Handling Corporate Laptop Theft Gracefully

Billosaur writes "From NPR, we get a Marketplace story about the theft of corporate laptops and the sensitive data they may contain, specifically how to handle the repercussions. From the story: 'TriWest operates in about 21 states. It's based in Phoenix, Arizona. In December of 2002, somebody broke into the company's offices and stole two computer hard drives.And those hard drives contained the personal information of 550,000 of our customers from privates in the military all the way up to the chairman of the Joint Chiefs of Staff.' How they handled the situation earned them an award from the Public Relations Society of America."

Comments

Encrypt the disks.

[base3]

Then there's no data loss, and thus no ethical or legal obligation to tell anyone, and thus no need to handle getting caught with your pants down gracefully.

Re:Encrypt the disks.

[shawn(at)fsu]

I didn't think any excryption was perfect. So what happens if they do encrypt the disk and the drive gets stolen. If they don't report it and the encrytion is broken what recourse do those people with compromised information/identities have?

Re:Encrypt the disks.

[MandoSKippy]

While California's SB1386 specifically mentioned encryption as a reason for not having to disclose to customers under that law, other laws do not. Specifically Wisconsin Act 138 does not mention encryption as a way to preclude disclosure. Basically Wisconsin's law states if someone unauthorized has a clients data, you must tell the client about it. Now, of course I am not a lawyer, nor do I play one on TV, but I know this is a new law (March 16th, 2006) and have any Jurisprudence clarifying this. On the flip side, encrypting the data sure makes the disclosure a lot less painful. I.e. Yes, we had laptops stolen, but all the data was encrypted per our policy and the likelyhood of you data being imporperly used is extremely low. I am currently researching a workstation encryption project, so if anyone (a lawyer perhaps?) has any insight into this stuff, I'd be happy to hear it from the expert.

Re:Encrypt the disks.

[Anonymous Coward]

If you encrypt all your disks ... you must have extra CPU cycles to burn.

Re:Encrypt the disks.

[MandoSKippy]

Research Whole Disk Encryption. It's actually not that bad on performance (I am running it right now)

Re:Encrypt the disks.

[Anonymous Coward]

Why is the parent comment flamebait? Properly encrypted data can be stolen or copied without causing harm because without the key the thief only gets useless garbage. Properly encrypted data can not be tampered with in a meaningful way. Encryption really is the solution to data leak and authenticity problems through laptop thefts and manipulations. Regardless of the legal obligations after a laptop theft, encrypting sensitive data is the right thing to do.

And it's a good idea for desktops and private citizens too: What if the harddisk with your personal data (you know, the pictures nobody but you and your spouse is supposed to see) fails catastrophically and you need to have it replaced? Are you going to send it to the manufacturer with all your data on the platters? If you had encrypted that data, there wouldn't be a problem with returning it for a refund or having it replaced.

Re:Encrypt the disks.

[winkydink]

It's not perfect. Nothing is perfect. How close to perfect do you have to get to be good enough?

Re:Encrypt the disks.

[Anonymous Coward]

First of all, yes, people have extra CPU cycles to burn. Second, encryption would put the CPU cycles to good use. It's a worthy price to pay for securing the data. Third, dedicated encryption coprocessors could greatly increase the throughput and lower the power consumption necessary for on the fly encryption and decryption of harddisks. Demand needs to be made heard for the supply to grow.

Re:Encrypt the disks.

[Anonymous Coward]

Good point. It doesn't even matter whether or not the encryption is perfect. The password is the weak point and typically the password is set by a user who tapes it to the bottom of his laptop or uses easily cracked passwords.

If the information is stolen, it should always be reported to customers. If the company wants to save face, they can simply say, "Because we take security seriously, the disk was encrypted, so it is unlikely your data was actually accessed." Customers know, company saves some face. Problem solved.

Re:Encrypt the disks.

[swillden]

I didn't think any excryption was perfect.

Well, not unless the key is as long as they data. If it is, then you can prove that the encryption is perfect.

In practice, though, the imperfect crypto that we have is damned good, and if you do encrypt you disks with something decent you can quite safely assume that no one who grabs the disks can read the data, as long as they don't have the resources of a major world government available to them (and maybe even if they do). If you're worried about whether the NSA can read your data, you'd better not be leaving disks around where they can be stolen.

Re:Encrypt the disks.

[vertinox]

If they don't report it and the encrytion is broken what recourse do those people with compromised information/identities have?

A laptop theif isn't going to spend 3 months and 10,000 distributed computers to crack your laptop. Well... Maybe... If he thinks it was really critical, but chances are he might just format the drive and sell it at pawn shop.

Re:Encrypt the disks.

[mopslik]

I didn't think any excryption was perfect. So what happens if they do encrypt the disk and the drive gets stolen.

Let me get this straight. There are two scenarios: leaving the disk unencrypted, and encrypting it. Under scenario 1, if the laptop is stolen, the thieves have free access to all the info on the hard drive. Under scenario 2, the thieves have potential access to all of the info on the hard drive, but only if they break the encryption.

Are you arguing that scenario 2 is no better than scenario 1?

If they don't report it and the encrytion is broken what recourse do those people with compromised information/identities have?

I'd say that has more to do with the company's actions (not reporting the theft) than the encryption itself. Under scenario 2, the company should still be liable, but they can come back and say "hey, at least we tried to put some basic security measures in place."

Re:Encrypt the disks.

[Anonymous Coward]

Done

Re:Encrypt the disks.

[Skjellifetti]

Specifically Wisconsin Act 138 does not mention encryption as a way to preclude disclosure. Basically Wisconsin's law states if someone unauthorized has a clients data, you must tell the client about it.

If the data is on an encrypted disk, does the thief really have the data if they steal the encrypted disk?

Re:Encrypt the disks.

[hazem]

If the data is on an encrypted disk, does the thief really have the data if they steal the encrypted disk?

Yes. Because the thief may be able to decrypt the data because they also copied down the password/key that was on a post-it note hidden under the keyboard of the computer. Or they might exploit a flaw in the encryption. Or they manage to socially-engineer access to the key needed to decrypt the data. Or they might have installed a key-logger to get the key and then came back a week later to get the drives too.

Re:Encrypt the disks.

[shawn(at)fsu]

I think you missed the a 3rd scenario.

Do not store sensitive data on a laptop.

Re:Encrypt the disks.

[nsciphysics]

Recall the trick used in Neil Stephenson's Cryptonomicon: Wrap several coils of wire around the doors and windows, and during the evening run several amps through them. Anybody stealing a hard drive will be left with a paperweight. Just remember to turn it off during the daytime ;)

Re:Encrypt the disks.

[krakelohm]

If it is someone else with my data... As close to perfect as possible.

Re:Encrypt the disks.

[hackstraw]

It's not perfect. Nothing is perfect. How close to perfect do you have to get to be good enough?

Keeping all of the files on a networked filesystem via an encrypted channel that is backed up, redundant and secure.

Who in their right mind keeps important files on a laptop? Especially if those files are valuable to those outside of the organization that owns the laptop.

Re:Encrypt the disks.

[sgent]

Not an option.

I don't know what world you live in, but people need access to sensitive data on their laptops -- espcially if they are in an area that doesn't have internet / communications availability.

You can take precautions such as encrypting the disk -- but many people can't do their jobs without access to that information.

Before computers, people often put files in their cars, or carried pen / pencil notebooks. The requirements to have that information available away from the office haven't changed.

Re:Encrypt the disks.

[Dare nMc]

> Research Whole Disk Encryption.
Doesn't seam like that would be a solution for the server drives stolen for this article.
    You either have to key in a password on any power-up, or have some device authorizing on boot. guess if your running multiple distant site redunency you could have it retrive the password across the network somehow, so it's authentication could be pulled if you lost just one server...

For valuable data, it seams like physical security of something that does the unlocking will need to occur no matter what. be it multiple people, or multiple computers... because encrypting the data on the server is going to either have the unlock passwords hard coded somewhere, or have everyone who accesses the data having memorized passwords that essentually unlock the servers data.

Re:Encrypt the disks.

[Kadin2048]

chances are he might just format the drive and sell it at pawn shop.

In many cases true, but if you had sensitive (we're talking geopolitically sensitive, not credit-card and Social Security numbers sensitive) then such an assumption might be unwarranted and a very bad idea. Certainly it's not a chance that I want people taking if I was in a position of responsibility.

Re:Encrypt the disks.

[HUADPE]

The laptop in question contained data on the US military, including senior officers (Joint Chiefs of Staff et. al.). A random thief wouldn't bother cracking it. Iran would.

Re:Encrypt the disks.

[networkBoy]

Then you have to assume that it was not a petty theft either.

Your common grab and run theif will still simply format the drive and pawn the computer.
-nB

Re:Encrypt the disks.

[Kadin2048]

Unfortunately, I don't think that trick would work so well. At least, not very practically. You'd need to be putting some significant current through those wires in order to reliably degauss a hard drive (remember, those hard drives are usually in ferrous-metal cases). I've never done the math, but I have a feeling it might make your doorframes into serious electromagnets. The thieves might catch on when all of their tools get ripped out of their pockets and stick to the doorjambs as they brush past it.

Now, doing something like that to keep someone from taking magnetic tapes out of a room, that might be more practical: backup tapes are usually in plastic or other nonferrous containers, and I think the energy required to degauss them would be less.

However, the thinking that's at work here: namely it's better to destroy something than to let it be stolen, I think lends itself to a variety of other self destruct systems. Personally, I'd like to see a system -- not running on the host machine's OS (so, in a separate microcontroller, with it's own EPROMs) -- that "phoned home" to a central site every once in a while via telephone or TCP/IP, and could receive a "kill code" for a particular machine if it was stolen. The kill code could be programmed to do any number of things, from reformatting the disks to igniting a thermite charge to shorting the battery in such a way that it would explode. (How about all three, in that order?) I could think of lots of neat nasty tricks to do with that.

Re:Encrypt the disks.

[Anonymous Coward]

In order to "not store sensitive data" on a laptop, you must not view sensitive data on the laptop. As soon as sensitive data is viewed in any form, it may be written to disk by the virtual memory manager, which does not encrypt paged memory for obvious performance reasons.

Re:Encrypt the disks.

[Minwee]

"As soon as sensitive data is viewed in any form, it may be written to disk by the virtual memory manager, which does not encrypt paged memory for obvious performance reasons."

No, I'm pretty sure that you _can_ run OpenBSD on a laptop.

Re:Encrypt the disks.

[Beryllium Sphere(tm)]

>How close to perfect do you have to get to be good enough?

XOR the data with itself. Since the key is the same length as the data, cryptanalytic attacks don't apply. Anyone who doesn't have the data, by definition, doesn't have the key. The ciphertext contains no clues to the plaintext and, in contrast to most crypto systems, is highly compressible. An additional convenience is that you can generate the ciphertext from one of the standard special devices without even needing the plaintext.

Some might argue that this is a lossy process, but you can always XOR the ciphertext with the key and get back your original data.

Pretty perfect, huh?

(yes of course I'm kidding)

Re:Encrypt the disks.

[Beryllium Sphere(tm)]

or the secret key was protected by a passphrase like "cookie" or "sesame", or because the crypto software left a temp file around with the plaintext in it.

Re:Encrypt the disks.

[Anonymous Coward]

All of those things are possible even if they don't physically steal the disk but can access the encrypted file in any way at all (e.g. breaking through a firewall). So logically, all companies with sensitive customer data should immediately notify their customers that their data has been stolen.

Re:Encrypt the disks.

[cmacb]

"I don't know what world you live in, but people need access to sensitive data on their laptops -- espcially if they are in an area that doesn't have internet / communications availability.

You can take precautions such as encrypting the disk -- but many people can't do their jobs without access to that information.

Before computers, people often put files in their cars, or carried pen / pencil notebooks. The requirements to have that information available away from the office haven't changed."

I know what world you live it. It is the world of video games and powerpoint presentations with cute little pie charts.

In the 60s (the 40s and 50s were before my time) we got access to sensitive data by going to the office, passing an armed guard, signing in and sometimes using several keys or typing in combinations to get into certain rooms. Yes, you could take notebooks (paper ones) and pens and pencils with you in your car. You might also take a printout or so with sensitive data from one place to another, but that was pretty rare. There were telecommunications back then and you could even get to your data over those links, which were a lot more secure than todays WiFi and dial-up.

What changed is that computers became toys, and many of the people using them now know nothing about the underlying technology other than it's easier than using an adding machine. Ninety nine percent of the problem is that the boobs entrusted with these toys didn't take even common sense precautions with the physical security of the devices. Given the mindset of such people, there is zero hope that they would know enough to take the proper electronic precautions.

I maintain that if the data is REALLY important, and that includes all the examples given above, the the proper way to use a laptop is as a dumb terminal with a highly encrypted communications link back to the actual data. Such a link can happen over the Internet, or via a satellite link. There is really no excuse for carrying such data around, in the past, now, or in the future.

Re:Encrypt the disks.

[rkcallaghan]

I realize you're joking, but do you even know what XOR is? Just how exactly do I perform an exclusive or conditional on data to get any results resembling cryptography in even the most distant ROT-13 sense?

~Rebecca

Re:Encrypt the disks.

[Anonymous Coward]

Yes, that's the joke. If you XOR the data with itself you get a stream of 0s. Hence, the poster mentioning the compressability of the result.

Re:Encrypt the disks.

[rkcallaghan]

Haha, cute. Okay, I get it now. It seemed so silly to me I thought it was another 'Slashd0t d00d' trying to throw in something at random.

Re:Encrypt the disks.

[swillden]

A laptop theif isn't going to spend 3 months and 10,000 distributed computers to crack your laptop.

If three months and 10,000 computers is enough to break the encryption, you should have used better encryption. It's easily available.

Re:Encrypt the disks.

[shawn(at)fsu]

TY. It's nice to see that someone sees things like I do.

Re:Encrypt the disks.

[sgent]

Maybe in your industry -- but doctor's have carried patient charts home, to and from hospitals, etc., forever. My father used to have a milk crate full of active patient charts in his car trunk.

There is no network in most nursing homes, and most hospitals won't allow their doctor's (or any staff) direct access to the internet and the ability to run something like TightVNC & SSH. A physician who downloads their currently hospitalized / nursing home bound patient charts to their laptop has no other way to do it -- other than printing it all out and carrying it by hand. I would also argue that its safer to do it this way than to open a port onto the internet with a physicians entire patient database.

HD encryption and good password protection is essential -- but to be honest I've seen more private health information leaked by social engineering attacks or database administrator's not following rules than I have from stolen laptops.

I bring up this industry because I'm most familiar with it -- but could see it applicable in others too (insurance adjuster in New Orleans comes to mind).

Re:Encrypt the disks.

[Bob_Robertson]

"chances are he might just format the drive and sell it at pawn shop."

Exactly. Thieves are usually looking for fast money. If the data is easy to get, they get it. If it's not, then they aren't going to waste their time and maybe expose themselves as the thieves when they can hock a quick bit of change and move on to the next target of opportunity.

There are several dissertations easily found through Google about making boot media (such as a USB memory stick) with a really good key for the disk drive itself, which itself is unlocked using an easier to remember pass phrase by the user during the boot process. Someone grabs just the laptop, and not the users USB thumb drive, they have a very difficult time ahead of them.

Re:Encrypt the disks.

[charlesnw]

Yeah. 10k systems is the average size of a botnet. It would be simple to command 10 times that many systems for a fairly small sum. If the data you have stolen is worth a lot (nuclear launch codes etc) then there are many many people who are willing to either: 1. Hire hackers to create a botnet. 2. Buy/steal a botnet. 3. Purchase 10,000 systems and secure them to do the hacking.

Re:Encrypt the disks.

[dascandy]

My mind goes blank just thinking of it...

Re:Encrypt the disks.

[Fred_A]

Frankly, there's a very simple solution to laptop theft and I'm really suprised nobody does it : diskless laptops.

There, problem solved.

Re:Encrypt the disks.

[swillden]

Yeah. 10k systems is the average size of a botnet.

And crypto that can be cracked in 3 months by 10k systems is horrendously weak. Single DES wouldn't fall that fast (though it can be brute-forced faster with special-purpose hardware).

Re:Encrypt the disks.

[yuna49]

Over the past few months, I've seen half a dozen stories about stolen laptops. In most of these cases, the laptops had thousands of individuals' data records on them, usually including SSNs. I can't see any possible rationale for someone to be walking around with that much confidential information on a laptop. In general, these breaches arise when senior management is unwilling to put customers' privacy ahead of their employees' convenience. How happy would you be to know your insurer, accountant, etc. is out there walking around with your personal health data or tax returns on a laptop hard drive with no encryption?

especially if they are in an area that doesn't have internet / communications availability

Um, I doubt there are many places that don't have a telephone. People can use modems to connect to the main office, you know.

Re:Encrypt the disks.

[Bing Tsher E]

Who in their right mind keeps important files on a laptop?

Really stupid people. An example would be the typical HR Representative for a company. You know, the woman who sends an email to everybody in the company by writing it with Word and dragging the Word .doc file into an email as an attachment.

There have been numerous instances in the last year of laptops from cretins like this being stolen that had the social security numbers of thousands of employees on them.

Said stupid people, and the kind of management who brings them 'on board,' need to be sued into poverty; they won't be able to do the same social damage when living in a $70 a week rooming house.

Re:Encrypt the disks.

[Bing Tsher E]

A displayless laptop, or one with no i/o in it at all, would be equally useful and almost as secure.

Re:Encrypt the disks.

[Bing Tsher E]

I could think of lots of neat nasty tricks to do with that.

So could thousands of malicious but not 'criminal' (in a monetary sense) crackers. The idea of being able to remotely thermite-explode a data center has a certain appeal, ya know. (Preferably when the data center is chock full of people who consider Windows appropriate to run on Servers.)

Re:Encrypt the disks.

[Anonymous Coward]

If the data is on an encrypted disk, does the thief really have the data if they steal the encrypted disk?

Yes. Because the thief may be able to decrypt the data because they also copied down the password/key that was on a post-it note hidden under the keyboard of the computer. Or they might exploit a flaw in the encryption. Or they manage to socially-engineer access to the key needed to decrypt the data. Or they might have installed a key-logger to get the key and then came back a week later to get the drives too. Or the password for the laptop may be written in permanent marker on the bottom of it (seen that). The thief may have a person on the inside helping him steal hardware (and thus passwords or other stuff). The machine may be powered on at the time of the theft and may be accessed before the session is closed depending on the nature of the encryption used.

I've worked a few places that had terrible security ideas. One wrote the passwords on the underside of the laptop in permanent marker, one used the internal serial number of the device (also on the underside of the machine) as the password. Another issued system passwords as the persons last name & first initial and most of these were never changed. I also worked another place where the IT dept was complicit in stealing quite a bit of hardware - just marking whatever they wanted defective and issuing a new one. Quite a few of those machines were picked up from the dumpster later.

Even using a dongle or a USB key isn't foolproof. A lot of users get issued nice carrying cass for the laptops and store the USB key or dongle there.

Re:Encrypt the disks.

[Anonymous Coward]

FBI has been notified of this threat of violence and are now investigating by serving Slashdot with a subpoena for the IP address of this loser. Then the trail leads to your ISP. Expect a knock on your door around Wednesday, shithead.

Re:Encrypt the disks.

[Kadin2048]

Preferably when the data center is chock full of people who consider Windows appropriate to run on Servers.

You say this like it's some sort of bad thing?

(Kidding, kidding...)

Handling Corporate Laptop Theft Gracefully

[suso]

Tip 1: When you make your get away, float above the carpet like a feather caught in the wind.
Tip 2: If you encounter security or other obstacles, aim for the biscuits.
Tip 3: Make sure you check the laptop for any homing devices that will help them track you down.
Tip 4: The password is usually the username with 123 at the end or the their children's ages.
Tip 5: Get the evidence out of your hands as quickly as possible to beat the feds.
Tip 6: Relax and enjoy reading the next day's headlines on Slashdot about stolen private information.

Re:Handling Corporate Laptop Theft Gracefully

[Not_Wiggins]

and of course...

Tip 7: Profit!

Re:Handling Corporate Laptop Theft Gracefully

[Hobbes897]

I think somebody's done this before. You people and your sequential processing.

Re:Handling Corporate Laptop Theft Gracefully

[JourneyExpertApe]

Tip 7: Don't let your enjoyment of reading the headlines move you to post about how you stole the laptops on Slashdot. ;)

Wrong, wrong, wrong...

[WebfishUK]

I think we all know that the real question here is, in a straight, clean fight, who wins, Airwolf or Bluethunder?. Now I know what your thinking? What chance does stright to video star Jan-Michael Vincent have against HAL chess playing, shark killing, SeaQuest DSV commanding Roy Scheider? Well to you I say, don't forget that Airwolf co-pilot was none other than Poseidon surviving, Gattaca acting, SpongeBob SquarePants Mermaid Man (I shit you not) Ernest Borgnine. Yeah people. Not so easy now is it?

Re:Wrong, wrong, wrong...

[iogan]

maybe a little OT, but Airwolf, hands down.

Re:Wrong, wrong, wrong...

[OctoberSky]

I have read your reply 4 times and still have no idea what this has to do with the topic at hand.

Mr. Webfish, what you've just said is one of the most insanely idiotic things I have ever heard. At no point in your rambling, incoherent response were you even close to anything that could be considered a rational thought. Everyone in this room is now dumber for having listened to it. I award you no points, and may God have mercy on your soul.

Re:Wrong, wrong, wrong...

[Anonymous Coward]

AirWolf. Their copter looked cooler.

Re:Wrong, wrong, wrong...

[gaijincory]

Bluethunder, if only for Malcolm McDowell. Feed the trolls.

Re:Wrong, wrong, wrong...

[zakezuke]

I think we all know that the real question here is, in a straight, clean fight, who wins, Airwolf or Bluethunder?.

Remember kids

Red Dawn + Bluethunder = Purple Rain

Blame Teh Terrerists

[Anonymous Coward]

Just claim that Osama himself came out of the sewer pipes and swiped your computer. Then demand that the government do something to protect the helpless citizens. That should earn you some brownie points from the government at least, and if they say they you're right, anyone who argues might just find themselves taking a nice long vacation to cuba.

Re:Encrypt the disks. OR don't use laptops

[cinnamoninja]

Sure, encryption would help.

But, first I have to ask: why on earth is this data on a laptop?

I mean, really! This is health-care data for top military officials! Who needs to take that data on the road with them? Encrypt, stick it in a secure database, on a server in some closet in HQ. At least make it take effort to get at, no?

Handling Secure Data Loss Gracefully

[digitaldc]

Resign with thank you cards, smiles all around and a wonderfully inspiring anecdote about how much you had accomplished in your career up until that day.

Re:Handling Secure Data Loss Gracefully

[Anonymous Coward]

Write two letters...

Handled Pretty Well

[Wannabe Code Monkey]

I actually listened to this story last night on the way home (or the day before, can't remember). Anyway, at first I was shocked when I heard the intro, they lost all this sensitive data, did some stuff and then won a PR award. If the actions they took were so great shouldn't they have won some sort of privacy award. Winning a public relations award makes it sound like you did a great job covering it up. But actually listening to the story I found that they really did handle it in a great way for their customers.

Re:Handled Pretty Well

[daigu]

The classic example of great PR is J&J's handling of the Tylenol poisonings. It was all about taking a public relations problem and handling it so people understood there was nothing to fear. Good PR is simply good communications about what you are doing and why. Covering things up is bad PR, and if you get caught - which you eventually will - the situation becomes infinitely worse.

Re:Handled Pretty Well

[Bing Tsher E]

Actually, good PR is using copious amounts of KY Jelly, or the equivalent for the form of screwing the public you are engaging in.

Would you want the HR scum at your work location to be the one who gets accolades at a national convention of HR scum?? Likewise, the public should not appreciate 'good PR' types. In many instances they should incarcerate them.

Whole Disk Encryption vs. File/Directory

[MandoSKippy]

So I am researching encryption for this very reason (laptop encryption) anyone have any links or insights into why anyone would choose file/directory encryption? I am heavily leaning towards whole disk, mainly because how can you be sure you get everything. (i.e. temp files, pagefiles, hibernation files) I have seen some items regarding "inteligent encryption" but I just can't see how any program can "know" what to encrypt and what not to without tons of administrative overhead. That's why I like whole disk. Just do it all. Any thoughts?

Re:Whole Disk Encryption vs. File/Directory

[Foolicious]

Generally, disk encryption is great if a machine is stolen; however, it doesn't offer you any benefits should the machine be compromised following login of the encyption product (generally at boot). Some products have timeout modes kind of like a screensaver where it forces a login to the encrpytion package following a period of inactivity, but basically disk encryption isn't a safe bet for complete safety. For instance, it can do nothing if someone remotes in to the machine or a "rogue" employee accesses the machine after login. This is where content encryption offers benefits. Disk encryption alone is just a hassle for the user (in terms of an extra password to remember) in order to placate suits who want the company's rear end covered, but don't want to spend the money and resources (which can be substantial) on a complete package that would handle both disk and content encryption. Just my 2 cents.

Re:Whole Disk Encryption vs. File/Directory

[lukas84]

EFS is your Friend and can be configured by group policies.

Re:Whole Disk Encryption vs. File/Directory

[dgatwood]

My Mac OS X laptop is set to require a password to wake it from screen saver or sleep. I make it a point to never leave it without sliding the cursor to a hot corner to start the screen saver (or sleep it if it isn't doing anything in the background and I'm not coming right back). That coupled with disk encryption would be a pretty hard thing to defeat.

Short of that, storing important information on encrypted disk images goes a long way towards solving the problem, though.

Re:Whole Disk Encryption vs. File/Directory

[networkBoy]

But that is user habits, just like my ctl-alt-del when I leave my windows notebook for any length of time. Most users do not do this (and it sacres me).
I use disk encryption on my notebook through IBM's TPM setup, and then I run container encryption on-disk for two reasons. First reason: I have top-security documents on my machine. They are encrypted, and I must access a server to obtain a decryption key every time I want to view them. The encryption is by authentica. I do not trust this encryption, thus I store the files in a true-crypt container. A seperate true-crypt container is used to store my personal information, saved web-pages, personal projects, my website backup, etc. This is because I also do not trust my employer. The notebook is theirs, but not all the data is.

As to the pagefile, that is set to 0 and I have 2 gigs of RAM to cover system requirements.
-nB

Re:Whole Disk Encryption vs. File/Directory

[Anonymous Coward]

Try truecrypt... it allows full disk or the creation of a psudo disk that mounts as a drive. It's open source, you can use virually any encryption you like... and it's compatible with windows, linux and I believe mac.

I use the same encrypted fat volume in both linux and windows, where I store a password file that is also encrypted with a different passcode.

It also has the ability to hide an encrypted volume within an encrypted volume... there is no way to know it's there as it appears as random data in the free space of the volume. Great protection against physical attacks on your security. Just put a few pieces of confidential information in the container volume, and your most precious data in the hidden one. If someone makes you reveal your password, they will see the data in the container volume without compromising the data in the hidden volume.

Best of all.. it is VERY easy to use... almost too easy... sometimes I wonder if it's just telling me it's encrypted ;-)

Re:Whole Disk Encryption vs. File/Directory

[Kaenneth]

Do both.

Re:Whole Disk Encryption vs. File/Directory

[woolio]

This is because I also do not trust my employer. The notebook is theirs, but not all the data is.

Would your life be a lot simpler if you stored only company data on the company laptop and non-company data on a non-company laptop/storage device???

Re:Whole Disk Encryption vs. File/Directory

[Zemran]

If you log in to the encryption system after the OS is running you leave a copy of your password in the swap file.

Re:Whole Disk Encryption vs. File/Directory

[Zemran]

EFS is very poor and offers no protection in a case like that mentioned in the story. They have the hard disk and can log in to the files as the user and see them without any restrictions.

Re:Whole Disk Encryption vs. File/Directory

[akpoff]

Not if you use an OS that encrypts the swap file.

Re:Whole Disk Encryption vs. File/Directory

[Achromatic1978]

A seperate true-crypt container is used to store my personal information, saved web-pages, personal projects, my website backup, etc. This is because I also do not trust my employer. The notebook is theirs, but not all the data is.

Why do I think that if your work is as confidential as you say it was, and you're going to the obvious effort to ensure its sanctity as best you possibly can, that there would not be a clause somewhere that mentioned your use of company resources for personal purposes, and that I'm fairly sure running personal site backups, freelance projects off a system used to handle said obviously sensitive data would be in fairly blatant breach thereof?

Re:Whole Disk Encryption vs. File/Directory

[midnighttoadstool]

I reckon you don't know what you are talking about. EFS has big limitations and has to be used carefully (knowledgeably) to have any value. But that doesn't make it poor.

However what is poor, in my opinion, is Microsoft's documentation of EFS, and as a result it is effectively unusable.

Re:Whole Disk Encryption vs. File/Directory

[Fred_A]

Well my laptop holds a small nuke that is set to explode at midnight if I haven't logged in the previous day.

Beat that. Hah !

Re:Whole Disk Encryption vs. File/Directory

[Bing Tsher E]

Where I work, I used to have the screen-saver/lock on my desktop PC configured to go to a password protected lock screen after five minutes.

The Corporate Level IT goons recently implemented a new 'security' policy (because of other dolts who had NOT protection, one assumes) which disabled the screensaver tab through domain-level controls, and implemented a 30 minute lockout company-wide. I can no longer set the timeout period to 5 minutes.

I emailed the IT goon to mention to them that they had just undermined the security on my desktop machine. I didn't get a reply. Oh well. They're running Windows servers. Really there's no hope.

Re:Whole Disk Encryption vs. File/Directory

[Bing Tsher E]

The data is then secured by virtue of the fact that you're running an OS for which there are none of the applications which your company uses to create, view, and modify it's data files.

In other words, you have a nice XMahjongg platform, and a place to write Python/Java/C++ code. And a decent firewall platform to run data through.

(this message typed on a NetBSD desktop system, btw. Have a sense of humor, okay?)

Re:Whole Disk Encryption vs. File/Directory

[akpoff]

Hey, don't forget tetris, minesweeper and TuxRacer, er, DaemonRacer. ;-) Not to mention you can code in lisp, haskell and perl. Is there more to owning a computer than that?

Re:Whole Disk Encryption vs. File/Directory

[nazg00l]

An easy solution to that is to mount the swap partition/file on boot using encryption with a randomly-generated password. This is trivial in Linux, don't know about Windoze, though...

Re:Whole Disk Encryption vs. File/Directory

[networkBoy]

There is, in fact, a policy regarding private use of company assets. Basically as long as what I do is only step one and two and omits "3) Profit!", then I am fine. Thus I do not op the site in my sig from my notebook, but I do op: farmersreallysucks.com. That is protected speech, and allowed (on my breaks) to be operated on with company bandwith and assets. Even to that end we run an application called CNB that backs up the entire PC. There is a special folder that we can use to store personal stuff that this app ignores. I have my large encrypted volume in this folder so it is ignored. I also have a small volume that is my "little black book" and is backed up, but is only 10 megs, so it's not like it matters.

Basically I work for an employer that is sane, and understands that a genuine draconian policy will not work, it's far better to have a very clear and mildly strict policy that is enforced with teeth. Besides I also consented to have all my e-mail, http, and ftp sessions logged and/or monitored as part of my employment.
-nB

Quite impressive...

[GillBates0]

How they handled the situation earned them an award from the Public Relations Society of America.

You mean they handled the situation (and the laptop) with a single three-fingered hand? That is quite impressive.

Creepy though.

You should be thankful.

[khasim]

I didn't (couldn't) read the linked article, so I'm just going to comment on the summary.

I was not so fortunate and read comments such as this:

"When the information theft occurred against my company, we discovered that existing state and federal laws protecting consumers from identity theft had been surpassed by the individuals perpetrating the crimes, so I made 'identity theft' my fight," said McIntyre.

Okay, I believe that "When the information theft occurred against my company" can be translated into "When the data was stolen".

I don't have any idea what "existing state and federal laws protecting consumers from identity theft had been surpassed by the individuals perpetrating the crimes" means.

But it seems that "so I made 'identity theft' my fight," means "I pushed for changes in the laws".

Sooooo..... "When the data was stolen ...something... I pushed for changes in the laws".

And the FA says nothing about changes to their policy of storing personal information in an un-encrypted format. But now we have some more laws. And laws will stop people from "stealing" identities. Yes. Right.

Re:You should be thankful.

[gEvil (beta)]

Sooooo..... "When the data was stolen ...something... I pushed for changes in the laws"

'something' = 'and I learned state and federal identity theft laws were a joke'

Re:You should be thankful.

[operagost]

Meanwhile, thousands of sysadmins use auditing procedures and technology to secure their data BEFORE it gets stolen, and they don't get any awards.

Re:You should be thankful.

[TheJediGeek]

Did anyone else notice how ridiculously stupid that person was?

"When we had a bunch of sensitive data stolen, I realized there aren't very strict identity theft laws so I pushed for more annoying and lame laws"

Even though stealing computer hardware is already a crime and that didn't stop them from doing it, somehow more identity theft laws would have stopped the thieves?

OT: Moderation

[mizhi]

This post is currently moderated as "Flamebait"

WTH are /. moderators smoking?

Re:OT: Moderation

[MandoSKippy]

Agreed. The post is not 100% correct but is not flamebait.

Re:OT: Moderation

[Threni]

Perhaps you can't read the OP's sigfile?

Re:OT: Moderation

[mizhi]

Or perhaps his sig is not relevant to the discussion, which is what moderaters should be looking at?

At worst, his sig is tactless.

Re:OT: Moderation

[Threni]

> Or perhaps his sig is not relevant to the discussion, which is what moderaters
> should be looking at?

So you set the agenda for moderation now?

> At worst, his sig is tactless.

There's a limited range of options. The important part is the sign of the value, as that affects the score, and not the text alongside it.

Re:OT: Moderation

[mizhi]

So you set the agenda for moderation now?

No, I expressed an opinion. If I set the moderation agenda, I wouldn't have to say anything, would I? I'd just cancel the moderation.

There's a limited range of options. The important part is the sign of the value, as that affects the score, and not the text alongside it.

I disagree. An "Insightful" moderation and a "Funny" moderation both carry a +1. They may affect the score in the same fashion, but when I see a +5 funny post I expect to read something that makes me chuckle. When I see a +5 Insightful post, I expect something intelligent. Thus, the text alignside the numeric score is also important.

And while you are correct that /. provides a limited selection of options for categorizing a moderation, I reiterate my opinion that the moderation was overkill.

You may choose, and have chosen, to disagree.

Marketplace != NPR

[Palshife]

ARGH. This is the second time this has been done. NPR does not produce or distribute Marketplace. NPR has nothing to do with Marketplace. It's produced by American Public Media. Please get it right. You're even LINKING TO APM!

Re:Marketplace != NPR

[Anonymous Coward]

Seriously though, what else does this mean than MPR is taking over largeish swaths of NPR programming every so often?

Re:Marketplace != NPR

[MonaLisa]

I second this. NPR does not do EVERYTHING that happens on public radio.

Re:Marketplace != NPR

[NutscrapeSucks]

At least around here, the announcers tend to say things like "You are listening to National Public Radio [Callsign]. Up next is Marketplace." It is an understandable mistake.

Re:Marketplace != NPR

[Moofie]

You get upset when people say "LEGOs", don't you?

Re:Marketplace != NPR

[Palshife]

I don't get it.

Re:Marketplace != NPR

[Billosaur]

NPR does not do EVERYTHING that happens on public radio.

Perhaps not the worst faux pas I have ever made, but certainly an honest mistake. I am fully aware that NPR does not produce Marketplace, but NPR does carry the show, and I should have indicated it that way, or mentioned American Public Media. Guess I have to turn in my Guy Noir trenchcoat now.

Re:Marketplace != NPR

[Moofie]

Don't worry about it. Everybody else will.

Re:Marketplace != NPR

[Palshife]

Okay...

Re:Marketplace != NPR

[shaka999]

Can you hand me a kleenex?

Re:Marketplace != NPR

[Anonymous Coward]

Typically NPR News Programming will be scheduled adjacent to Marketplace and the "You are listening to National Public Radio" is the end of a National Public Radio program -- the closing credit. The call sign and "Up next, Marketplace" are done by the local public radio station.
Being anal about this is reserved for when it is propigated by a news outlet of which which Slashdot is one. It's similar enough to the Linux v/s GNU/Linux thing except that fewer people know or care to argue or point it out.

Re:Marketplace != NPR

[Moofie]

They're on the xerox machine.

Re:Marketplace != NPR

[Palshife]

Hmm, you should have used the Xerox example. That would have been more clear.

And hey, if you're okay with companies getting credit for things they didn't do while others fail to get any noteriety simply because people are too lazy to know how things really work, more power to ya. Seems to be the general direction of the nation these days.

NPR makes content. APM makes content. PRI makes content. Public stations pay them to broadcast that content. The distinction is important. I guess I'm the only one that feels that way considering the way I've been modded.

Re:Marketplace != NPR

[Moofie]

"Whose name appears on content production credits" has little, in my mind, to do with "how things really work".

But if that makes your naughty bits tingle, more power to ya.

Re:Marketplace != NPR

[NutscrapeSucks]

For my public radio station, you are wrong.

Re:Marketplace != NPR

[Anonymous Coward]

You should probably quit while you are ahead.

Re:Marketplace != NPR

[Kiaser Wilhelm II]

A thousand angels weep for you.

Re:Marketplace != NPR

[Anonymous Coward]

Sorry but NPR do not carry anything. They have no radio stations to carry it on for one (other than one in Berlin). NPR simply sell programming to your local affiliate and marketplace is not one of the shows they sell.

Re:Marketplace != NPR

[Palshife]

Nevermind, I was looking for a debate, not an exchange of one-liners.

Aack! Just buy a Mac already!

[Anonymous Coward]

Macs (including laptops) come with Filevault built in. If the laptop is stolen, all the data in that users folder is useless without the password. It is dirt simple to turn on, seamless, highly secure and barely noticeable when it is working.

Explosives

[Infernal Device]

All laptops with sensitive information should be equipped with a remote detonation device and 10 grams of C4.

Not to stop the criminals.

For the entertainment value ...

Re:Explosives

[MadTinfoilHatter]

...more specifically the entertainment value of being tazered, when you get caught trying to board a flight with it. ;-)

Re:Explosives

[Anonymous Coward]

All laptops with sensitive information should be equipped with a remote detonation device and 10 grams of C4.

Not to stop the criminals.

For the entertainment value ...


You laugh. But since the cops won't do much, and the insurance won't pay for any losses beyond possibly replacing the laptop (big deal) you're not the only one to have thought of it.

After having some twits break into my car to steal a cheap stereo - it might be worth $10 on the street - I have thought of buying another one and packing it with Estes rocket engines on an electronic delay timers to go off about 60 seconds after being disconnected from the battery.

Re:Explosives

[jintxo]

Yeah just make sure your battery never goes kaput, heh.

Re:Explosives

[morgan_greywolf]

...more specifically the entertainment value of being tazered, when you get caught trying to board a flight with it. ;-)

Actually, believe it or not, as scary as this sounds, it's more like if, not when.

Sure, the TSA has sensors that can check for certain high-order explosives (including RDX, aka cyclonite, the main explosive ingredient of Composition C4) but it's not whether or not the sensors detect it, it's whether or not the TSA employees bother to check.

My wife once worked as an undercover security employee -- her job was to smuggle anything through airport security, including drugs, weapons, explosives, etc. If she made it through, the screening employees got written up. And you know what? More often than not, she got the stuff through.

Re:Explosives

[duffstone]

Haha, my first thought was what a kewl freak'n job to have. Then it occured to me that they've shut down decent sized airports for toy guns and white dust let alone C4 or any other type of contraband. Imagine being an undercover agent testing the system and bringing DIA to a halt... That would suck hard core... haha... But I can see it happening easily enough. :-)

Re:Explosives

[Original Replica]

Imagine the blackmarket resale value of an Idenity theft of a "undercover security tester". Smuggle anything you want an if you get caught here is your get out of jail free card.

Re:Explosives

[easter1916]

Hey, I called that number... who's the girl? It wasn't funny. Just some number. Your ex?

Re:Explosives

[Zemran]

I used to work with certain security personel and they found it easy to get guns on planes. I am talking post 9/11. I was involved in voice recording and if our guys were going into a sensitive area they did not want to be met by security at the airport who could issue them with weapons as they may get made by the bad guys. They would secrete a couple of guns in the recording equipemnet and they never got caught. OK, it is easier to stay calm and distract the guys doing the scanning when you know you will not get arrested but it does drive a coach and horses through the security.

Re:Explosives

[toddestan]

I would rig it to go off when the radio is hooked back up to power. That way, you don't have to worry about the battery dying, plus you have a chance of damaging the nitwit's car.

Maybe this kind of information

[iminplaya]

shouldn't be stored locally on a laptop. This would include passords, etc. Put it on the company server and work it from there. Might be kind of slow, but it seems like good insurance.

BS

[jafiwam]

Bah, some corporate whore-org commends some member cuz they managed to pull the wool over everyone's eyes. That's like satan giving george bush a cookie.

From the PRSA website;

Chartered in 1947, PRSA's primary objectives are to advance the standards of the public relations profession and to provide members with professional development opportunities through continuing education programs, information exchange forums and research projects conducted on the national and local levels.

"You sure managed to make a positive spin on screwing the public and armed forces, good show chaps!"

So... like the retired officers club gives an award to the army for "blowed that up good", or maybe the United Tattoo Artists Association giving awards to Jesse James for pointing out his tats on TV.

Re:BS

[hackstraw]

That's like satan giving george bush a cookie.

Bush quit eating cookies, drinking alcohol, doing cocaine, AND taking things offered by Satan when he was "born again".

Give the guy a break!

Re:BS

[Zhe Mappel]

You're being a little hard on our truthsmythes, aren't you? Haven't you heard the good news about the PSRA's "prestigious" Silver Anvil award? (So named because it is where the truth is hammered until the clients of corporate PR can see their million-dollar reflections.) As they like to modestly note:

The Silver Anvil Awards program has grown in scope and stature since its inception in 1946, and awards are now given in 56 categories and subcategories. To date, more than 1,000 organizations have received Silver Anvils for excellence in strategic public relations planning and implementation.

As Elvis Costello once sang,

They're here to help you satisfy your desire
There's a bright future for all you professional liars

Conscientious Capitalism

[Doc Ruby]

Capitalists know that PR is cheaper than security. Never trust them.

Re:Conscientious Capitalism

[Doc Ruby]

Moderation -1
    100% Troll

I guess the PR of the Year Award comes with a free subscription to AsTrollTurf Inc.

Re:Conscientious Capitalism

[noidentity]

"Capitalists know that PR is cheaper than security. Never trust them."

And it's the public who sets the stage by valuing PR more than security. Capitalism is like a computer: it does exactly what you tell it, and you often don't realize what you're really telling it to do.

Re:Conscientious Capitalism

[Doc Ruby]

And that's why posting sensible observations on Slashdot can be as valuable as coding securely.

Re:Conscientious Capitalism

[Doc Ruby]

Moderation -1
    100% Troll

AsTrollTurf Inc is committed to consistency, if not to quality.

Re:Worst. Article. Ever.

[ZombieRoboNinja]

FYI, this story was a followup to a longer story about laptop and identity theft. The original story did indeed focus a lot on data encryption.

From the original article:
"This is Jonathan Zittrain, a co-founder of the Berkman Center for Internet and Society at Harvard Law School. He says he's not surprised that all of this information is walking around on portable computers. People want to be productive on the run, he says. But he says there are pretty sure-fire ways to protect sensitive information. Like, encrypting it, or leaving the data on the main server and remotely tunneling through the Internet to work with it."

Way to declare this the "worst article ever" in the same post you brazenly declare you didn't read it, by the way. A bold move, even by Slashdot standards.

bad headline

[Anonymous Coward]

This isn't about laptop theft, it's about how the company handled potential identity theft and loss of sensitive data. The hardware is irrelevant.

Don't know the windows side..

[Junta]

But for individual workstations/laptops with single users where there is no protection of the data from multiple users, whole disk works well (except for /boot with the kernel and an initrd with dm-crypt tools). I have / and swap encrypted and don't have to worry about theft much with respect to private data.

Individual directory/file encryption is important for multi-user workstations/servers, where you have to worry about other users getting the files when owner is not logged in. encfs and the like provide some additional protection against this, but not much meaningful. It can protect the contents of data on a fileserver from even the administrator though, as I have seen encfs used to translate data from an nfs server to a local workstation mountpoint... I believe the built in windows file encryption mechanism has similar benefit from shared fileservers.

article..

[Feyr]

/quote
If he gets his way, even possessing the kind of information that the thieves stole from his ca, and from his company, will be a crime someday /quote

so what he's saying is that if he gets his way, all the credit bureaus, banks, insurance companies, everyone doing credit checks and your own accountant will be criminals. even his company

i'm sure that will work out JUST RIGHT.

remember kids, when you make it a crime to possess credit informations, only criminals will have that data

Encryption? Priceless.

[mythosaz]

I work as the senior engineer for the desktop engineering department of a large west-coast healthcare organization with over 20,000 PCs.

Not only do we encrypt EVERY laptop, regardless of if we think it contains PHI; theft of desktop equipment has prompted us to encrypt EVERY desktop, regardless of if we think it may contain PHI. We also encrypt and monitor every PDA (including phones with sync).

The software: Millions of dollars.
Support: Millions of dollars.
Not being sued in California for losing PHI: Priceless.

Interesting theft

[Anonymous Coward]

Breaking into an office and stealing two hard drives, which contains all that data may point to a sophisticated, targeted hit, maybe using hired pros.

Re:Interesting theft

[Anonymous Coward]

Since personal data of high ranking military members is involved, it may have been staged as simple theft by foreign intelligence services. The fact that there is no obvious sign that any of the half million people's data have been misused makes this theory even more likely. If a foreign secret service was targeting access to a specific high ranking military person, such theft would be quite a standard scenario.

What's amazing in this story is that the company where this could happen is receiving an award.
A lawsuit that puts them out of business and the CEO into jail would seem to be more appropriete treatment.

Re:Interesting theft

[Anonymous Coward]

A professional would have just made a backup and left physical media. That way they would never know the data was compromised.

But speculation aside, there really isn't enough data on the robbery to jump to any conclusions. For all we know the entire IT's shop area could be gone: monitors, desktops, various other devices, but only 2 of the things stolen were worth including in the article.

Re:Encrypt the disks. OR don't use laptops

[OnlineAlias]

The drives in Tri-West's case was inside a locked building, not on a laptop.

Corporate policies needed

[MarkusQ]

There's very little you can do after the fact (though the C4 idea above was cute). The key is to do what somewhere I once worked did: make sure that there are effective corporate policies in place long before hand to make sure that laptop thieves don't profit when they get their hands on sensitive information.

For example:

• Have policies that make corrupting corporate data easy, but correcting it tedious/impossible.
• Give different departments "ownership" of different data and encourage them to distribute it to people who need it via e-mail (hand copied from the application), screen shots, or exported spreadsheets that do not correctly propagate column names.
• Encourage employees to edit the e-mails to produce versions of the data that they think are more accurate, and distribute them with names like "New (revised) revision of Q4 draft data dump--updated, with corrections by MQR for some of the errors introduced by BC in Q3"
• Have data retention policies that assure that every laptop has at least twenty such interpretations of any key data on it at any time.
• Prevent the addition of new columns to databases, and instead encourage users to reuse existing columns (Title, Address_line_2, Retirement_date, ROI_projection, Collateral_damage, NSA_contact_name etc.) that are otherwise underutilized.
• Make test data by permuting fields (and words/digits within fields) between rows of live data. Do not clearly distinguish live data from test data, to assure that some of these will end up on laptops as well.

With a few simple precautions like these, you can be sure that the bad guys may steal the laptop, and the data, but they won't have any more idea what to do with it than you do.

--MarkusQ

Crypto!

[redelm]

Laptops get stolen. It's a reality of life. The worst thing is to compromise cutomers/other's data. This can easily be prevented by using crypto for data directoris. GPG has a Windows drop-in for the clueless.

Re:Crypto!

[Zemplar]

True, PGP Co. has a product for the Windows "clueless." But doesn't better protection start by asking yourself if the "clueless" should actually be handling or otherwise be responsible for this type of data?

Re:Crypto!

[redelm]

Specialization! As computers get used more and more, the lusers _must_ get less and less clueful. The available knowledge has to be bolted in.

Re:Crypto!

[geekoid]

I think he means 'clueless' as in IT ignorant. No 'clueless' as in stupid.
I work with some very smart people, but they don't know much about computers

why is computer-theft still an issue?

[schweini]

i fail to see why computer theft is still an issue - even i implemented a relativly simple, yet, as far as i can see, 'secure enough' system for these situations:
all 'interesting' files are inside AES256 encrypted container-files wich are mounted via loop-devices.
if, for some reason, a server or machine reboots, it asks the next higher server for the password it needs to decrypt itself via an encrypted network connection. if a machine is reported as stolen, the server that has the task of sending the passwords gets advised of this, and simply wont send the corresponding password anymore. the peak of this pyramid of trusted machines is an off-site server far, far away. thus, if the hierarchy is broken (e.g. by computer theft) anywhere along the way, it's a matter of seconds to render all information contained on the stolen machine completly useless.
if i came up with this, surely the admins of REALLY important data can?

Re:why is computer-theft still an issue?

[Anonymous Coward]

No they can't and the universe may not be infinite.

Re:why is computer-theft still an issue?

[Anonymous Coward]

if i came up with this, surely the admins of REALLY important data can?

Well, it is hard to imagine that they could come up with anything more stupid and lacking in technical merit.

Re:why is computer-theft still an issue?

[Dr.Ruud]

if a machine is reported as stolen, the server that has the task of sending the passwords gets advised of this, and simply wont send the corresponding password anymore.

How about the time between the actual stealing and the moment it is reported? Could be several days.

Re:why is computer-theft still an issue?

[gr8dude]

But what if the server which sends out the keys also checks the origin of the request (if it comes from a different address - the request is discarded, logged, and authorities are announced).

Of course, identity spoofing is possible, but if the initial design implies that all requests are made via SSH or some other secure channel, then it will be more complicated to try to request the decryption key.

And another detail - the server could be configured in such a way that if there's a timeout of X minutes (assuming that the machines keep the session alive, or notify the server when they go offline), the future requests will not be processed until an authorized person notifies the administration, or something of that sort. In other words - if somebody fails to contact the server admin in time, it is automatically assumed that a problem occurred.

Re:Worst. Article. Ever.

[coaxeus]

Yeah, trying to read tfa (or whatever it is) was one of the more difficult things I've tried to do recently. I could have listened to the STREAMING AUDIO, but that shit is annoying.

Re:Aack! Just buy a Mac already!

[wyip]

Windows 2000 and XP Pro are able to encrypt files and folders out of the box. You could just encrypt your profile in 'Documents and Settings' for essentially the same effect as Filevault on Mac. Setup the Administrator account as a Data Recovery Agent for the same effect as the File Vault master password. This is what we're doing for the Windows users in our department who won't or can't switch to Mac. (We're actually using this as a temporary solution while we look at PGP)

Not NPR

[Anonymous Coward]

Marketplace is distributed by American Public Media and I think it's produced by Wisconsin Public Radio (maybe a different state), but it is not and National Public Radio joint.

Hmmm

[Anonymous Coward]

1. Have laptop containing sensitive data stolen
2. Lobby for legislation which thieves will not read
3. Win award for being incompetent
4. ???
5. Profit!

What about external HDs?

[$t0mp]

I am curious whether anyone else out there does what my company does. The company I work for has always been paranoid about laptop theft. To address this concern they have taken the following approach:

- All laptop users are issued a external hard drive 80-160GB that is encrypted
- The built-in laptop hard drive is partioned into 2 parts. One part stores the OS and all program files, the second part is used for swap space (virtual memory and temp files)
- Laptop users are instructed to store *ALL* data on the external drives as well as to always secure the drive (via removing it and locking in a drawer, or carrying it with them when leaving the laptop).

The general consensus is that the primary target is the laptop. If it is lost then there is no exposure because no data is stored on it. The existence of data in temporary files is minimized by using the single partition which is constantly re-writing to itself.

Given that these external hard-drives are alot easier to pick-up and walk away with, we still feel that we are more secure. We often find the laptops unattended, but rarely, due to training, do we find an unattended hard-drive.

$t0mp 0ut

Re:What about external HDs?

[mythosaz]

Great idea! ...except for the fact that it's overly complicated and relies on end-user cooperation. There are a number of at-boot hard drive encryption suites that are (a) cheaper than external drives, (b) don't rely on end-user participation and cooperation, and (c) address the fact that your swap and cache information may be full of useful data, and you leave it unencrypted.

Re:What about external HDs?

[suwain_2]

Given that these external hard-drives are alot easier to pick-up and walk away with

Isn't that exactly why the external hard-drives are more prone ot being stolen?

but rarely, due to training, do we find an unattended hard-drive

If your training works, why not just train them not to leave laptops unattended?

Your post raises another interesting point, though: what if people use internal hard drives, encrypted, but a user brings in their own external drive? That seems like a potential security flaw waiting to happen.

Insightful? Interesting?

[Anonymous Coward]

In your rush to say something trite, I think you missed the grandparent's point.

Encrypting the disks may be 'good enough' to protect the company from liability for the lost data (assuming the company was not negligent in other regards). However, since encryption is not perfect, customers should still be informed of the loss, because the company will not be able to say with certainty that the data was not accessed.

Why store data on latop at all?

[HumanCarbonUnit]

How about this, instead of putting data on the laptop putting it at risk of theft don't store sensitive data on the laptop at all. Use a VPN or SSH tunnel and have the laptop access a remote server to get access to the information. You can even (and should) have the VPN / SSH server on a seporate server from where the data is located.

To futher secure it, you can setup a static route that says all remote login traffic cant access any other machine on the network except the database server. This way if the laptop is stolen, only the laptop is stolen and the data is safe. If the login server is broken into, there aren't allot of other places on the internal network the attacker can go to, provided of course you can detect / eliminate the threat before the attacker also gains access to the database server.

Well, thats my 2 cents on the topic: BTW: this is only theory, actual implementation would be more complex and thought out.

Re:Why store data on latop at all?

[sgent]

Your assuming an internet connection -- try again.

Re:Why store data on latop at all?

[Zemran]

Why not take it further and have 5 locations using VPN and set the physically seperate location up like RAID 5 so no location actually has the data. If any hard drive gets stolen it has a maximum of every 4th chunk of data (4 chunks and a check chunk = 5 locations). A thief would need to break into all locations at the same time to get the data. If one location is broken into the data can still be recovered using the check chunks but the thief cannot recover any data. Encryption can easily be broken but a thief cannot see what he does not have.

Re:Why store data on latop at all?

[nzhavok]

Why not take it further and have 5 locations using VPN and set the physically seperate location up like RAID 5 so no location actually has the data.

Well there has to be some place to assemble the data again, unless it is in log term storage.

The security here depends on the motives of the thief, if the prize is a laptop to pawn then encryption is probably a big enough deterrent to stop them getting at the data. The laptop will be formatted and pawned/ebayed.

If data is the prize of the theif, then they will probably move to attack a weaker point in the system (e.g. in your example the system which assembles the data). I think in current corporate environments it can be difficult to stop a determined data theif, however encrypting the laptops will stop a lot of oppertunistic data theft (and not much more).

Re:Why store data on latop at all?

[gr8dude]

This would require fantabulous network speeds, otherwise we're bound to watching slide-shows (or 'please wait' screens) for the rest of our lives.

Foreign Intelligence Operation?

[CodeBuster]

There is one other possibility that has not been considered and that is that the break-in was organized by a foreign intelligence agency in an apparently successful operation to capture records relating to United States military personnel. If this is true then it ups the ante significantly because foreign intelligence agencies have the resources and expertise to organize these types of raids despite the best private security and especially if the operatives are willing to kill for the information. They could have infiltrated across the Mexican border, where security is sorely lacking, and gone anywhere in the US without attracting much attention. Most corporations do not employ the types of security measures that the military does and so they would probably be caught off guard by a commando style raid in the middle of the night. The night watchmen doesn't get paid enough to be killed over a couple of hard drives and all he saw were men in balaclavas before he was knocked over the head with the butt of an mp5 and tied up...you get the idea. This may have been a professional job.

Re:Foreign Intelligence Operation?

[joto]

Most corporations do not employ the types of security measures that the military does and so they would probably be caught off guard by a commando style raid in the middle of the night. The night watchmen doesn't get paid enough to be killed over a couple of hard drives and all he saw were men in balaclavas before he was knocked over the head with the butt of an mp5 and tied up...you get the idea. This may have been a professional job.

What you just described would not have been a professional job. A professional job would have been one where everything looked like a common burglary. The burglars would steal some laptops and other expensive equipment, the coins from the soda machine, the cell-phone Jones forgot in office 304, and whatever seemed to be of any value.

It would be even better if the laptops somehow turned up later, when some honest person who bought them from ebay noticed the contents of the harddrives and informed the police. Maybe this would even lead to some arrests, and a false belief that the data would not have been copied..

Of course, by then, copies of the harddrives would have been in the hands of the enemy for months.

On the other hand; if you send in your elite soldiers at night to disable or kill the night-guards, and steal exactly two harddrives when there are lots of other valuables lying around, everybody will know exactly what happened.

Re:Foreign Intelligence Operation?

[dbcad7]

Nah, a "professional" would have just duplicated the drive. That way no investigation if any kind would be necessary, since nothing was missing. They do it all the time on Alias, they even do it wirelessly with a lipstick gadget.

Re:Foreign Intelligence Operation?

[joto]

In that case, a 1331 h4x0r could just use a spy satellite to log on to the laptop without getting traced, and retrieve the records he wanted, without ever having access to fancy lipstick gadgets. I'm not sure what he would need the spy satelite for, but it sounds a lot more advanced than just connecting over teh Intarweb.

Re:Foreign Intelligence Operation?

[minorproblem]

They haxored my laptop while it was turned off with the battery removed in my backpack!!!11one

Laptop theft? No problemo

[Anonymous Coward]

I handle the possibility of laptop theft by encrypting my /home partition with dm_crypt, and backing up the laptop nightly. If the laptop is stolen, the thieves won't know my passphrase and so they can't get any personal data.

Although the loss of the physical assets would be a nuisance, the laptop itself isn't worth much (under $500) and so I'd just replace it and maybe see if my insurance will pay for it.

Dell Ownership Tag

[ScottCooperDotNet]

I'm suprised my company doesn't take advantage of Dell's Ownership Tag (there is an Asset Tag as well) to put the company name on the POST screen. It won't stop systems from being stolen for the data, but it will stop those looking to resell the hardware.

Compaq and I would assume the other major companies have this as well.

Re:Aack! Just buy a Mac already!

[geekoid]

How does encrypting the data work?
Meaning, everytine I wnat to look at a file I need to enter a key?
when I transfer a doc off my computer onto a network, is it encrypted on the network?

Re:Encryption? Priceless.

[BagOBones]

What software are you using?

Re:Aack! Just buy a Mac already!

[wyip]

The encryption on Windows 2k/XP is tied to the user's login. Once you log in you have access to your files, like on Mac with FileVault. If you copy your document onto another storage device - one of two things will happen: if the destination is using NTFS, your file will still be encrypted. Otherwise, it will lose the encryption. Compare to FileVault, where if you copy a file anywhere outside of your encrypted home directory, it will no longer be encrypted.

Encrypt the disks-Trusted Computing.

[Anonymous Coward]

Trusted computing would take care of this situation by taking passwords away from users.

Re:Aack! Just buy a Mac already!

[SnotBob]

The only problem is if your administrator account has master access, then all I have to do is boot your computer off a Linux CD with that cute little Windows Admin password changer and change the Administrator password to get in.

visible security as PR?

[speculatrix]

visible security as PR?

consider Israeli airlines... when was the last time they got hijacked or blown up? The Israelis take security very seriously, and a lot of it is not visible at the airport, it's behind the scenes... such as depressurizing baggage, well trained plain-clothes security on board... it costs a lot of money, much more than a few smartly dressed low-pay security guards at a screening desk.

contrast this with other airlines - it's all about making people feel confident.

similar, corporate employee welfare, security, customer service - it's about perception not reality - the winners are those who make people *think* they are being treated well as an employee, making customer's feel valued & safe.

Re:visible security as PR?

[Doc Ruby]

The Israeli security you mention is real security, not just handwaving PR. They are winners. The empty American "security" gestures you describe, from airlines to marketing, simulates security ("simcurity"). It's a loser.

As usual, the best practice is real security, with tasteful promotion that people can trust as much as the security itself.

[OT]Ignore this post

[Neoncow]

I second this request, if only to serve as a reminder to myself.

Re:Aack! Just buy a Mac already!

[wyip]

We tested that. That breaks the encryption and access will be denied to encrypted files.

Cops and Stolen Laptops

[billstewart]

I had a laptop stolen one Friday night in San Francisco. A couple of hours later, the cops picked up the thief for other reasons, and since he didn't look like the type who'd own a laptop, they called my company's security department (whose number was plastered all over it.) By Sunday afternoon the security department had called me and verified that it was my company-owned laptop, and we talked to the police. Monday morning I went into the cop shop to identify it, they couldn't find it in the property room's hand-written checkin records, and a couple of hours and a couple of discussions with different cops later, we concluded that they'd let the thief out of night-jail and given him "his" property back, and being a Person of No Fixed Address, recovery was unlikely, even if he didn't have the sense to fence it right away :-)

Fortunately I had a recent backup, because the disk had been making suspicious noises the week before. I hope the fence had the decency to format the disk drive to cover his tracks so somebody else didn't have to wade through all my corporate Powerpoint presentations...

Re:Cops and Stolen Laptops

[Anonymous Coward]

In this case, I believe they did all they could have. They can't confiscate property on the suspicion it's stolen. They called your security department and gave them as much time as they had to claim it - until he was released - and it wasn't enough. Frustrating, but what can you do?

Works of fiction may not offer the best advice

[AHumbleOpinion]

Recall the trick used in Neil Stephenson's Cryptonomicon: Wrap several coils of wire around the doors and windows, and during the evening run several amps through them. Anybody stealing a hard drive will be left with a paperweight.

Works of fiction may not offer the best advice, real world meet artistic license. People have tried to erase disks with degausers, bulk video tape erasers, etc without success.

Re:Encryption? Priceless.

[mythosaz]

Products from Guardian Edge
http://www.guardianedge.com/

I'm quite pleased with the encryption product itself, but the guys who package their MSIs need shot :)

Re:why is computer-theft still an issue ... replay

[pbhj]

Isn't that susceptable to a an attack whereby the encrypted pw is simply replayed from a previous authorisation instance.

So, break in, disconnect and reconnect network (with packet sniffer in place); steal computer, replay packets, copy decrypted data ... PROFIT

???

Re:Encryption? Priceless.

[muhgcee]

Hi. GuardianEdge support guy here :-)

Comment removed

[account_deleted]

Comment removed based on user account deletion

hardware.slashdot.org???

[microbee]

Hardly an appropriate category.

When my laptop gets stolen..

[Sloppy]

..they'll have to crack AES256 before they can mount /home, or crack Blowfish before they can examine my swap. Any corps that aren't doing something like this, aren't taking their responsibilities seriously.

Social Engineering at it's best (not)

[Anonymous Coward]

I remember when this happened. And have worked at the same company twice -- once before the stolen computers (it was 2 whole servers that were carried out the front door) and and then again after. If I remember correctly, there was blurry video tape showing the computers being removed out of the building. It was Christmas time, and there were a lot of holiday parties.

Honestly, I was really shocked when the company was handed the second contract for the 21 state region of TRICARE. General opinion was that the security breach should have cost the award, but government/politics hijinx -- who knows what happened. That's right - this happened BEFORE the expansion to the 21 state contract.

Physical security prior to the theft was IMHO, a joke. Doors were held open for others walking in. One person would "badge" in, then several others would follow through the just opened door.

Afterwards, visitors were signed in, ID checked. Better -- but still a high amount of contract workers.

and I still know some great, highly ethical people that work there.

Whole Disk Encryption issue

[gr8dude]

I see things this way:

• Whole disk encryption forces you to encrypt absolutely everything - meaning that more processing power will always be needed. (Well, the data resode on the encrypted partition)
• But the good news is that all the software you have on the computer is working with encrypted files, without even realizing it. So you don't have to change anything in your infrastructure, update programs, pay extra, lose some functionality, etc

So, what you get is 100% transparent encryption in change for a performance penalty (which varies from machine to machine).

Directory encryption gives you the flexibility to choose which data you want encrypted, and which not (so performance loss is minimal). But then, you have to manually decrypt the stuff before using it, and sometimes you might forget to encrypt it - which can be a serious problem.

A solution is vritual drive encryption . A program creates a virtual drive which is seen as another drive in the system, any application works with it in a usual fashion (since encryption is transparent and on-the-fly), while you are not forced to copy all your files to that drive, hence you don't waste CPU cycles on encrypting things such as your high-scores in Minesweeper :-)

Look for a program called Private Disk.

Policies might not be enough

[TheDude99]

This seems to be happening everywhere! E&Y seems to loss a lot of laptops. The problem is, you can't just use corporate policies, because some people just won't follow it. You need some software to enforce the policy. There are a couple of comapnies out there doing such things - like Softection www.softection.com for example. With all the sensitive data out there - I wonder if cases of identity theft have been on the rise. Anyone know?