)_)
- Policies and regulations for air travel

## Tips

## Slide 19

## Slide 20

## Questions???

Nancy A. DeFrancesco
(202) 482-3490
NDeFrancesco@doc.gov 

*Nancy A. DeFrancesco*
*(202) 482-3490*
- _[NDeFrancesco@doc.gov](mailto:NDeFrancesco@doc.gov)__ _