Computerworld — This is a story about how budget cuts take a toll on security, but it's also a tale about how security setbacks can be opportunities to introduce much-needed measures.

When the recession led my company to cut costs about a year ago, one of the decisions was to close a major facility housing some 1,200 employees. A lease agreement meant we couldn't start moving those employees into our headquarters building until last week, when 200 made the move.

Trouble Ticket

At Issue: A brazen theft has raised everyone's awareness of security issues.

Action Plan: Take advantage of this opportunity to establish stronger security policies.

Slideshow: When Rogue IT Staffers Attack: 8 Organizations That Got Burned

When the moving truck arrived here, the movers propped open one of the building's side doors. That was a mistake, made worse by the fact that the budget for guards at headquarters was also cut last year. No guard was available to watch the truck or that open door, and the movers, of course, were too busy moving things to provide security.

That big moving truck outside of an office building must have looked like an invitation, because someone took advantage of the situation and sneaked into our offices through that side door. That person then proceeded to steal unsecured laptops from open offices and cubicles. He got 25 of them, apparently making several trips in and out through that door. He might have gotten more, but on one of his trips out of the building -- when he was carrying five laptops -- an employee challenged him. He ran to his car and took off. Another employee chased the thief but was only able to obtain a partial license plate number. But we know the make of the car and have some video footage from our security cameras, so we're hopeful that we'll be able to recover our goods. In the meantime, data and intellectual property are at risk.

As I said, though, unfortunate events are sometimes the needed impetus for making changes. My experience has been that when bad things happen, I have about a one-to-two-week window of opportunity. I seized the moment.

Grabbing the Chance

First on deck is full disk encryption. We tried to implement it about two years ago, buying the product put out by PointSec (recently acquired by Check Point Software). But some simple things impeded widespread adoption. For example, a lot of our employees use laptops inserted into docking stations, and they couldn't use their USB mice and keyboards until after they logged in. There were also problems with hibernation that I understand have been fixed in newer versions of the product.

Continue Reading