The number of mobile storage devices on campus continues to grow at quick pace.  It is important that faculty, staff and students at the University adopt practices and procedures for mobile storage devices to ensure that confidential and private data stored on these devices is protected.

Mobile storage devices include, but are not limited to:

• laptop computers, tablets, and other portable computing devices;
• flash drives, removable hard drives, CDs, DVDs and other portable storage media;
• cellphones, smartphones, and Personal Digital Assistants (PDA's)

These devices and the data contained on them when left unsecured, are susceptible to theft and possibly to explotation.

When at all possible, confidential, sensitve or private data should not be stored on mobile storage devices.  If sensitive data is stored on a mobile device the following practices should be adopted:

• use a password to access the device and set the device to auto-lock during inactivity
• protect specific files with a password if possible
• do not share your device with other people
• turn off wireless, bluetooth and infrared access when not in use
• wireless access should be configured to query for authentication before connecting
• unknown or untrusted networks should not be used to transfer sensitive data
• immediately report the loss, theft or unauthorized use of the device
• capable devices should be wiped remotely in the event of loss or theft

Whenever possible you should physically protect the mobile device itself by:

• using locking security cables for mobile computers
• locking offices, cabinets or desk where devices are stored
• ensure your doors are locked and devices are out of sight when in a vehicle
• avoid leaving your device unattended in a public area
• institute a check-out procedure to track shared devices in a Department or Faculty

For some more information on Smart Phones on campus, please visit the Telecommunications Mobile/Wireless Device page.

Encryption

For highly sensitive data, such as data subject to the Personal Health and Information Act (PHIA), file or whole disk encryption should be used.  Data encryption is the conversion of data into a form that is unreadable by the unauthorized user.  Encrypted data must be decrypted with an authorized key prior to use.  Faculty, staff or students should contact their local IT Support staff or the Help and Solution Centre for assistance with selecting and implementing an encryption tool.

Here are some popular open source encryption tools:

True Crypt (Disk encryption for Windows 7/Vista/XP, Mac OSX and Linux)

AxCrypt (File Encryption for Windows)

GPGTools (Mac PGP tools) 

7-Zip (Compression tool with AES-256 encryption for Windows/Mac/Linux)

Disposal of Mobile Devices, Portable Media and Hard Drives

When recycling mobile devices and portable media, such as laptops, smartphones, DVD/CD's and system hard drives, it is important to remove all data securely or destroy the device so that is unusable.  It is extremely important that sensitive data containing personal information or personal health information is not leaked to unauthorized persons.

When recycling a Windows or Macintosh computer please follow the guidelines on secure disposal of old computers and instructions for erasing hard drives.

The following are some more options for various items:

Workstations, Laptops and Hard Drives

• erase the systems hard drive using a recommend tool such as DBAN (Darik's Boot and Nuke)
• remove hard drives from the system and physically destroy the drive
• Shred-It* will take standard size storage boxes of Hard Drives for a fee of $25 (July 2011)

CD's, DVD's, Floppy Disks, Tapes

• degauss magnetic tapes or destroy using the Shred-It service or other means
• physically destroy discs using the Shred-It service or other means

Smartphones, Cellphones and PDAs

• Apple Support Documentation (iPhone, iPad and iPod) - From Apple support site search your device or check user manual
• Blackberry Support Documentation - or search for "KB05099" in the knowledge base
• Palm Pilot Support Documentation - search "zero-out rest" or "factory reset"
• Documentation for various cell phone models at recellular.com - requires registration

University of Manitoba Capital Equipment Control Procedures
University of Manitoba Capital Asset Management (Policy, Forms and Information)

Also, see our guidelines on securce disposal of old personal computers.

(+)