US Border Policy Shifts May Drive Changes in Laptop Security

by Ericka Chickowski, Contributing Writer, Dark Reading, March 31, 2017

In-cabin laptop ban and requirements to unlock devices for border patrol could have enterprises revisiting their on-device data policies.

The new travel ban enacted by the U.S. Department of Homeland Security for laptops in the cabin of flights from certain countries may have corporate risk managers revisiting policies about how road warriors handle data on laptops and mobile devices.

Enterprise employees may find that government actions won’t just put a crimp on convenience but could also have heavy implications – from a regulatory and intellectual property protection perspective – when combined with growing powers of US Border Control to demand travelers unlock their devices for inspection. As things develop, large organizations doing international business may be facing a new minefield when it comes to device-based data portability in and out of U.S. soil.

At the bare minimum, experts believe this latest decree by the feds will bolster resolve for existing policies on endpoint security as worries about devices disappearing from checked luggage grows.

“It’s going to force people to actually implement and enforce the policies they have on paper,” says George Wrenn, CEO and founder of CyberSaint Security, and a research affiliate MIT’s (IC3) Critical Infrastructure Protection Program. He explains that most large organizations already have policies on device encryption, authentication and data storage to plan for loss or theft. “They’re just not enforced,” he says, “because people will carry their laptops and they’re considered to be using other compensatory strategies to prevent the loss of intellectual property and data.”

The question now becomes how to effectively enforce policies that have long been ignored, says Jonathan Gossels, president and CEO of SystemExperts.

“This is not rocket science.  We are talking whole disk encryption, good quality passwords or two factor authentication, and key management,” he says.  “Blocking and tackling, but it has to be enforced by each company to be effective.”

Nevertheless, even with the basic blocking and tackling in place, many organizations may still be squirrely about laptops with corporate secrets or customer data sets being parted from their caretakers into aircraft holds.

“Most organizations won’t feel comfortable with employees packing away their company-owned laptops and other IT equipment into their luggage, even if they are properly secured with encryption and passwords,” says Richard Steinnon, Chief Strategy Officer of Blancco Technology Group. “So, I imagine that employees traveling to the countries included in this ban will likely be asked by their employers to not carry these devices with them. If they have to, they will likely be told to remove all non-essential data before they check in their IT assets in their baggage.”

In some instances, simply leaving a corporate laptop unattended may already be against company policy. For example, warns Eric O’Neill, national security strategist for Carbon Black and a former FBI counter-terrorism operative, military contractors likely wouldn’t be able to bring their laptops on affected legs.

“When traveling internationally, the rule of thumb is to keep all critical devices on your person – especially phones, laptops and tablets that have important information on them, or access to important or sensitive information,” he says.

The travel ban is just one part of the equation. Even more troubling are the inspection rights that border patrol have increasingly been asserting with regard to devices, even those locked by their possessors.

“The long-term substantial impact is that key information may be exposed, unpredictably, and for no substantive reason, to inspectors who have no right to that access,” says Mark Graff, CEO of Tellagraff and former CISO for Nasdaq. “This development may well open these companies to litigation exposure any inadvertent violation of data security regulations. It is only a matter of time before companies fined for violating federal standards take the federal government to court for forcing that violation with the new order inspection practices.”

Both the laptop ban and the requirement of unlocking devices for inspectors throw up data confidentiality and integrity issues, explains Phillip Hallam-Baker, vice president and principal scientist at Comodo. However, the latter is a lot more difficult because there are few compensating controls.

To read what other experts have to say, click here.