Cover Your Assets

Feb 1, 2006 12:00 PM, By Sandra Kay Miller

TENANTS OF THE ANACAPA BUSINESS PARK, Ventura, Calif., considered themselves fortunate that their desks afforded a view of Ventura Harbor to combat the monotony of sitting in front of a computer all day. That was until a string of smash-and-grab robberies claimed all the computers and desktop printers from the entire row of offices. Only the traveling nurses agency — which had the forethought to anchor their machines and printers to the desks with cables and locks specifically designed to protect IT assets — was unaffected by the thefts.

“We thought all of our files were safe because we backed up all of our work from the desktop to the file server,” says Catherine Coor, manager for one of the offices hit. “But they took the file server, too.”

Noah Groth, president of PC Guardian, a company providing asset protection for more than 20 years, estimates computer equipment thefts set back businesses and consumers more than $5 billion annually. The majority of these losses could have been avoided with an inexpensive cable lock.

Today, the stakes are much higher when equipment such as servers, desktops, laptops and PDAs are stolen or lost. Regulatory compliance — such as HIPAA, Sarbanes-Oxley and Gramm-Leach Bliley — demands audit trails for the movement of protected information and that includes tracking equipment on which the data resides. SB1386 in California paved the way for reporting data security breaches, and many other states are now following suit.

All this security oversight and reporting has boosted asset protection to a $600 million business. Keeping track of company assets — especially with the exponential growth of mobile devices — has precipitated new technologies, including the widespread use of radio frequency identification (RFID) tags and GPS tracking devices.

Defining assets

Before instituting an asset protection program, the first step is to identify what assets require safeguarding. Typically, companies use asset tracking and protection solutions for valuable items such as computers, audio-visual electronics, lab equipment, furniture, fire extinguishers, medical equipment and other items of strategic importance.

The Enterprise Strategy Group, a Milford, Mass.-based IT research organization, reported in a recent survey that 68 percent of users say laptops are the most vulnerable to confidential data. For large organizations, a lost or stolen $2,000 laptop may not represent a significant loss; however, if sensitive data is stored on the missing device, public disclosure of potential privacy and confidentiality breaches can have far-reaching ramifications, including compliance fines and stock fluctuations for publicly traded companies.

Increasing the mobile asset threat is the rising use of personal digital assistant (PDA) devices and smart phones. Only a few years ago, these electronics were little more than electronic address and telephone books, but with increased processor, memory and storage capabilities along with 802.11, cellular and Bluetooth features, they now can support a number of enterprise-class real-time applications such as e-mail, enterprise resource management (ERP) and customer relationships management (CRM). Research firm eTForecasts, Arlington Heights, Ill., put U.S. PDA sales at $8 million in 2004 and estimates totals reaching $11 million in 2006 and $17 million in 2008.

But it is not only computer devices that are considered assets, and companies specializing in security devices recognize this fact. Audio-visual equipment has been a common mark for theft. According to the U.S. Department of Justice, schools are experiencing an explosion of thefts involving electronic and high-tech items. These items are fairly easy to resell and also are often sought for personal use by students and teachers as perpetrators, as well as seasoned criminals.

Laboratory equipment and specialized tools are frequently protected assets. For example, a portable network testing and analysis device can top $75,000. Small enough to be put in a brief case, backpack or even hidden under a jacket, it is easy to see why security vendors are getting more requests for solutions that take advantage of new technologies, such as RFID and GPS tracking.

Many choices

Once the assets to protect have been determined, the next step is choosing how to accomplish the task.

For relatively stationary objects, such as desktops, printers, servers and audio-visual equipment, steel cable locks are often enough of a deterrent to prevent thefts, such as those experienced by the Anacapa tenants. This type of solution attaches the asset to a desk or wall.

To prevent tampering, such as the removal of RAM, drives and other internal components, locking covers and cases can be installed, as well as adhesive tabs and sensors that will set off an alarm when they are removed.

Protecting mobile assets is often two-fold — preventing theft of the device itself and ensuring security of information stored on the device. Physical protection can be as simple as non-removable identification plates to sophisticated GPS tracking beacons capable of pinpointing a wayward device's location when activated.

The advent of RFID has taken asset protection to a new level. Only a few millimeters in thickness, RFID microchips can be easily disguised as manufacturer stickers and placed in less-than-obvious locations for stealthier monitoring. Passive tags are instantly inventoried when passing within several feet of a scanning device. Active RFID tags can be set to transmit on-demand when attempting to locate a particular asset. An added bonus is RFID asset tracking, and protection vendors are integrating their solutions into legacy systems offering organizations a bolt-on product for their existing security solutions.

The ultimate in asset protection are systems that include the ability to transmit GPS data for real-time monitoring. Assets such as vehicles, heavy equipment, marine assets and cargo are routinely outfitted with wireless communication hardware combined with Internet-based location services.

In addition to pinpointing the asset's location, these units can also triangulate speed, distance traveled and route tracking. These capabilities further protect assets by monitoring their use and movement and for safety analysis of speed and travel patterns.

Inside job

SACS Consulting and Investigative Services, an Ohio-based security company, reports a marked increase in employee theft, accounting for as much as 75 percent of stolen assets. Ramco Systems, a New Jersey security company specializing in the information technology industry, has seen everything from routers to an entire IT department worth of equipment stolen; however, it is not always big-ticket items and electronics that are the objective of thieves. Objects not routinely viewed as assets, when taken in large numbers, can represent a substantial asset as a whole.

When the fire extinguishers at a sprawling southern California luxury resort started disappearing, the general manager chalked it up to guests occasionally swiping one. Later a quarterly financial review by the controller pointed out that in three months nearly half of the extinguishers on the property had been replaced, resulting in a shocking expense. Suspecting internal theft, the resort added their lowly fire extinguishers to the list of assets tagged with a non-removable barcode tag they used for asset inventory throughout the property for computer and networking equipment as well as furnishings in the guest rooms. The fire extinguishers remained in place after being tagged.

Regardless of what type of asset protection an organization chooses to employ or the assets protected, the company should inform its insurance carrier about it. Simple theft deterrents can lead to a reduction in premiums. According to the National Association of Insurance Commissioners, 12 states currently require insurers to give discounts on comprehensive vehicle insurance when asset protection devices are installed.

Asset protection does not necessarily cost a lot of money, but spending the time to institute some method for protecting those items key to a business can save an organization money, as well as big headaches.

---

ABOUT THE COMPANIES

For information, circle the Reader Service number (listed below) or visit securitysolutions.com

PC Guardian.	60
Ramco Systems	61
SACS Consulting and Investigative Svcs.	62

Want to use this article? Click here for options!
© 2008 Penton Media Inc.

This month in Access Control

• Opening Up About Door Closers
• An Enterprise Approach
• The Framework For Open Systems
• On A Higher Plane
• More from April's issue