Slashdot Mirror
TSA to Contractors - Encrypt Your Laptops
eweekhickins writes "After two laptops were lost containing the personal data of 3,900+ truckers who handle HAZMATs, the Transportation Security Administration has ordered its contractors to encrypt any and all data. 'After the second theft or loss, the TSA conducted an IT forensic investigation that ascertained that the (previously) deleted information could be retrieved if a thief had the proper training. "So even though [there's only a] small chance of [the data being misused], we did notify all affected individuals and advised them of what steps to take to protect themselves, and we mandated that contractors need to encrypt any and all data in addition to any deletion procedures that might be in place," Davis said.'"
"No, not the keys to the truck and trailer, I need the damn keys to the laptop!"
---- Teach Peace. It's Cheaper Than War.
Though many never do, will this be the same?
I think that even if you force the security measures in place people will always find a way around it. People write their passwords on a Post-in note or tape it to their monitor. These security measures are good but definitely not perfect.
That these kind of measures are retroactive instead of proactive.
Ask not what you can do for your country. Ask what your country did to you
OK, so I have my Open Office document with goodies of HAZMAT data in it. I deploy my favorite encryption program and encrypt the document. Then I delete the original document. Same problem exists. Encryption is not enough.
Either the data needs to be "shredded" or stored in it's natural form on a fully encrypted volume.
We don't want people knowing how much crap happens at a typical bridge, or airport. So only autherized personal should have access to the data. Hmm, my ignorance is comforting as I type this.
Yeah, I installed TruCrypt today so I could encrypt my drive yesterday.
Uh, dude, I think you mean "reactive".
Politics is the art of looking for trouble, finding it everywhere, diagnosing it incorrectly and applying the wrong fix.
As someone who works for a govt contractor (state & local govt, not federal), ironically in the security field lately, I've noticed that retroactive measures for security lapses are generally the norm, and not the exception. The govt organizations themselves are too cheap to do security right in the first place, and many contractors are too greedy to include proper security measures in their govt projects since those will cut into their profits. Fortunately, my employer has a clue and we don't suffer from such moronism, but we sure see a lot of it when we have to come in and finish or repair a system implementation that a prior contractor botched up.
Always put the password somewhere near your laptops in case you forget it. Security is aight, but there's nothing worse than forgetting your password!
Be serious here!
You steal a laptop. If you're not a complete dimwit, you first of all check what you got. So you boot the thing up and notice that you have a government laptop in your hands.
Question for 100: Do you want to know what's on it? Let's even assume you don't know jack about computers, but do you want to know what's on the box?
Now, it's fairly trivial to get information out of a hard drive and restore deleted information (unless it's been overwritten, where it becomes less trivial). A halfway informed person with a bit of knowledge is enough, you don't need a forensic expert. All you need is the usual program(s), downloadable at leisure. And presto, instant information recovery.
The question is not whether information can be gained from the laptop, the only question is whether the thief has the brains to use it. That he has access to it without any hassle is a given. The only thing that matters is whether he knows a fence for information rather than just hardware.
And yes, those people exist...
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
So even though [there's only a] small chance of [the data being misused], we did notify all affected individuals and advised them of what steps to take to protect themselves, and we mandated that contractors need to encrypt any and all data in addition to any deletion procedures that might be in place
The data that goes out, why spend incredible efforts tracking every action of the victims in case it's a fraud.. versus, invalidating the data that went out?
Your social security number was leaked because of the government? The government changes your social security number, fixes their data, and the old one remains as a trap waiting for some fraudster wanna be try and use it.
The latest versions of Puppy Linux have an easy-as-pie way to encrypt everything. Just burn a CD, boot from it, then at shutdown you're prompted to save your session. You can save to the hard drive or any other storage device, and you have the option to encrypt the data.
Boot from the CD, and it'll find and load the data you stored. Enter your password (correctly, one would hope) and go. It doesn't get much simpler than that.
Of course, you can't use your insecure Windows "helpers". But if they were *really* concerned about data security... well, I won't go *there*.
Stressed? Me? Of course not. Stress is what a rubber band feels before it breaks, silly.
What they should be looking at is VMware's ACE product. Built in encryption, security policies, and the ability to expire a VM after a certain amount of time. Add to that the ability to lock out USB devices and un trusted networks, and you have a pretty cool product.
I'm not as concerned about the laptops being lost as I am about contractors keeping the data on their laptops as long as they like.
Tim
See... and you thought your sig was boring - TT
The TSA can issue orders like that until it is blue in the face. If it ain't in the contract, and it ain't in the Federal Acquisitions Regular (FAR), then the only way this happens is if TSA (in other words, the taxpayer) chooses to *pay* for it to happen.
Are there any real-world effective laptop encryption solutions?
Encryption requiring a simple password:
They key space will be limited making for easy cracking.
Encryption requiring a sufficiently complex password to avoid above:
The password will be too hard to remember so people will write it down... on a sticky note on the laptop.
Encryption requiring an external device to supply complex key:
This will fail because many people will either attach the device to the laptop, or keep it in the same bag as the laptop.
I guess the simple password solution is the best since it would at least require a degree of technical expertise from the thief to get around.
I use Truecrypt to encrypt a partition on a drive and store all of my documents there. It's transparent to the user, once you've mounted your volume(s) and it's pretty danged fast, too. You can do encryption with Twofish, Serpent and AES or a cascading combination of them. Pretty damned secure, opensource and free.
You can even encrypt a whole device. If you do that, it just looks like a blank volume and a thief won't even know there is data on the volume to be decrypted.
Most Thinkpads support something like Full Disk Encryption. Password in the BIOS, and you can't boot without it. The disk is literally unusable without the password.
My gig at I%$&#, they had me write my FDE password down and give it to the nice Systems tech. That way, when I left, they could recover the disk and reissue the machine after the usual shredding and wiping.
Without it, they would have to throw out the drive and buy a new one.
And yes, you need to remember your password. This you write down and leave at home, or with the Keymaster in the office, or your boss.
Honestly, this is not that hard.
deleting the extra space after periods so i can stay relevant, yeah.
Im assuming high hostility against a federal machine. So, no, the host password will NOT be easily extracted. You know.. SysKey, encrypted ~/windows directory, encrypted user directories... Not fun. To combat that, you use an ICE. In Circuit Emulator.
Next the VM... Yes, you could roll back the clock, but how would one prevent that simple of an "attack"? Record via signed encrypted file when the last time/date access was. Ok.. so now we can just 'freeze' the VM so restart starts with those very files at that exact time.
The question is "How can we verify accurate and precise time in a VM?" The answer here is that the VM needs to have a secret that is shared with a trusted server, however one must also have trusted access to the CPU to verify that no tampering takes place during the critical connection. To combat replay attacks, the VM client could send a very fine granularity time (say HH:mm:ss:SSS) and request a response using this time. Any significant deviancy from this timebase would seal off the VM.