What to do when your laptop is lost or stolen:
- Have you recorded essential data (model number, serial numbers,
vendor support tag numbers, Ethernet address, etc.) so you can report
the loss to police and your support vendor?
- At our site stolen laptops sometimes return and are easily
identified in network logs by their physical network address (MAC).
- The thief may call your vendor for support with problems they
encounter.
- Photocopy the back of your laptop. Put lots of identifying marks on
your laptop and copy that too.
- Most computers are configured to "call home" for important
updates -- mine calls home to UW for automatic patches,
anti-virus updates, etc.
- There was a recent
case where a stolen laptop was recovered -- it had the SETI@HOME screen saver
installed -- the "Search for Extraterrestrial Intelligence"
(SETI) project.
- Make sure your computer has a unique name (if every IST laptop
has the same name then logs are not as useful) and have your
IT/IS folks check their logs for any call home activity.
- Assume the worst -- your password has been compromised, your
files have been compromised. Change passwords everywhere,
watch your bank accounts carefully. See SANS Tip.
