Problem solve Get help with specific problems with your technologies, process and projects.

Finding lost notebooks with 'LoJack for laptops'

LoJack software can be helpful in retrieving stolen laptops, but there may be a better way. Security management expert Mike Rothman explains the pros and cons.

What can you tell me about the market for products that promise to act like a LoJack for your laptop? How do these products work, and do they really help an organization recover stolen hardware? In what scenarios are they worth the investment?
These PC-finder applications are pretty simple. They involve loading a software agent on a laptop that will periodically (when connected to the Internet) phone home and figure out if the device is listed as stolen. In the event the device is stolen, it provides information about the IP address and other network characteristics to assist law enforcement in locating the device. Presumably, this allows the proper authorities to find the device and return it to its rightful owner.

These services do work, as long as the local police are responsive to finding and retrieving the device. Is it worth the investment? There is no generic answer to that. The reality is a machine itself is worth a couple hundred bucks. This is a traditional insurance calculation. Security professionals should figure out the likelihood of their machine being stolen and its replacement value, and then make a decision on whether the insurance is a good bet – especially when there is no guarantee the machine will be recovered.

Another aspect of this decision isn't so much the value of the machine, but the value of the data it contains. If private data is kept on the device, then retrieving it as quickly as possible is critical, unless it has some type of full-disk encryption, so even if it is stolen and not recovered, the data on the computer is not exposed. Of course, if the machine's data is not backed up properly, the data could be invaluable.

Currently many more organizations opt for full-disk encryption over LoJack-type services. So I think it's safe to say that for a lot of organizations, the investment is not worth it.

More information:

This was last published in February 2008

Dig Deeper on Information Security Incident Response-Information

Start the conversation

Send me notifications when other members comment.

Please create a username to comment.