We amuse ourselves with stories of laptops, backup tapes and flash drives containing sensitive information being lost or stolen. We ask ourselves how people can be so careless and negligent with such sensitive information. However, the truth is that stories like this will continue to happen, even when top secret information is at stake (see this recent story about a US army data leak, and this story at NetworkWorld for some interesting losses in the past year). The reason that I claim that this is inevitable is that there are simply too many people out there who handle sensitive data. Thus, even if we manage to reduce the probability of a leak to be very very small, the chance that there will be data breaches of this kind is still very high. In fact, if you're in a midsize company, the chances of a data breach of this kind happening to you within the next few years is also not very low. So what should you do?

Well, to quote the boy scouts, my conclusion is just that we should "be prepared". This involves ensuring that we have backups in case data is actually lost, and making sure that all data on external devices like flash drives and backup tapes, and all laptops are fully encrypted. It's really not difficult to do this these days, so why not? It also greatly reduces your legal liability...