I got a Skype message last week from a friend who is a frequent traveler.  He told me how his company finally gave them new lighter weight laptops and he was pretty excited about that.  I, of course, asked about the security of the laptop.  He responded, “Even you would be happy with this security backpack they gave us – they cost a $100 bucks each (USD).”

I think he went to the website for this backpack as he started typing all the details into our Skype conversation. This laptop has slash protection so nobody can use a knife to rip the backpack open.  He went on to say that all the zippers are tamper proof so the pockets could not be unzipped without his knowledge.  He even went into some detail on the snatchproof shoulder strap – but I have to admit that I was not paying too much attention at that point.

While he was dumping all these marketing buzz words on me, I’m busy running some real numerical analysis.  Finally I jumped in and ran the analysis by him.

• Average Cost of a Laptop – Lets use a very conservative high estimate and assume a fully loaded name brand laptop and go with $2500 USD as the average laptop price.
• Average Cost for “security” backpack - $100

So essentially they spent an extra 4% ($100/$2500) of the laptop’s value on an insurance policy against the laptop being stolen.

Then I asked how many records (rows in spreadsheets, records in a database) of confidential data are on your PC.  He said, “at least 5,000 – that’s why they invested in this backpack!”

I then quoted him from the The Ponemon Institute 2008 study on the Cost of a Data Breach. This study estimates that the average cost per breached record is now $202 USD.  So, if your laptop is stolen those 5,000 records represent a million dollars in money (lost revenue, lost brand reputation, staff spent dealing with crises etc.).

So I tell him that I know the bag is great – but what if you just leave it on the chair when you get up to get coffee and somebody walks along, picks it up, takes it home.  Then, in the comfort of their garage full of tools, they slash through all the backpack protection.  If that happens – has your company spent the same 4% or roughly $40,000 on tools to to protect the data?  Let’s just say the conversation went downhill from there (though I am optimistic that by the time he finds this blog he will have forgiven me).

Bottom line – laptops can easily be replaced.  Data on the laptop hard drives cannot be easily replaced and the costs associated with the data loss are huge.  You need to protect the data – not just the shell around the data.