GigaOM » Collaboration

Telecommuting natives take a lax attitude toward security, report reveals

Jessica Stillman — Mon, 19 Dec 2011 14:01:17 +0000

Members of so-called Gen Y may be “telecommuting natives,” as FlexJobs CEO Sara Sutton Fell has said, claiming “they just don’t see a building as a defining structure of where you do things,” but it appears this natural affinity for mobile work doesn’t come equipped with natural instincts for data security while nomadic, at least if a new report from Cisco is to be believed.

The company spoke with 2,800 college students and young professionals from more than 14 countries and found that familiarity with mobile devices and living your life online does not lead to greater caution. Quite the opposite. The survey found:

Thirty-three percent of young people do not mind sharing personal information online, believe privacy boundaries are loosening, or do not think about privacy.
Fifty-six percent said they have allowed others to use their computers without supervision — family, friends, coworkers and even strangers.
Sixteen percent admitted leaving personal belongings and devices unattended in public while getting something to eat or drink or going to the restroom.
Sixty-one percent believe they are not responsible for protecting information and devices, saying that this is IT’s responsibility.
Of those who were aware of IT policies, 70 percent admitted to breaking them. The most common reason was the belief that employees were not doing anything wrong (33 percent), followed by the need to access unauthorized programs and applications to get their job done (22 percent).
Thirty-six percent said they did not respect their IT departments.

Perhaps unsurprisingly given this generally lax attitude toward security and privacy, one in four young people will experience identity theft before the age of 30, according to the Cisco study.

Clearly, these numbers indicate there is some failure of communication between young, mobile, tech-savvy workers who were raised online and IT departments. The result is that many members of Gen Y fail to understand what positive role IT can play in organizations (besides that of killjoy sheriff) as well as fail to see the need for more care when it comes to their and their companies’ data.

Who has to change here: cavalier Gen Y, uncommunicative IT or both?

Image courtesy of Flickr user Lee J Haywood

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

Go ahead, bring those holiday gadgets to work

Terri Griffith — Thu, 08 Dec 2011 23:43:05 +0000

Darrell Etherington’s predication is coming true, “Bring Your Own Device Will Usher in Bring Your Own Apps, Too.” On Wednesday, IBM announced several new social networking and collaboration mobile apps –all specifically designed to support enterprise needs around consumer mobile devices. The new software is available from most popular app stores. IBM’s goal is to bring social networking, real-time collaboration, and online meeting capabilities from behind the company firewall and into the hands of tablet users.

This is a response to demands to better manage the growing number of personally-owned gadgets being used for enterprise work.

In the press release, IBM describes how employees at the global medical device manufacturer ConMed Linvatec used the IBM Lotus Notes Traveler app on iPad devices at a recent medical tradeshow: “The app allowed ConMed employees to demonstrate its medical devices, collect sales leads, and send product information to prospective customers right on the spot….” Dale Westrate, messaging systems architect for ConMed Linvatec’s Largo division is quoted in the release: “As a result of using IBM collaboration software on iPad devices, we generated more leads, and acted on them sooner, than ever before.”

IBM is offering a variety of new tablet capabilities (availability across platforms varies):

They are also helping developers create mobile applications faster and improving the experience for the user:

Tools to build mobile apps faster and better: IBM is introducing its Mobile Technology Preview on the developerWorks website.
Tools to improve the Web experience for the user: The new software, IBM WebSphere Portal Mobile Experience, helps companies easily control the content, look and feel, and page navigation on mobile devices.

It’s exciting to see the software giant helping smooth the way for how people behave at work. Rather than putting information technology departments in conflict with their users, who are just trying to get their jobs done in times of tight resources, IBM’s approach enables natural behaviors to proceed with an enterprise-appropriate (e.g., greater security) infrastructure.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

Secure documents on BlackBerry with WatchDox

Aliza Sherman — Tue, 26 Jul 2011 07:34:01 +0000

As mobile devices become more prevalent at work, the need for security continues to rise. WatchDox provides document control, tracking and security features through a web app, apps for iPad and iPhone (we covered it late last year) and now for BlackBerry. WatchDox aims to ease concerns about mobile devices being a risky way to transmit and view sensitive documents by adding a layer of security and control to documents sent through its system.

On the BlackBerry, WatchDox users can render PDF and Microsoft Office. It offers features allowing users to:

Share and view documents securely on BlackBerry devices.
Restrict shared documents from being copied, printed or forwarded.
Eliminate documents remotely, if needed.

The company also announced updates to its Apple iOS app, including:

Document sync. Users can securely sync their online documents or their virtual data room folders through the secure app versus less secure consumer-grade syncing methods.
Passcode protection. In case of device loss or theft, a passcode provides an additional layer of security against information leaks.
Performance enhancements. Access to documents should be speedier.

While there are several subscription levels for WatchDox including Personal, Team and Virtual Data Room, pricing is customized so you’ll need to contact the company for a quote, although general plans typically start at $49.99 per month per user. The company does offer a 14-day free trial.

How are you securing your documents on your mobile devices?

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

Web worker security: how to keep your data safe at a distance

Jessica Stillman — Tue, 21 Jun 2011 17:02:16 +0000

The flexibility and autonomy of web working can boost productivity and morale, but letting company information out of the secure perimeter of corporate headquarters also opens organizations up to a whole host of security concerns, according to a recent article from MIT’s Technology Review. The piece lists several potential vulnerabilities, including:

Web workers are more vulnerable to “social engineering” attacks. In an office, “you can pretend that you’re a bike courier or FedEx guy, but you still have to get past the security guard, receptionist, and so on,” explains Steven Chan, chief software architect with MIT’s engineering systems division.
Office network security usually beats home network security.
Loss or theft of devices is a bigger threat for mobile workers.
Greater employee control over which devices they use can for work can create security concerns.

Still, the payoffs of web work are high and there are sensible steps organizations can take to minimize these risks. The experts at MIT also offer these recommendations:

Limit the threat from lost or stolen devices through encryption and tracking. “For thorough security, the entire hard drive should be encrypted and should be accessible only through strong passwords—Microsoft recommends passwords of at least 14 characters, some of which are letters, numbers, and symbols. Furthermore, tracking software can be used to locate a lost laptop, phone, or tablet and remotely wipe it clean of data,” says MIT.
Decide who needs access to what. Review often. MIT’s Chan suggests “credentialing, which means employees should get access only to the information they require for their work.” And don’t just set these permissions and forget about them. “Security isn’t something companies dust off and adjust once a year,” agrees CTO Edge in another recent piece on telecommuting and security.
Servers should be vigilant too. “Have servers in a network identify and authenticate all devices attempting to gain access,” suggests MIT. “In a step known as device fingerprinting, the network can try to distinguish a legitimate remote employee from a rogue hacker by looking at the IP address, device serial numbers, and other settings on the user’s computer. If an unfamiliar device attempts to access the network… either entry is denied or the request is evaluated after further authentication (by a phone call to the user, for instance).”

While there are some risks, working remotely can also offer security advantages, according to some experts. For instance, locating files in the cloud, which is increasingly common practices for dispersed teams, means that “there are no files on a physical laptop which could get lost or hacked into,” InfoStreet CEO Siamak Farah has previously told WebWorkerDaily.

Is your team taking all sensible measures to keep your data secure despite being physically dispersed?

Photo courtesy Flickr user Trevor Blake

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

LastPass Possibly Hacked, Users Forced to Change Master Passwords

Simon Mackie — Thu, 05 May 2011 10:13:42 +0000

LastPass, a password management app that stores passwords in the cloud and automates form filling via browser add-ons, could have been hacked, with user data — including email addresses, salted passwords and the server salt — potentially compromised, according to a post on the company’s blog. As a precaution, the company is forcing all its users to change their master passwords.

The post notes that anomalies in server traffic led the company to suspect its database has been accessed and take appropriate precautions, although it cannot be sure at this point in time. It also points out that the data accessed alone should not be enough to expose an affected user’s stored passwords. To get those, an attacker would also need the user’s master password, which is only really a risk if that password is easy to guess using a brute force attack. Users with strong, non-dictionary-based master passwords should be relatively safe, although as some users don’t use particularly strong mater passwords, the company has elected to force all of its users to change their master passwords. In addition, the company will be validating users changing their passwords by either checking that the user is visiting from a previously-used IP block, or by validating against their email address.

As a result of the potential breach, LastPass is also beefing up the encryption it uses:

We’re also taking this as an opportunity to roll out something we’ve been planning for a while: PBKDF2 using SHA-256 on the server with a 256-bit salt utilizing 100,000 rounds. We’ll be rolling out a second implementation of it with the client too.

This potential breach is a reminder that storing your passwords with a third party like LastPass ~~or competitor 1Password is risky~~. Their data is obviously a very attractive target for hackers, despite their encryption and robust security arrangements. But you have to weigh that risk against the convenience they offer: Using a password management tool makes it much easier to have a strong, unique password on every service you use. That’s much more secure than using the same password everywhere, which makes large security breaches, such as the recent PlayStation Network hack or last year’s Gawker hack, so damaging, as attackers can gain access to wide range of different services with a single password. However, if you’re concerned about storing your passwords in a cloud service, you could always elect use a desktop password management tool like that stores your passwords in a local database like KeePassX instead; the downside is not being able to retrieve passwords everywhere. Whatever password management tool you choose, ensure you pick out a strong master password that’s not going to be easy to crack via a brute force attack.

Photo courtesy Flickr user subcircle

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

The Challenges of Being a Modern Employee

Andy McLoughlin — Mon, 21 Feb 2011 22:00:46 +0000

In today’s 24/7 digital economy, it’s hard to believe that just a decade ago many organizations were still trying to establish how – or even if – they could deploy email in their offices. Now, thanks to the mass adoption of high-speed communications and advances in hardware and software, the office can be wherever your Internet connection and laptop/smartphone/tablet device is.

However, with this change comes a new set of challenges for the modern workforce. When do you switch between personal time and work? How do you ensure that you remain productive and motivated? How do you cope with the onset of cabin fever? What are the security issues?

Security

Let’s start with the issue that strikes fear into the IT manager’s heart: security. A recent study conducted by Vanson Bourne and TNS discovered that almost nine in 10 UK IT managers fear the security risks caused by remote working practices. As laptops/smartphones/tablets holding company data venture beyond the office walls, this concern is hardly surprising. Add to this the fact that employees may take paperwork and USB sticks home to access the information they need and you can understand why management and IT teams worldwide break into a cold sweat at the mention of remote working. Intel’s Billion Dollar Lost Laptop Study revealed that 329 U.S. businesses had collectively lost more than 86,000 laptops, worth $2.1 billion. For freelancers, the cost of losing their laptop or smartphone is not just the cost of replacing the device but the loss of trust from clients, which can be devastating.

So what can be done? To keep information on devices safe, there are numerous options: hard disk encryption, data back-up, and security tools that wipe and kill a laptop if stolen. Intel and Fujitsu are just two vendors that have such offerings. Another option, which avoids people needing to carry around USB sticks or notepads, is using the cloud. There are now a number applications out there, including Huddle, which enable content to be stored in secure environments that can be accessed from anywhere at any time , with no VPN access or USB stick required. Gone are the days of the sheepish confession: “I left it on the train/put it in the wash /dropped it in the restaurant” and all the data protection and legal issues that can come with it.

Working Long Hours

With 24/7 access to information comes the challenge of switching off. Most web workers will have been there: the last check of emails before heading to bed, working over the weekend because you only have to travel as far as your sofa, developing that great idea that popped into your head at midnight because you only have to switch on your laptop. The solution is discipline. One of the beauties of web working is the fact that you can work when it’s convenient for you, but this doesn’t mean you should be working all hours. As pointed out by Simon last year: long hours aren’t healthy. Get a personal trainer or start going to gym classes to break up the day and force you to stop working. Don’t forget to take a proper lunch hour and get out into the fresh air. Arrange to see people and get out of your home office. These may sound like simple tips, but it’s all too easy to get into the routine of continually working.

Cabin Fever

A related issue is cabin fever. Especially if you’re a freelancer or entrepreneur, you can get caught up in your own web worker bubble and forget about the world beyond your home office. My tip is to use tools such as Plancast to find out what events and meet-ups are in your local area. Whether you want to meet like-minded people, build your network or just go out for a few drinks, Plancast is a great place to get started. When I relocated to San Francisco last year to set up a U.S. team, it proved invaluable.

If you’re a remote worker for an organization, make sure that you don’t miss out on vital interactions with your colleagues. Use tools such as Skype to share the snippets of information that you’d normally communicate via face-to-face chats or in passing in the corridor. When there is a company-wide meeting, make sure that you are included via phone, web or video conference so that you have visibility of what’s going on across the business. You are part of the bigger picture, even though you’re not in the office all day, every day.

These tips aren’t rocket science, but hopefully they can help you cope with being part of the 21^st century workforce.

Andy McLoughlin, Co-founder and EVP Strategy at Huddle, can be reached on Twitter @Bandrew.

Photo courtesy stock.xchng user rajsun22

Related content from GigaOM Pro (sub. req.):

iTwin: Remote, Encrypted Access to Your Files

Charles Hamilton — Mon, 03 Jan 2011 20:00:46 +0000

The iTwin device provides a simple and secure way of connecting to your office’s files while you’re out of the office. When you first open the box, you’ll see something that looks like a USB key, except that there are USB ports on both ends. Look a little closer, and you’ll see that the device can be split into two pieces.

To set up the iTwin, insert the device (with both halves still attached) into a Windows machine. You’ll be prompted to install the software, and to register an email address you can use to disable the device if it gets lost. The two halves are then “paired,” so that they work together to create a connection between computers using 256-bit AES encryption.

You will be able to access one machine from the other, but only if both pieces of the device are installed. For additional security, you can also create a password on the iTwin.

You can leave one half of the device in your office machine, and insert the other into, say, a laptop. You’ll be able to access, move, copy and back up files. You can edit remote files directly, or copy files by dragging and dropping them.

Both iTwin and Pogoplug allow you to connect to your own files remotely without monthly fees, and without using cloud storage. But Pogoplug connects to an external hard drive and makes it available remotely, while iTwin allows you to connect to your entire computer and network. Of course, in order to access a particular machine, you’ll need to leave it on and connected to the Internet.

Of course, there are some security issues to be considered. While iTwin provides a couple of ways to disable the connection if one half gets lost, it might take a while before the loss is noticed. And the connection is bi-directional, so if someone entered your office, they could access your laptop. Frankly, it’s an open question whether the security of this system is better or worse than a software-only solution with strong passwords.

I wasn’t able to fully test the system, since iTwin only works with Windows machines at present, although the developers say a Mac version is in the works. I’ll be interested to see how speedy and stable the system is in actual use, and how well it interacts with Windows’ sleep mode.

iTwin retails for $99 on the developer’s website.

How do you connect with your files while you’re on the road?

Related content from GigaOM Pro (sub. req.):

WatchDox Brings Secure Documents to iPad and iPhone

Aliza Sherman — Tue, 16 Nov 2010 15:00:24 +0000

Smartphones and Wi-Fi-enabled devices are without a doubt essential business tools for many of us. With mobile communications and connectivity comes security issues, though. How can we share and manage sensitive documents over the airwaves?

WatchDox is one solution. It’s document management and security application that lets you control, track and protect your digital documents. Confidela — the maker of WatchDox — just announced that its software is now available on iOS devices as a native app. WatchDox’s web-based secure document platform is built using Flash, and while it has been available on Android devices for a while, the use of Flash has kept it off of the iPhone and iPad until now.

While you can’t generate secure digital documents from your iOS device, you can open and read documents that have been secured using WatchDox. With a subscription, you can use the website’s tools to secure your documents, including authenticating users and restricting the forwarding, copying or printing of those documents. You can track activity on a document, including who opened it, what they did with it, and even if they accessed it from their iPhone or iPad. You can also watermark your digital documents, or put in a “time bomb” to limit the duration any user can view it.

Note: The application was still pending approval from the App Store at press time. You can read more from our previous coverage of WatchDox at:

How do you manage mobile document security?

Related content from GigaOM Pro (sub. req.):

Google Apps Take Two Steps Toward A More Secure Cloud

Simon Mackie — Mon, 20 Sep 2010 09:01:23 +0000

The option of a two-step verification process has been added to Google Apps, Google announced today. Once activated by an administrator, the new authentication process requires users to log in using their password and a verification code that’s sent to their phone via SMS or generated using an Android, BlackBerry or iPhone app.

Users have the option of indicating that they are using a computer that they trust, which means that they won’t be asked for the verification code in the future from that machine for 30 days.

Google believes that this two-step authentication process, which might seem familiar to users of certain online banking websites, should make Google Apps much more secure; even if a hacker steals a user’s password, they won’t be able to access the account.

The technology used to implement this system is based on open standards; Google hopes it will allow for integration with other vendors’ authentication technologies in the future. Google is also making the code for the mobile apps open-source so that its customers can customize them.

Administrators for Google Apps Premier, Education and Government Editions can activate two-step verification from the Admin Control Panel now; the mobile apps are available today. Standard Edition customers will be able to access it “in the months ahead.” Google is also planning on making the technology available for individual Google users.

Related GigaOM Pro content (sub. req.): Who Owns Your Data in the Cloud?

WatchDox Bringing Document Security to Android Devices

Aliza Sherman — Mon, 12 Jul 2010 14:00:16 +0000

The document management and security product, WatchDox by Confidela, will today announce a new offering for Google’s Android platform. A BlackBerry version is coming later this year, as soon as BlackBerry supports Adobe Flash, and a native iPhone/iPad app is also in the works.

I initially wrote about Watchdox when it first launched and then again when it discontinued its free service and went pro. Since that time, the company has:

Added an Outlook plug-in to give you easy access to security and management features for documents you share with others.
Offered an offline MS Office PDF plug-in so you’re not locked into the browser-based viewer (both parties need to download the plug-in). This feature allows document collaboration.
Opened up APIs to developers, which means that you can integrate WatchDox functionality into other systems you’re using, including Sharepoint and Salesforce.
And, as of today, the company is rolling out mobile device support.

Some examples the company cites as ways to use WatchDox include protecting any proprietary IP and distributing e-books, training documents and other subscription-based or paid materials that you offer electronically. Graphic designers can send drafts or spec work with added WatchDox security protection so that their designs cannot be seen by anyone but the recipient. Consultants can share proprietary reports, proposals, pricing and invoices.

The individual price for WatchDox is $49.95/month.

What are you using to protect and manage the documents you distribute electronically?

Related GigaOM Pro content (sub. req.): Report: The Real-Time Enterprise

Check for Risky Out-of-date Plugins Using Plugin Check

Simon Mackie — Thu, 13 May 2010 16:00:44 +0000

Mozilla’s Plugin Check — a free web service that examines installed plugins to see if they’re current — now works in more browsers than ever before. Outdated plugins pose a security risk, so keeping them up to date is important.

Visit the Plugin Check site and it’ll check out all of the plugins installed on the computer — it now works in Firefox, Safari, Chrome, and Opera, and can also check IE 7 and 8 for the most popular ones. If any of them are out of date, it gives you a handy link so that you can grab the latest versions.

As Mozilla’s Jonathan Nightingale notes, outdated plugins pose a major security and stability risk, citing one study that notes how around 80 percent of web users have a vulnerable version of Flash installed. And Plugin Check will take no more than a few seconds of your time.

Are all of your plugins up to date?

Related GigaOM Pro content (sub. req.): Enabling the Web Work Revolution

Untiny Deciphers Shortened URLs

Simon Mackie — Wed, 21 Apr 2010 20:00:36 +0000

Thanks to Twitter and its 140-character tweet limit, the number of URL-shortening services like bit.ly and TinyURL have exploded over the past couple of years. They’re useful for shortening unwieldy URLs, but as the destination the link points to isn’t immediately obvious, they can also be used for malicious purposes — to trick users into visiting a site they wouldn’t have otherwise, for example. Untiny can be used to decipher those shortened links and see where they end up.

Having to go the Untiny site for every link would be a pain, though, so thankfully there are a large number of third-party Untiny add-ons and extensions listed for various browsers and IM clients on this page, including extensions for Firefox and Opera, Greasemonkey userscripts and more. These can automatically reveal the real destinations of any shortened links on a page — the screenshot above is of Om’s Twitterstream with all of the shortened links automatically decoded by the UnityFox Firefox add-on, for example — and provide a useful (and free) extra layer of security to the web.

Are you suspicious of shortened URLs?

(via gHacks)

Related GigaOM Pro content (sub. req.): Can Enterprise Privacy Survive Social Networking?

How to Create a Strong Password

Thursday Bram — Tue, 23 Mar 2010 23:00:42 +0000

I conduct pretty much all of my business online. I use a dozen different web applications on a daily basis. I rely on these tools to get my work done, which makes it absolutely crucial that I do everything I can to protect my information. I do my best to find trustworthy applications, but in the end, some of my security comes down to something I do for myself — choosing good passwords.

A good password has to balance security with our ability to remember it, because minimizing the number of places that a password is written down or otherwise recorded is a good idea. It’s a tough line — the most memorable passwords are the easiest to crack, while the most secure are a jumble of characters that are impossible to recall. But there are some steps you can take to create a reasonably secure password that you’re less likely to forget.

Forget about amusing passwords. Among the most common passwords are those that seem to amuse the person creating them — there are plenty that use profanity or insults. Some sites, such as Twitter, have actually created lists of words that are banned from use as passwords. A surprising number of them fall into this category. Passwords such as these aren’t secure, if only because they’re relatively common and more likely to be tried first if someone is trying to crack your password.
Try longer phrases. Most of us have an easier time remember actual words and phrases than random assortments of letters and numbers. Using just one word, perhaps with a number tacked on to the end, is often less secure, however — certain methods of hacking passwords include simply running a dictionary through the password system. Using a longer phrase — especially if it includes numbers or other characters — makes it significantly harder to guess.
Use a minimum of eight characters. Longer passwords are better. Most sites require you to have at least six characters in your password these days. Some are moving up to eight, but if you can go for longer, you should. That’s another benefit of using a phrase.
Choose related, but not identical, passwords. You want to minimize the chances you’ll forget a password, but using identical passwords means that if one of your accounts hacked into, you’ll run the risk of having other accounts hacked as well. One option may be choosing phrases about the same topic, while another is changing key parts of your password to reflect the site you’re using it for.
Don’t use personal details. In the event that someone is hoping to gain access to your personal accounts, details like your phone number, employment details and important dates in your life will be among the first passwords typically tried. Instead, you want to use something that may have personal meaning for you — at least enough to help you remember it — but that won’t be easy for anyone else to guess.

How do you create secure yet memorable passwords?

Photo by Flicker user akeg licensed under CC BY-ND 2.0

Related GigaOM Pro content (sub. req.): Can Enterprise Privacy Survive Social Networking?

Who Owns Your Data?

Simon Mackie — Wed, 13 Jan 2010 16:58:53 +0000

Here on WWD, we’ve recently been discussing privacy in social media, but the issues of privacy, security and data ownership actually extend much further, affecting everything we do on the Internet. As our computing increasingly moves to the web from the desktop, more of our personal and private information — from emails and documents to financial information and even our current whereabouts — sits in the cloud. Gmail, Google Docs, Upcoming, Foursquare, Zoho, Facebook, Basecamp, Flickr, Twitter, Mozy — so much of our data is now kept online. Many people don’t stop to think about where that data is stored, or how it might be accessed or used.

So, who owns your data, and who has access to it? In my latest Long View for GigaOM Pro, “Who Owns Your Data in the Cloud?” (subscription required) I take an in-depth look at the issues of privacy, security and data ownership in the cloud; the legal protection (or lack of it) that your information has to protect it from unwanted snooping; and the steps that we should all be taking to minimize the risks of our data being accessed or used in ways that we hadn’t intended.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

3 Ways to Protect Yourself Against Theft

Georgina Laidlaw — Sun, 27 Sep 2009 13:00:40 +0000

If you’ve ever been robbed in a public place, you’ll know all too well the feeling of horror that ensues. For the remote worker on the road, that horror increases exponentially with the realization that you’ve lost your work, your colleagues’ details and data, your stored access passwords, and so on.

With your computer, that thief may also be able to access your and your contacts’ personal details, your online banking and payment accounts, email accounts, and other accounts on sites through which you may purchase goods, store sensitive data … the list just goes on!

Of course, web workers are likely to find ourselves in public spaces carrying valuable equipment more frequently than our office-bound counterparts, so the chances of our being victims of theft aren’t low. Don’t wait until your stuff is stolen to put adequate protection in place. This checklist should provide you with a solid plan for protecting your data — as well as software and hardware — against theft.

In creating a protection plan for my gear, I thought about the theft of my stuff from three perspectives. If my gear was stolen, I’d lose hardware and software, my IP or product (that is, the work I’ve done and am doing), and my personal data, like access passwords and information stored on the associated sites and services.

1. Protect hardware and software with insurance.

In my mind, the last thing I’d want to do if I’d just lost my work gear, data, contacts, possibly cash (if my entire bag has been stolen) and so on, is go out and pay to replace everything.

Is your remote working kit — your computer, phone or PDA, camera and any other gear you might use — insured? If you don’t have insurance, you should definitely consider it. You may be able to claim the insurance premium as a tax deduction, which will nullify its impact on your income. Since insurance is a pretty competitive market, you should be able to get a reasonable deal if you shop around.

If you do have insurance — perhaps as part of a home or office contents policy — double-check to make sure that your items are covered if you take them out of the house or home office. In checking my insurance policy I found that, for example, my computer would be covered if I took it out of the house, but only to a maximum value of $1,000, and only if it was stolen while I was in a building. So if my gear was taken while I was at the park, it looks like it wouldn’t be covered at all.

Also make sure the policy you choose covers you for business losses — my default policy provides only limited cover for home business equipment, so I’ll need to speak to my insurer to make sure the items I use for business purposes are covered.

Okay, that’s the hardware and software dealt with. What about my work product?

2. Protect your work product with regular data backups.

Your data is your IP, your product, your commodity. Imagine how you’d feel if, right now, you lost everything you’re working on. If you know you have a nice current backup of your hard drive somewhere, you’re probably smiling smugly to yourself. But if you’re one of those remote workers who never seems to get around to backing up your data, let the possible theft of your gear motivate you to put a reliable backup process in place.

We all need backups. Maybe you’ll burn key files to CD. Perhaps you’ll copy your entire hard drive to an external device in your (or someone else’s) office. You could easily store your stuff on a server on the other side of town, or the world, or use a cloud-based backup service. Whatever method you choose, try to reduce the risk of losing both the backup and on-device data by ensuring your backups and your computer aren’t stored or transported together.

If you can’t arrange automatic backups of your data, set a reminder in your calendar — every Thursday at 4pm, for example — and refresh your backups manually so you can be sure they represent the latest data. If something happens to your gear, you’ll be glad you had the foresight to back up your data. I promise.

3. Protect your online identity with a password storage plan.

The last piece of the puzzle is your passwords and other details that give you access to online services and sites, and the information you may have stored there — your online identity.

If you’re like me, you probably have more access passwords than you care to — or can — remember. I rely on my browser to remember most of them for me. Yet I’m sure that one of the first things I’d want to do if I lost my stuff would be to log into all my accounts and reset my access passwords. In considering this issue, I realized I don’t even know the access details for my home web connection, let alone my ISP-hosted email account, so I’d have some serious trouble resetting passwords on the sites I use.

The first, and most obvious tip, is to set an access password for your computer itself. If you haven’t done that already, you should!

The next step is to consider password management for all the online services and systems that you use. Obviously, choosing a password storage methodology is the important part of this equation. Of course, the option you choose will affect how quickly you can log in to the sites you use to reset your passwords.

Basically, we have two choices:

localized storage: writing passwords on a piece of paper that you keep in your wallet/under your pillow/inside the third garden gnome from the left on your back porch; storing them in a USB key stuck to the wall above your desk; storing them on your computer using password storage software
globalized storage: storing passwords in a file with your online backups; sending them to your web mail account in encrypted format, and saving the obscurely-titled email in a suitably obscure folder; using an online password storage system

Once you’ve chosen a storage option, make sure your list of passwords is updated at the same time you update your other data backups. That way, you can reset all those passwords as soon as you can get web access after your gear is stolen.

These are the basic precautions I’m taking to protect my gear in public places. What have you considered in protecting your gear, IP and online identity against theft or damage?

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

Do You Need a P.O. Box?

Thursday Bram — Thu, 10 Sep 2009 18:00:36 +0000

There are a lot of things that a web worker needs in order to be able to do his or her work: a computer, an Internet connection … a post office box? While it’s not absolutely required in order to get your online work done, having a P.O. box can make a lot of sense.

I originally got my P.O. box because I wasn’t comfortable handing out my home address online. Despite working primarily online, I still receive a lot of mail, like review copies of software and books or contracts. I still even have a few clients who send me everything for the work they need done in hard copy — some clients just aren’t ready to go to a paperless process for one reason or another. But since I started renting my post office box, I’ve found quite a few reasons why having one is a good idea.

Security

Having your mail sent to a P.O. box can be a matter of security. It’s a choice many people make because they don’t want to hand out their home address online, but the security questions that a P.O. box answers goes even beyond that. Many web workers still receive paper checks. A lot of home mailboxes don’t have locks, making it possible for anyone to pull your mail — no matter what it contains — out of your mailbox. In contrast, a post office box has a lock and is usually inside a post office, so your mail will be safe.

Packages

Because I don’t need much more than my laptop to work, I often spend my days in coffee shops. If a package comes while I’m not home, it’s possible that the apartment office will hold it for me. However, it’s just as possible that they’ll refuse to sign for it and I’ll wind up driving all over. Of course, that’s assuming that the delivery service doesn’t just drop my package in front of my door and hope that it doesn’t disappear before I make it home.

Professionalism

While a home address does not instantly mark you as unprofessional, a P.O. box can help a web worker seem a little more established. It depends on the companies and clients you’re working with, but some clients may just deem a post office box to be a more professional address than an apartment or another address that is obviously residential. In part, such judgments can be attributed to the fact that most beginning freelancers or other web workers don’t usually have a mailing address beyond their homes. If you’ve reached the point where you can have a separate mailing address for your work, you’re probably a little further along in your career.

Not everyone needs a post office box, of course. It’s worth considering how much mail you receive on a regular basis, as well as your own needs as far as factors like security go. Don’t let the price scare you off, though: it’s usually possible to rent a P.O. box inexpensively — and the cost is likely to be deductible for taxes.

Do you have a P.O. box? Why did you decide to get one?

Image by Flicker user mrarteest

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.