Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

With a number of laptops out there the likelihood of one being stolen is high. What methods, preferably free, can be used to secure the data on the computers? The laptops do not have any special hardware on them, and generally keep their user data in a dropbox folder. One small step taken is to have the the dropbox folder encrypted by Windows 7. Any additional suggestions are greatly appreciated. The data in the dropbox folder is sensitive.

share|improve this question
2  
Is your company OK putting sensitive data on Dropbox? I don't have a problem with it .. I use Dropbox for all my data .. but I suspect careful (i.e. paranoid) companies would not condone it. –  tomjedrz May 3 '10 at 23:20
    
They are okay with it. It's data you could trust to Dropbox, but not stuff you would like to have in the hands of just anyone. –  user42134 May 4 '10 at 0:04
add comment

5 Answers 5

up vote 5 down vote accepted

Having your "dropbox" folder encrypted is a good first step. I use a dedicated TrueCrypt partition for data, and use two passwords on the laptop -- one for Windows login, and another for the TrueCrypt data partition. One weakness here is that browser history, last opened file names, and many other potentially interesting kinds of user data are left unencrypted.

You can supplement this with a 'phone home' solution like Prey. I think it's debatable how much this would help against a professional information thief, but at least it gives the appearance of doing something active about recovering the laptop.

You can also encrypt the full boot drive. There are pros and cons. On the plus side, full drive encryption is comprehensive, nothing is accidentally left unencrypted. On the negative side, a small software or hardware malfunction can lead to a OS reinstall.

Tom's Hardware recently compared TrueCrypt and BitLocker from Microsoft, but not some of the competition. IMHO the article misses the point a bit; speed is not a significant differentiator between the two, but BitLockers stronger support for enterprise deployment and key maintenance is.

Edit: Great comments below, thanks Warner, nedm & Maxwell. As for the "Evil Maid" attack, I know of this attack, but it's not stopping me from using TrueCrypt. If an attacker can repeatedly get physical access to a PC, then any security measure can ultimately be defeated. The question is, would it be economical to mount an attack, relative to the expected value of the stolen good. For most companies, I think TrueCrypt full disk encryption would make an attack uneconomical (cost of one criminal to make mutiple break-ins etc). The common thief would simply wipe the harddrive and sell the laptop as a stolen good. If that's not good enough for you, then have a look at BitLocker, or better yet PGP's Whole Disk Encryption with two-factor authentication -- or stop using laptops. :-)

share|improve this answer
1  
Thank you for the TrueCrypt suggestion. I am looking into this solution. –  user42134 May 4 '10 at 0:08
    
I have TrueCrypt deployed professionally for over a year not and we have yet to experience any support issues or otherwise. –  Warner May 4 '10 at 4:08
    
+1 for Truecrypt full-disk encryption. We've installed it on probably a dozen laptops + a few desktops with no issues. Note that with a recovery disk, which it forces you to create on install, you can recover from a partial or fully overwritten disk volume header, which is the main threat to the integrity of the encryption scheme. We've never had a problem, and even with block errors or hardware problems on the drive I wouldn't say it's been any more fragile than an unencrypted disk. The lack of enterprise deployment features is a legitimate drawback, but then again, it's also free. –  nedm May 4 '10 at 4:18
    
As for TrueCrypt you may want to read this article: theinvisiblethings.blogspot.com/2009/10/… –  Maxwell May 4 '10 at 9:34
add comment

Look at using full disk encryption, whether Bitlocker or a 3rd party product. This is not perfect, but makes it harder on a thief to get anything off of the system. Most will likely wipe and reload. You won't get the HW back, but you'll better ensure company data isn't lost because of a theft.

share|improve this answer
    
Agreed. The loss of a laptop with an encrypted hard drive is almost an incidental loss, almost every time. Yes, there are targeted thefts which increase the liklihood of your data being stolon, but really, you're protecting yourself from the snatch and grab on the subway or parked car. –  Matt Simmons May 3 '10 at 22:40
    
Bitlocker sounds great, however, it requires an upgrade in editions (from business). Can an upgraded Windows 7 instance use Bitlocker on the drive, or is a format required? –  user42134 May 4 '10 at 0:06
add comment

I would also advise going for the TrueCrypt solution as it can cover pretty much everything you want. I have a TrueCrypt voume on my laptop and have been experimenting with TrueCrypting the boot volume too. It's free, it's open source, and It don't play (as much) havoc with deployment.

share|improve this answer
    
I'm testing this out now, props to TrueCrypt –  user42134 May 9 '10 at 9:12
add comment

Use bitlocker and bitlocker to go. Bitlocker is easily maintained and simple to deploy. If you want to get the hardware back try laptopcop. I like laptopcop because they work with the police freeing you from that pain. Another source of security is windows rights management

share|improve this answer
    
Would you say bitlocker is worth upgrading business to enterprise? –  user42134 May 4 '10 at 0:09
    
Absolutely, win 7 pro + sa to get enterprise for bitlocker is an easy call to make –  Jim B May 4 '10 at 12:28
add comment

If you do not have physical security you do not have any security. Any attempt at securing the data on an otherwise physically insecure system is only a delaying game against an incompetent thief. Since NTLM hashes for 14 character password, even with special characters, can be broken in 6 to 8 seconds now I would recommend forcing a complex password scheme of no less than 24 characters and hoping the bad guy does not have a large enough rainbow table.

share|improve this answer
    
One nice thing about TrueCrypt is that it doesnt make it apparent that there is anything there worth attacking, or which method should be attacked. While I agree, physical security is essential, even this can be be broken. –  user42134 May 9 '10 at 9:11
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.