PREVENTING COMPUTER THEFT by jolinmilioncherie


									RISK MANAGEMENT                                                     Kent County Council

Kent County Council                                    l

                                                1. Introduction

    Laptops, tablet computers, newer desktop computers and white board projectors
    are attractive items to thieves and the number of reported thefts is increasing.
    Over 90% of thefts are carried out by ‘opportunist thieves’ who simply rely upon
    equipment being left around or poorly protected. Appropriate safeguards should
    therefore be taken to reduce the risk of theft.

    Some of these, such as improved housekeeping, can be achieved at no cost;
    others may require some degree of expenditure. Guidance is therefore provided
    to help eliminate or reduce the risk of theft.

                                        2. Delivery of Equipment

    Security Arrangements
    Do not promote the planned arrival of new IT equipment through the media as
    this may make your site vulnerable to attack. Professional thieves may take the
    chance that you will not have had time to security mark any new equipment
    within a few weeks of its arrival on site. If possible, arrange to have IT
    equipment security coded before delivery or marked up immediately upon receipt.

    Disposing of boxes also advertises the fact that new IT equipment has been
    delivered. Fold packaging flat and dispose as soon as possible from site. If a
    large quantity has been received, consider staggering the opening and disposal of
    boxes. Especially, if you have a small bin capacity.

                                     3. Security, Storage and Use

    Never leave your laptop unattended. If you have to then make sure that it is
    secured to a fixed point and that the door to the room is locked.

    Keep laptops and other equipment out of sight when not in use.

    Security marking
    Do not tell strangers about your security arrangements. Any suspicious activities
    should be reported to senior management immediately.

    KCC.2003 RM.Advice Note - Preventing comp theft
All equipment should be security marked preferably with a visible acid based
solution such as Selectamark which is available through the KCC Supplies
catalogue. This will primarily act as a deterrent to theft but will also reduce its
resale value and increase the risk of the thief being caught.

Leased equipment should only be marked with the consent of the supplier.

Security Fixing and alternatives solutions

Security products should meet with Loss Prevention Standard 1214 and carry the
Loss Prevention Council approval mark.

Equipment secured to fixed points is more difficult to remove. There are many
ways in which equipment can be secured. A few of the more typical methods are

Cable and lock systems – although these are lower grade security systems they
are suitable for lap top computers and other portable equipment to prevent ‘walk
in walk out’ thefts. This simply involves fixing a wire rope to a unit by a special
lock which is then secured around the desk where it cannot be removed or to an
anchor point fixed to a flat surface i.e. wall or floor.

Specialist cable systems can also be used to secure ceiling mounted white board

Charging cabinets
Charging cabinets that meet with Loss Prevention Standard 1214 will provide an
increased level of protection. Unfortunately, when mounted on wheels charging
cabinets can facilitate large scale theft as they can be wheeled away. Security
cabinets will require more robust securing and a ‘D’ ring fixed to an anchor point
is recommended. Cabinets should be removed to secure stores when the school
is not being used as far as is practicable and particularly during holiday periods.

Cages – fixed around computers, servers or white board projectors will protect
units as they are locked into place usually with a padlock or security screws. If
fixing a cage to the ceiling consider any weight implications.

KCC.2003 RM.Advice Note - Preventing comp theft
High security spec equipment - security features are now provided as
standard by many manufacturers and include :

 Security coded start-up PIN. After being unplugged, such projectors cannot
  be used again unless the PIN is entered.
 No external control buttons so that the projector will not work if removed
 In built alarm system which will sound if jogged or jolted

Data projectors for schools are available with an orange casing. This initiative
has been introduced to quickly identify any projectors found outside of school

Securing Servers
Servers should be kept in a secure environment and preferably a secure room.
This should ideally be alarmed and protected with a security door and access
controlled during school hours. See security stores.

Servers should be located within the beam of any security sensor.

Where single servers are situated in school offices or classrooms it is
recommended that a cable and lock system or security cage is used to protect

Securing Computers at Workstations
Laptops should not be left unattended during the day unless they have been
secured to the workstation. They can be secured by a cable and lock system or
locked into a desktop cage.

Desktop computers should also be secured if there are concerns about the
security of the area/room in which they are kept i.e. open areas near to main
doors or mobile classrooms.

Security Stores
All new equipment should be securely stored until brought into use.

Security stores should be alarmed and any skylights and windows protected with
bars and one-way security film to obscure vision. Furthermore, doors to stores
may need to be upgraded to a security type PAS 24 standard which will resist
forced attack for up to 15 minutes.

Key Security
Keys for security locks, trolleys, cupboards etc should not be kept with or near to
the equipment they work with. Ideally, keys should be kept in a separate room in
a locked key cabinet. Key cabinets should be controlled.

KCC.2003 RM.Advice Note - Preventing comp theft
IT Rooms/Areas
When designing an IT room or area the following should be considered at the
planning stage:

   Locate above ground floor wherever possible
   If a computer suite has to be located on the ground floor try to keep it within
    an internal part of the building, without external walls, doors or windows.
   Protect the actual room and areas outside of the area by an intruder alarm
   Protect windows with security grilles, bars or shutters.
   Have windows that are kept permanently locked or have good quality key
    operated window locks
   Have doors that can be locked, ideally with mortise locks conforming to BS
    3621, when the room is not in use
   Fit with good quality doors i.e. 44mm solid timber door
   Protect by CCTV where installed
   Equipment located on the ground floor should be at least 1m away from
   Keep ground floor equipment from view when the building is not in use either
    permanently with one way reflective film or by curtains/blinds

In addition all routes through the school to any IT suite should be protected and
linked into the intruder alarm system. It is advisable to survey the school
premises to ensure that all routes through the school, from outside of the school
or over roofs into any IT suite have been identified and factored into security

Mobile Classrooms
Mobile classrooms are more vulnerable to attack than main buildings. If
equipment is being stored and used in mobiles, consider protecting the windows
with grills and one way film. It is advisable to link the mobile unit to the main
intruder alarm. If possible site units in the line of CCTV where installed.

Laptops should be locked away when not in use and removed from mobile
classrooms overnight, at weekends and holiday periods to a security store ideally
within the main building. Other IT equipment of any significant value should also
be removed particularly during holiday periods.

                            5. Management and Housekeeping

A security policy should be developed which incorporates good management
procedures including the issue and return of equipment by pupils and staff. A
suggested policy is being developed for schools.

Loaning of Equipment
Keep a record of any equipment loaned to a member of staff or pupil. This record
should include the name of the person to whom the equipment has been loaned,
date of loan, equipment identification number and date of return. The school
should consider developing a policy for setting out the issue, care and
consequences of any loss or damage of computers.

KCC.2003 RM.Advice Note - Preventing comp theft
Anyone borrowing equipment should ensure that it is kept secure whilst in transit
and at home or other place of work.

Ensure any losses are reported immediately.

The extent to which you will need to secure your equipment will be based upon a
number of factors such as:

   Adequacy of existing security arrangements
   Quality of equipment
   Level of local crime
   Disruption to school and individuals if units are stolen
   Ability of the school to meet losses which cannot be met through insurance

KCC.2003 RM.Advice Note - Preventing comp theft
Kent County Council
Risk Management & Insurance Section
Sessions House, Maidstone, Kent ME14 1XQ
Tel: 01622 694632

KCC.2003 RM.Advice Note - Preventing comp theft

To top