21. A company's IT policy requires the protection of sensitive data on employee laptops, especially those taken off premises. Recently, data theft on these devices has become a concern. Which of the following security measures should the company implement to safeguard the laptops?
Answer: A
Full disk encryption is the best measure to safeguard employee laptops.
Implementing full disk encryption ensures that all data stored on employee laptops is encrypted, making it inaccessible without proper authentication. This is particularly crucial for sensitive data that may be vulnerable to theft when devices are taken off premises.
A) Full disk encryption
Full disk encryption is the most effective measure to protect sensitive data on laptops, especially those taken off-site. It encrypts the entire hard drive, ensuring that if a device is lost or stolen, the data remains secure and unreadable without the appropriate decryption key. This directly addresses the company's concern about data theft.
B) Intrusion detection software
While intrusion detection software is valuable for monitoring unauthorized access and potential threats, it does not protect data stored on laptops if they are stolen. This measure focuses more on network security rather than safeguarding the data physically residing on the device itself.
C) Biometric authentication
Biometric authentication enhances security by ensuring that only authorized users can access the device. However, it does not encrypt the data stored on the laptop. If the device is stolen, the data can still be accessed by someone who bypasses or removes the biometric control.
D) VPN access
VPN access is essential for secure remote connections to the company's network, but it does not protect the data stored on the laptop itself. If a laptop is stolen, a VPN will not prevent unauthorized access to the files on the hard drive, making it insufficient as a standalone security measure.
Conclusion
Full disk encryption is the definitive choice for protecting sensitive data on employee laptops, particularly when taken off premises, as it secures the entire hard drive against unauthorized access. Other options, such as intrusion detection software, biometric authentication, and VPN access, provide various security benefits but fail to adequately protect the data at rest on the devices. Therefore, full disk encryption is essential for mitigating the risk of data theft effectively.