Author: tedrose.charles

Definitions / Terminology

Data-At-Rest (DAR) - DAR refers to all data stored on hard drives, thumb drives, DVDs, CDs, floppy diskettes, and similar storage media. It excludes data that is traversing a network or temporarily residing in computer memory to be read or updated.
Mobile Computing Devices (MCD) - Term used in reference a (references are on page 5) to refer to “Laptops, portable notebooks, tablet-PCs and similar systems.” Reference d uses this same term, but also includes “external media” in its definition. Users should consider this term to include external/removable media and to be synonymous to “mobile IS” (below).
Mobile Information Systems (mobile IS) - Term used in references a, c, e, and f. Reference e defines this term as, “Laptops and removable storage devices such as thumbdrives.” Users should consider “mobile IS” to be synonymous to “MCD.”
Personally-Identifiable Information (PII) - Reference h defines PII as “information which can be used to distinguish or trace an individual’s identity, such as name, social security number, biometric records, etc., alone or when combined with other personal or identifying information, which is linked or linkable to a specific individual, such as date of birth, mother’s maiden name, etc” (paragraph 2a of enclosure). Maybe a better explanation is in reference k’s definition of ‘Privacy Data:’ “information the disclosure of which would constitute an unwarranted invasion of personal privacy” (paragraph E2.1.41.2).
Sensitive Data/Information - Typically, this term refers to For Official Use Only (FOUO), Privacy Act, Department of State Sensitive But Unclassified, or Personally Identifiable Information (PII). Page 87 of reference i has a more extensive definition. Refer to paragraph E.2.1.41 of reference k for a complete list of Sensitive Information. Appendix A of reference d contains a fairly thorough list as well.

2

Summary

Never leave a mobile Information System (IS) where it can be seen in an unattended vehicle!
Never leave a mobile IS overnight in an unattended vehicle!
Don’t carry Sensitive Information on a mobile IS unless you have to. Transfer this information by PKI-encrypted E-mail or by posting it to AKO.
Sensitive Information on mobile IS (including removable media) must be encrypted with an Army-approved data-at-rest (DAR) product.
Mobile IS must be hand-carried or under visual observation while traveling on public transportation.
Do not leave a mobile IS unattended in an unsecured personal residence.
Do not leave a mobile IS unattended and unsecured in the workplace. Unless in a locked office, mobile IS should be locked in a container or secured with a cable lock to an immovable object.
Laptops must be labeled to indicate that all Sensitive Information is protected by an approved DAR solution and the laptop is authorized for travel.
Always shut down laptops before travel. Never use the sleep or hibernation modes during travel.

For Assistance Contact:

Local IA/IT POC (write name/phone below):
_______________________________________
TRADOC Information Assurance Program Manager: monr.tradociapm@us.army.mil
This document is available for download at the following URL:
http://www.tradoc.army.mil/tpubs/misc/DAR/index.htm
Current as of: 20 Feb 08

6

TRADOC User’s Guide to Data-At-Rest and Mobile Information System Security

Overview

1

TRADOC continues to lose Sensitive Information due to negligence in protecting data on mobile Information Systems (IS). These losses place our employees’ personal information, the accomplishment of our mission, and the lives of our Soldiers at risk.
Over the past two years, DA and TRADOC have released numerous policy documents on Data-At-Rest (DAR) and mobile IS security. Users have reported difficulty in complying because the terminology used in these documents has not been consistent and no single document lists all of the requirements.
The intent of this Guide is to consolidate and summarize DA‘s and TRADOC’s guidance. It explains the key requirements, attempts to resolve confusion over terms, and provides URLs to pertinent documents. Page 6 (the back cover, if folded properly) summarizes the most important points.
Keep in mind that local or organization policies may be more restrictive than the information in this Guide.

Key Requirements

Key Requirements
(cont.)

References

APPROVAL FOR TRAVEL
Supervisors must explicitly approve mobile IS for travel. They need to be aware of the sensitive information that their personnel are transporting out of government-controlled facilities on these devices.
————————————————————————————
LIMIT THE AMOUNT OF DATA TRANSPORTED
“Limit the amount of sensitive information that is transported out of facilities on mobile ISs’ hard drives or on thumb drives, floppy disks, CDs, DVDs, or other removable media to the minimum necessary for mission objectives. To the fullest extent possible, personnel shall transfer sensitive information by PKI-encrypted E-mail or by posting it to Army Knowledge Online as a repository for sharing or availability” (paragraph 2b, reference f).
———————————————————————
DATA-AT-REST (DAR) ENCRYPTION
All sensitive information on laptops and other mobile IS approved for travel must be encrypted using an Army-approved DAR solution so it won’t be compromised if an IS is lost or stolen. DA CIO/G-6 is working to field an Army-wide DAR solution. They selected a product and ordered a large number of licenses, but competing vendors protested this purchase. While the protests are being resolved, DA has placed a moratorium on DAR software purchases. Organizations that purchased Pointsec, Credent, Guardian Edge, or Mobile Armor licenses before the moratorium may continue to use them. Sensitive information on other Windows-based mobile IS must be protected by Microsoft’s Encrypting File System (EFS), as described in reference d. Many organizations using EFS have chosen to force encryption of all documents in each user’s My Documents folder and to create an encrypted folder on each removable storage device. Never travel with a laptop in sleep or hibernation mode, as this may allow DAR encryption to be bypassed.

3

LABELING OF MOBILE IS
Laptops must be labeled to indicate that all sensitive information is protected by an approved DAR solution and that the system is authorized for travel. If the DAR solution being used supports removable media, these devices must be labeled as well (per paragraph 3.1.4 of reference g). Per reference j, labels should be placed inside the lid of laptops, not on the outside, to avoid advertising these devices as government systems containing sensitive information .
————————————————————————————
PHYSICAL SECURITY
1. Never leave a mobile IS where it can be seen in an unattended vehicle! It must be locked in the trunk and (per ref a) should be secured with a cable lock to a “permanent vehicle mount.” If renting a car, try to get one with an alarm system and no external rental identification stickers.
2. Never leave a mobile IS overnight in an unattended vehicle!
3. Mobile IS must be hand-carried or under visual observation while traveling on public transportation. If the computer carrying case is too large to be carried on an airplane, the computer must be removed from the case and hand-carried onto the plane.
4. During hotel stays, use a cable lock to anchor the laptop to a fixed object in the room (per ref a).
5. Do not leave a mobile IS in an unattended, unsecured personal residence.
6. Do not leave a mobile IS unattended and unsecured in the workplace. Unless in a locked office, mobile IS should be locked in a container or secured with a cable lock to an immovable object.
————————————————————————————
REPORTING LOST PII
Suspected or confirmed losses of PII must be reported within one hour IAW reference h.

4

a. Army Best Business Practice (BBP), “Road Warrior” Laptop Security, version 1.2, issued 17 Feb 06 (updated 4 Jan 08)
https://informationassurance.us.army.mil/bbp/
b. VCSA message, ALARACT 099/2006, subject: OPSEC Message - Guidance on Proper Use of Computer Hardware and Software, 22 May 06.
https://www.us.army.mil/suite/doc/5634316
c. DA CIO/G-6 memo, subject: Army Data-At-Rest (DAR) Protection Strategy, 28 Sep 06.
http://www.army.mil/ciog6/references/policy/docs/DARStrategy.pdf
d. Army BBP, Data-At-Rest (DAR) Protection, Mobile Devices using EFS Implementation, version 1.0, 12 Oct 06.
https://informationassurance.us.army.mil/bbp/
e. VCSA message, ALARACT 209/2006, subject: Army Data-At-Rest (DAR) Protection Strategy, 27 Oct 06.
https://www.us.army.mil/suite/doc/9449430
f. TRADOC DCG/CofS memo, subject: Guidance on Protecting Data-At-Rest (DAR), 31 Oct 06.
http://www.tradoc.army.mil/tpubs/misc/DAR/index.htm
g. VCSA message, ALARACT 147/2007, subject: Army Protection of Personally Identifiable Information (PII) Awareness, 2 Jul 07.
https://www.us.army.mil/suite/doc/9180511
h. TRADOC DCG/CofS memo, subject: Reporting the Loss of Personally Identifiable Information (PII), 20 Sep 07.
http://www.tradoc.army.mil/tpubs/misc/DAR/index.htm
i. AR 25-2, Information Assurance, 24 Oct 07
http://www.apd.army.mil/pdffiles/r25_2.pdf
j. TRADOC Supplement 1 to AR 25-2, TBP
http://www.tradoc.army.mil/tpubs/supplndx.htm
k. Department of Defense Directive 8500.01E, Information Assurance, 24 Oct 02 (current as of 23 Apr 07).
http://www.dtic.mil/whs/directives/corres/pdf/850001p.pdf

5