Friday night, a break-in at a federal agency. The perpetrators enter through an unsecured window that had been known as a weak point for some time. Alongside cash and electronics, mobile IT systems disappear. Whether files were copied or tampered with can no longer be determined with certainty after the fact.
The theft of devices, storage media and documents causes double damage: replacement costs and loss of availability on the one hand, the uncontrolled disclosure of confidential data on the other. The BSI lists this threat as G 0.16.
What’s behind it?
What gets stolen is what is valuable, inconspicuous and easy to carry. Notebooks, smartphones and USB sticks meet all three criteria. In many cases, the thief is not interested in the hardware at all — the stored data is the actual target.
Forms of theft
- Opportunistic theft — unattended devices in public spaces, vehicles or hotel rooms. Mobile devices are particularly exposed because they are small, valuable and easy to resell.
- Targeted theft — an attacker deliberately targets specific devices or storage media containing confidential information. Such attacks are often enabled by insider knowledge.
- Insider — employees with legitimate access copy large volumes of confidential data onto private storage media shortly before leaving the company and take them along. Technically this is no classical theft, but the effect is identical.
- Break-in — targeted break-ins into office buildings or data centres in which servers, hard drives or files are stolen.
Impact
The immediate damage comprises replacement costs and business disruption. The more serious damage arises from the disclosure of confidential data: customer data, trade secrets, personal information, access credentials. For the loss of personal data without encryption, a GDPR notification obligation applies — including possible fines.
Practical examples
Notebook theft from a vehicle. A sales employee leaves her company notebook in the boot of her company car overnight. The vehicle is broken into, the device stolen. The unencrypted hard drive contains customer lists, price calculations and contract details. The GDPR notification becomes necessary, the customers must be informed.
USB stick with customer data in the drawer. A call centre employee copies large volumes of confidential customer data onto a private USB stick shortly before resigning. After leaving, he sells the data to a competitor. The call centre subsequently loses several major customers when the incident becomes public.
Break-in with hard drive theft. In a mid-sized company, intruders break into the server room at night and steal several hard drives from a storage system. The data contains design plans and patent documents. Since no backups exist at a separate location, availability is also affected.
Relevant controls
The following ISO 27001 controls mitigate this threat. (You’ll find the complete list of 18 mapped controls below in the section “ISO 27001 Controls Covering This Threat”.)
Prevention:
- A.7.1 — Physical security perimeters: Access controls and structural measures prevent unauthorised entry.
- A.7.9 — Security of assets off-premises: Rules for the protection of mobile devices when travelling and in home offices.
- A.8.1 — User end point devices: Encryption, screen lock and secure configuration of all end-user devices.
- A.7.10 — Storage media: Rules for the secure handling and disposal of storage media.
- A.7.4 — Physical security monitoring: Camera surveillance and alarm systems as deterrence and for incident investigation.
Detection:
- A.6.6 — Confidentiality or non-disclosure agreements: Contractual obligations that provide legal recourse in the case of insider action.
- A.8.10 — Information deletion: Ensuring that data on returned or decommissioned devices has been completely deleted.
Response:
- A.5.29 — Information security during disruption: Contingency plans for the case that critical devices become unavailable through theft.
- A.8.13 — Information backup: Current backups ensure the availability of stolen data.
BSI IT-Grundschutz
The BSI IT-Grundschutz catalogue links G 0.16 to the following modules:
- INF.7 (Office workplace) — security requirements for office spaces, including access protection and storage.
- INF.8 (Home workplace) — protection of devices and documents in the home office.
- SYS.3.1 (Laptops) — specific requirements for securing mobile computers.
- CON.6 (Deletion and destruction) — secure disposal of storage media and documents.
Sources
- BSI IT-Grundschutz: Elementary Threats, G 0.16 — original description of the elementary threat
- ISO/IEC 27002:2022 Section 7.9 — implementation guidance on the protection of devices outside secured areas
- BSI: Mobile Security — recommendations for securing mobile devices