8

There usually is a lot to do about the security of servers since a lot of sensitive information is stored there but I think it's more important to make sure the company-laptops (and USB-Sticks) are secure since they're way easier to lose (or steal).

So what I want to know is: What does your company do to protect the confidential information on laptops and usb-drives?

3
  • Is the [Security] prefix really necessary when it's already tagged as such?
    – spoulson
    Apr 30, 2009 at 13:39
  • I don't think it's necessary. If I had enough points to edit I'd get rid of it. Apr 30, 2009 at 13:45
  • @spoulson: Good one.
    – Huppie
    Apr 30, 2009 at 17:01

8 Answers 8

8

We use TrueCrypt. For laptops we insist on a BIOS password as well.

4
  • BIOS passwords can be easily disabled. Pull the what battery,reset the jumper and wait.
    – cbrulak
    Apr 30, 2009 at 12:54
  • @starko: this doesn't work on laptops as the BIOS password is stored in a security chip (unless you replace the chip)
    – mwore
    Apr 30, 2009 at 13:39
  • So pull out the harddrive, put it in a USB box, read it from another machine. TruCrypt will stop people getting any useful data from it, of course, but it still doesn't stop your shiny laptop being nicked by someone. May 6, 2009 at 22:29
  • Sure, but the question was about the data.
    – nickd
    May 12, 2009 at 21:29
3

Whole disk encryption.

There are quite a few methods for doing this.

I've personally used TrueCrypt, but there are many more options on this wikipedia page.

I also used to work for an accounting company that rolled out PointSec (Now Check Point). Their solution seemed far more complete that truecrypt, but of course, that comes at a price.

2

I've used a product called SafeGuard Easy from Utimaco. You couldn't boot the laptop w/o first entering a password. It also encrypted the entire drive. If someone tried hacking the password it progressively increased the timeout between attempts (something like 3X the timeout each attempt, so it would have a crazy-long delay even after only a few incorrect attempts). It had some nice tools for remotely allowing a log-in if someone got locked out via a generated key and it let you set an expiration policy on users.

They had some command line tools so you could push down these changes inside of a config file, which was nice since we could automate that through the primary application they ran on the notebook. If the notebook went missing we knew the user/password would be expiring within a week (even if they knew the password) they'd eventually be locked out.

1
  • I've also used SafeGuard Easy, great product!
    – Andy May
    Apr 30, 2009 at 13:14
1

Whole disk PGP encryption

1
  • same here. good success with dozens of laptops.
    – SqlACID
    Apr 30, 2009 at 17:03
1

Not allow it to get there in the first place (at least, that's what we're working towards...). Technology, and the way computers work and are used, is changing - it is now perfectly reasonable to have always-available Internet access from every/most places a user could be expected to be, either through a wired connection at work, via a wireless network, or by handing them a laptop with a built-in 3G broadband dongle. Therefore you can disable the use of USB drives via Windows GPO and have them access data via a VPN, probably simply by using applications via Terminal Services (or VNC/SSH, or whatever) and using however-many factor security you like.

0

true crypt virtual drives. We can manage them by backing up the headers in case the passwd gets lost and since they are easy to use, no problems getting the users to use them. Mind you, we only have 5 ppl

0

We use a whole disk encryption solution which has single sign-on built in. SafeGuard is one such solution. This allows the user to log on once, which is right after the POST finishes. If you enter the wrong password, the length of time between password attempts continue to double. And if you restart, it stays at whatever the last time period was, but starts it over. Therefore, brute forcing isn't really a possibility. If the user types the correct password it will log them onto the computer with the same username\password combo (or a cached set of credentials).

This won't stop the case of a user booting through and then leaving the laptop unlocked, but it does protect the drive "at rest."

0

Not being facetious but the best way is to not put it there in the first place. (Agree with David Hicks).

Think of it this way: If the laptop was stolen or lost and contained all your companies secrets - how would you feel? Even if you use TrueCrypt with a super strong password.. you'd always have that doubt in your mind.

Consider publicity; the press take a simplistic view of things. They'd say "Acme corp loses laptop with 30,000 employee records". The fact that it was highly encrypted might not be enough to prevent reputational damage.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .