<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="MSHTML 6.00.6000.16544" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV>
<TABLE cellSpacing=0 cellPadding=0 width="100%" border=0>
<TBODY>
<TR>
<TD vAlign=top width="65%">
<DIV><SPAN class=Article_Deck><B><A
href="http://www.eweek.com/article2/0,1895,2228887,00.asp">http://www.eweek.com/article2/0,1895,2228887,00.asp</A></B></SPAN><SPAN
class=Article_Deck> </SPAN><BR></DIV></TD><!--talkback count-->
<TD vAlign=top align=right width="35%">
<DIV id=talkback_bug><FONT face=Arial size=2></FONT> </DIV></TD><!--end talkback count--></TR>
<TR>
<TD class=Article_Posts align=left colSpan=2><FONT face=Arial
size=2></FONT></TD></TR>
<TR vAlign=top>
<TD class=Article_Content align=left colSpan=2>
<P>Thieves stole a laptop from the home of a Forrester Research employee
during the week of Nov. 26, potentially exposing the names, addresses and
Social Security numbers of an undisclosed number of current and former
employees and directors, the company said in a letter mailed to those
affected on Dec. 3.
<P>Forrester "Chief People Officer" Elizabeth Lemons said in the letter
that the hard drive is password-protected but made no mention of
encryption.
<P>The laptop contained records pertaining to those who have received
grants of Forrester stock options or who have participated in the research
firm's Employee Stock Purchase Plan, according to the letter. Those who
have done contractual work for the consultancy, but who haven't
participated in either stock plan, also appear to be affected.
<P>The incident appears to be a clear case of, "Do as I say, not as I do."
Besides the irony of a technology consultancy that apparently does not
encrypt sensitive data on employee laptops, the office of Forrester's
"chief people officer" apparently had not informed the firm's media staff
of the incident before sending out the letter.
<P>When eWEEK contacted Forrester's press hotline on Dec. 5, a staffer
said that this was the first she had heard of the incident.
<P><FONT face=Arial size=2>[...]</FONT>
<P>The idea that password protection actually protects laptop data is one
that's laughed out of the room by security professionals. "Anybody with a
relative clue, or at least a copy of <A href="http://www.knoppix.net/"
target=_blank>Knoppix</A> or <A href="http://fire.dmzs.com/"
target=_blank>F.I.R.E.</A> [data recovery tools], could potentially bypass
security measures implemented on lost or stolen drives. Period," wrote
data breach experts at <A
href="http://attrition.org/news/content/99-09-10.001.html">Attrition.org</A>,
a volunteer-run site that keeps a running list of data breaches relied on
by organizations including <A
href="http://www.privacyrights.org/identity.htm" target=_blank>Privacy
Rights Clearinghouse</A>.
<P>"Unless data on a drive is encrypted with a key either unknown or
inaccessible to an intruder, that data is open to compromise," Attrition
said in a February <A href="http://attrition.org/dataloss/forensics.html"
target=_blank>posting</A> that followed the recovery of a lost VA laptop.
<P>"We won't even go into cracking AES256 or 3DES here; for the most part,
such measures are impractical. Cracking algorithms over 128-bit is
possible, but only with a lot of time and/or firepower. However, shoving a
CD in the machine, rebooting and typing: '# mount /dev/hda1
/tmp/stolen_info/ # cd /tmp/stolen_info/ # ls -la' is not that difficult
and it makes all of that 'password-protected' data quite readable, even
for a casual computer user.
<P>"If the person who stole the laptop were to remove the drive and
perform a bit-by-bit copy, they would circumvent any password protection
on the computer. Remember, BIOS and Operating System passwords rely on the
computer and OS to boot up. If you remove the drive, neither will offer
any level of protection and are completely worthless."
<P>A volunteer for Attrition who goes by the online name "Lyger" told
eWEEK that Forrester's notification letter to those affected "should be of
little comfort," given that Forrester didn't divulge whether the laptop's
hard drive was encrypted.
<P>At any rate, it may be ironic, but Forrester's dilemma is far from
unique. A former analyst for a defunct technology consultancy wasn't
surprised to learn the details behind the breach. "When I was at Meta, we
didn't do anything in our back office that we preached to others," he
said. "It is symptomatic of all businesses. They really don't pay any
attention to their own employees when warned of something
</P></TD></TR></TBODY></TABLE></DIV>
<DIV> </DIV>
<DIV><FONT face=Arial size=2>[..]</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV></BODY></HTML>