Lost or Stolen Devices

Layer 1: Physical Medium risk

How it works

Devices are lost in taxis, airports and restaurants, or stolen from vehicles, homes and offices. A thief is usually after the hardware, but an unencrypted laptop or an unlocked phone can give anyone access to email, saved passwords, cached files and connected cloud services. Removing the drive from an unencrypted laptop can expose everything on it. Phones without a screen lock can also receive password reset messages and multi-factor codes for work accounts.

For an organization that handles personal information, a lost device can become a reportable privacy breach. In Canada, organizations may need to notify affected people and regulators when a breach creates a real risk of significant harm, and Alberta's private sector privacy law has its own notification requirements. Encryption and remote management often make the difference between a minor inconvenience and a serious incident.

Warning signs

• A device cannot be located or was left behind
• Sign-ins from a known device in an unexpected place
• Staff delaying reports out of embarrassment
• Devices without encryption or a screen lock
• No inventory of who has which device

How to defend against it

• Encrypt all laptops and mobile devices
• Enforce screen locks and strong PINs or biometrics
• Use mobile device management with remote lock and wipe
• Store work files in the cloud rather than locally
• Keep an up-to-date device inventory
• Make it easy and blame-free to report a lost device

If it happens to you

1. Report the loss to IT immediately
2. Remotely lock or wipe the device and revoke its sessions
3. Change passwords that were saved or used on the device
4. Assess whether personal information was exposed and needs reporting