Small devices, big challenges: handhelds present insurers with an assortment of new risks. But new technology is now helping many of them protect against the worst were it to happen

Risk & Insurance, March 3, 2003 by Joan Herbig

Using mobile infrastructure technology, the insurance information technology administrator can take several steps to reduce the opportunity for hackers to do significant harm:

* Data on the device can be stored in encrypted form and retrieved in a readable format only after a recognized password has been entered. It goes without saying that data traveling between the server and the device should also be encrypted.

* If the information on a lost device is sensitive, it may be safer to delete it altogether rather than simply locking down the device. This security measure may be the last in a series of actions taken to protect device data. For instance, if a device has not connected with the server for 12 hours, a lockdown command is automatically sent. If the device has not connected for 36 hours, all data is deleted from the device. The device can be configured to carry out actions such as these even when it is severed from network contact. The ability to erase some or all of the device data allows the corporation to maintain control of this precious resource, even if the device itself is no longer in its possession.

* Configuration standards for handheld devices can be defined and automatically enforced from a central location. Every time a user connects to the corporate network, configuration settings can be checked and automatically changed if they're out of compliance. As a result, the user who turns off password protection soon finds that it has been automatically turned on again. He may also receive an e-mail explaining why the precaution is necessary, and encouraging him not to disable it again.

Recovering Lost Data

Insurance firms bear the brunt of data loss or misuse, in terms of liability, competitive weakness and reduced employee productivity. The employee, however, feels the full force of that loss in terms of frustration, heartfelt anguish and, ultimately, responsibility to customers.

What if the PDA left in the field contains valuable information that is vital to processing a claim following a devastating car accident? Without a mobile infrastructure solution, the agent would be on his own. But his frantic call to the IT administrator is not in vain if he can "reach out and touch" the device via handheld management software. If he purchases a new PDA at the nearest office store and connects it to a PC with Internet access, the administrator can simply download the Mobile Infrastructure solution onto the new client, authenticate the user and restore the device to its last known settings, including all applications and data.

The new device looks and acts exactly like the one that was lost. And the grateful agent is able to process the claim, although his hands might still be shaking.

Of course, data loss can occur even when a device remains in the user's possession. The handheld might bounce down an escalator or go through the wash. Or it might simply sit there too long.

Handheld device batteries have a relatively short life span, which most users aren't known to chaperon with much diligence. For some devices, when the battery discharges completely, only the data burned into ROM at the factory is retained. Everything else is lost, including applications, settings and data. While the data is safe from misuse, it is just as unavailable for legitimate use, which can cause even the toughest agent to call the IT department near tears, pleading for help.