Ask Slashdot: Using Company Laptop For Personal Use

An anonymous reader writes "I'm starting a new job soon, and I will be issued a work laptop. For obvious reasons I cannot name any names, but I can state that I do expect my employer to have tracking software on the laptop, and I expect to not be the administrator on the device. That being said, I am not the kind of person who can just 'not browse the internet.' If I ever have to travel with this laptop, I may want to read an ebook or watch a movie or maybe even play a game. I can make an image of the drive, then wipe the machine, and restore it back to its former state if I ever have to return it. I can use portable apps off a usb key and browse in private mode. The machine will be encrypted, but I can also make myself my own little encrypted folder or partition perhaps. Are there any other precautions I could or should take?"

Comments

No

[Anrego]

I can make an image of the drive, then wipe the machine, and restore it back to its former state if I ever have to return it.

Is your new job worth it? Not saying you'll automatically lose your job over that, but I can't imagine it'll go over well. Especially as you'd be using your (non-work prepared) laptop for doing work and might inadvertantly put them at risk (the kind of risk they hope to eliminate by issuing you the laptop in the first place).

The simple solution is get yourself a USB / livecd type distro. Don't touch the hard drive.. and if it's encrypted, you shouldn't be putting your company at risk (assuming you don't use the same key for anything else). Personally I'd ask your IT guys if they are ok with this before doing it. Sometimes they can actually be reasonable about this kind of stuff.

The real solution here is to leave your work laptop alone completely and get your own laptop for personal use.

Re:No

[Anonymous Coward]

To add to this, anyone can pick up a jolly decent pre-owned machine for seriously little money.

Re:No

[jhoegl]

Agreed. As an IT Director, I can tell you I would be pissed someone took company inventory and did this.
Security is based off of locking down that laptop so you dont do something stupid like install a "free game" with a trojan in it.
Not that I dont trust employees to know better, but I dont trust ALL employees to know better. A breach only takes one infected system.

Re:No

[Anonymous Coward]

First, we don't know what industry this guy is in and who his employer is - or his position for that matter. If he works for the FBI, CIA, or etc, then that's one thing. If he just works for a typical American corporation, then that's another.

My company wouldn't care. We don't track laptops, and even if we did, we'd only pull the information if you reported the laptop stolen. We aren't staffed to actively monitor the laptops of 100 salesmen, 20 executives, 400 middle management people, and etc.

If your job entails holding a lot of highly sensitive information on your machine, then maybe they do track you and it is in your best interest to cooperate, and maybe you would want to avoid a lot of uncomfortable questions if the authorities recovered the laptop and did forensics. That's really the only situation where I can see there being merit to avoiding personalization of the laptop.

If you feel your employer is really out to get you, then maybe you shouldn't really work for them.

Otherwise I say just reimage the drive or just swap out the drives for your own. That's what I've done. Been this way for about 7 months and nobody has said a peep to me.

Re:No

[Collapsing Empire]

Once you lose physical control of a machine, you really can't say much about the security of it. You don't know where that laptop has been or who else might have tampered with it while it has been traveling the globe. The best you can really do is the standard antivirus scans. But that doesn't stop a 0-day or a custom written trojan.

You really ought to be treating all portable devices as potentially hostile devices and securing (and monitoring) your networks accordingly.

IMO if the user is competent enough to install Linux or their own custom Windows image on there, I don't think you are any worse off than it was previously. Seeing how out of date some IT departments are with patching and service packs, the machine may end up being more secure.

Re:No

[jowifi]

The solution I came up with was to buy a spare hard drive and caddy for the machine. When I wanted to do my own thing, I swapped out the drives. No risk of contaminating either system with data from the other, and it's a lot easier to carry around than an extra laptop or even a tablet. It also tends to be faster that a cd or usb drive.

Re:No

[Joce640k]

I can make an image of the drive, then wipe the machine, and restore it back to its former state if I ever have to return it.

Can you shrink their partition, install another OS in the free space and dual boot? It would be a lot easier to do and you can switch between 'work' and 'play' modes.

If possible, make the original partition non-writable when you're in 'play' mode.

This is almost the same as having two laptops.

Re:No

[maxwell demon]

Another solution is to simply ask the employer, if some personal use of the laptop is OK, and if so, to what extent. Maybe you'll get the answer that your intended usage is fine, and then you'll not have to worry at all about how to hide it.

Indeed, if I were the employer, if someone asked I'd probably be fine with it, but if someone were playing tricks to hide and I'd find out, I'd seriously consider firing him.

Re:No

[Guspaz]

You can lock down a laptop sufficiently so that even though you've lost physical control of the machine, nothing short of replacing the hard disk is going to compromise the system. If your employees are doing that just to circumvent IT policy, maybe THEY should be treated as the hostile one, not the laptop.

Re:No

[ulski]

You could ssh into a "always on" computer at home - (you start putty from a usb stick). Or you could buy a 2.5inch harddrive and switch between the corporate 2.5inch drive and your private one. In some laptops it is fairly easy to swap drives like that. Or you could boot from a usb stick or usb harddrive, but that will only work if the bios is not locked to only boot from the internal harddrive. My guess is that that last option would be the best choice

Re:No

[Bill_the_Engineer]

I'd hope that the people I issue laptops to are responsible and trustworthy. Personally I don't care if they use the laptop for personal web browsing or e-book, as long as they do it on their own personal time. Most appropriate use agreements say the same thing. I do draw the line at installing programs on the laptop.

However I always strongly suggest people to have their own laptops/computers for personal use. Information stored in the form of cookies, browser history, etc. can be embarrassing or worse. There was a local county worker who was dismissed for inappropriate material being found on his work laptop while it was being serviced by the IT contractor. No one thinks about the laptop failing and having your personal data locked up for the IT repair guy to find. I find it amusing that they warn of key logging (which isn't as wide spread) but aren't as cautious about being caught in a compromising position.

Another (and more appropriate reason for the people I work with) reason being that the company I work for (and most others) consider the use of company equipment for personal financial gain as an offense worthy of dismissal and any goods produced on company equipment as their property. Lawyers are more expensive than a laptop - a.k.a an ounce of prevention is better than a pound of cure.

You really ought to be treating all portable devices as potentially hostile devices and securing (and monitoring) your networks accordingly.

Placing company laptops in a DMZ doesn't always make for a productive work environment nor is your monitoring idea that effective. A compromised laptop can still "behave" in a company private LAN and once connected to a public hotspot send its payload to whomever. There is a reason we like locking down company equipment. Locking down company equipment also has a "cover your ass" attribute that network monitoring alone can't offer. Also depending on the industry there are regulations that may dictate such measures to be taken.

IMO if the user is competent enough to install Linux or their own custom Windows image on there, I don't think you are any worse off than it was previously. Seeing how out of date some IT departments are with patching and service packs, the machine may end up being more secure.

The employee should stick to his/her paid job assignment and let IT do the job for which they are paid. I have company equipment that have two or more operating systems on them, but they were all approved by IT first and my job directly depends on it. I believe altering the contents of a company laptop in such a drastic manner without the consent of IT may be a severe violation of the use agreement.

Re:No

[Nimloth]

For what it's worth XenClient is exactly what you need, though it requires a Citrix infrastructure at work so it might not work out. But you'd have an hypervisor on the laptop with two VMs, Work and Home. Work is loaded by IT and sync'd with XenDesktop, and Home is loaded by you and you control everything on it. Complete isolation of both images.

Re:No

[Glonoinha]

Smartest thing I've read all day. It is literally a perfect match to the original question, which is probably the dumbest thing I've read all day (drive image your work laptop, smoke it and install your own warez, and restore the drive image before giving it back to them.)

OP - here's the one piece where your plan fails : the active directory connection establishing your machine as a trusted member of the domain, and your user as the domain with the same name ... disconnects if it hasn't been refreshed in a while. I don't know how long it takes, but it happens. And it is a particularly uncomfortable discussion with corporate IT explaining why, given that your machine looks exactly like it did when they gave it to you, and you have been using it for a few months. The question is going to come up 'What did you do to it?' and you are going to answer just like they expect you to 'Nothing.' ... and it goes downhill from there.

Technical answer for you is same as Anrego : USB Thumbdrive install of Linux : Pen Drive Linux has a zillion distros you can pick from, and they give you step by step instructions on making it work.

If technical answer #1 doesn't work for you, here's technical answer #2 for you : remove the work hard drive, install a new hard drive, install your own OS on that and swap out drives for work / pleasure. Downside is limited to the danger of physically borking the work drive while removing it or storing it while it is out of the machine. Explaining how you managed to mangle the SATA connector on a work laptop is a very difficult discussion.

Personal preference answer is also same as Anrego : don't do anything on your work laptop that you wouldn't do with representatives from corporate HR, IT, your boss and his boss standing over your shoulder. Buy a cheap used netbook for $150 on Craigslist and take it with you to do your warez/internet surfing/pr0n viewing.

Re:No

[maestroX]

Agreed. As an IT Director, I can tell you I would be pissed someone took company inventory and did this. Security is based off of locking down that laptop so you dont do something stupid like install a "free game" with a trojan in it.

So you did piss at the directors for requiring to install Windows on company inventory?

Re:No

[unixisc]

I fully agree w/ this. In all my jobs, I made it a point to not do any personal stuff on work laptops (and once they disabled webmail sites like gmail, the only potentially urgent personal thing to do was out the window). On my home laptop, I did whatever non-work related stuff I wanted. Never faced any issues - particularly given how it's well known that there is no guarantee of privacy as far as one's work laptop is involved.

Re:No

[Anonymous Coward]

If you in a Job where you are getting a company laptop you are probly making enough cash to buy your own personal laptop. Keep your porn/games/dating sties/torrents of my company equipment.

  It support around 50+ users in an office and I do not have time to wipe pcs cause some one got frisky and screwed them up.

Re:No

[Deorus]

As a software engineer, whenever I have to work with IT people like you, I happily leave the company's laptop unused and locked in a drawer beneath my desk and use my MacBook Pro instead. All the information needed to access corporate services is in my possession anyway, so you're none the wiser. If you block Internet access at work, I will happily tether to my iPhone or bring my iPad.

To put it simple: in this day and age you can't afford to think you have that kind of control. If there's sensitive information, the only way to be on the safe side is to ensure that it never leaves the company, which is something that you can still do.

Re:No

[CohibaVancouver]

You don't know where that laptop has been or who else might have tampered with it while it has been traveling the globe

Sure you do. There's all kinds of tracking software that will tell you this and alert you as an IT administrator to policy breaches.

Re:No

[CohibaVancouver]

The solution I came up with was to buy a spare hard drive and caddy for the machine. When I wanted to do my own thing, I swapped out the drives.

If a) you're running windows on your second drive and b) the employer has deployed tracking software like Computrace then Computrace will self-heal onto your second drive and the swap will be detected. No worries if you're running Linux on the swapped drive.

Re:No

[rtfa-troll]

You can lock down a laptop sufficiently so that even though you've lost physical control of the machine, nothing normal in software short of replacing the hard disk is going to compromise the system. If your employees are doing that just to circumvent IT policy, maybe THEY should be treated as the hostile one, not the laptop.

FTFY;

In other words; no you can't. You can compromise the user interface by putting something between the keyboard and the IO device. With a radio device there you may read passwords on demand or even do live manipulation. For a laptop that counts to me as "compromised". However, if that's not enough you can always put a tap on the bus between the IO devices and the processor. Typically a simple second device on one of the main buses is sufficient. Then you can simply insert your code into a DMA transfer at the appropriate point.

Please note that these attacks completely bypass any protection from disk encryption and are partially effective against many TPM uses.

Once you have physical access pretty much all bets are off. Even military systems deal only with time delay and / or data destruction in the case of physical control.

Re:No

[Anonymous Coward]

Seriously just by your own laptop; its a pain to have two laptops while traveling, but its the best bet.

Where I work anything I do on the work laptop is monitored and all employees agree to only perform work-related activities. If I am at work and learning about things, that's allowed. Learning on my own time: not allowed. Its odd, but those are the rules.

Even if you use a live cd, there are other vectors Video card memory doesn't get cleared on boot like conventional memory, so if you did get something, that's a good place to hide it to persist it, so it is possible that you could get something under personal mode and it could persist over to work mode. Since video card drivers run ring 0 typically, that means they could get complete access to your un-encrypted work data.

Re:No

[HornWumpus]

If someone has gone to the lengths of locking down the laptop they must have concerns. Important IP and known active industrial espionage would be the kind of head space I'm describing.

Given that mode of thinking, I would assume you would check the image of returning employees laptop hard drive for malicious changes installed by professionals.

Even if you trust your employee completely, the laptop has been in the hands of customs and other unknown people while in the world. It can't be assumed safe until re-imaged. Finding any attackers code would be a bonus of the 'standard' harddrive swap by IT on return.

And no it wouldn't be that bad. Employee has only had laptop for a few days. Tech pulls old drive, installs standard image replacement, checks for nonstandard flash, updates crypto, puts back on shelf. Tech installs old drive in USB enclosure, enters crypto key, scans then copies data folders to employees user folder, then runs paranoia process on OS and drive. If nothing found drive re-imaged and put back on shelf.

To the employee it looks like he turned in his machine and his data showed up in his folder 30 minutes later. To the tech it looks like he has a job doing paranoid shit, until one day he finds the next Stuxnet.

I assume, more or less this, is routine at many corporate R&D centers. In that world they do have to treat employees as, at least, potentially hostile.

Re:No

[PNutts]

Holy jebus. You should be embarrased to post that in what used to be technical forum. A laptop in possession of a trustworthy employee governed by policy is not losing physical control. It's not your resource to do what you please and you don't manage it. You also didn't build and tweak it so don't assume the things that work on yours will work at it. The company will have policies on what's appropriate ranging from "no personal use" to "occasional use" to "go forth and surf". The OP didn't mention what the policies and so this entire thread will be a flame war. The rest of what you say is so obvious as to be insulting. Except the last paragraph which is dangerously naive. Any decent IT shop will evaulate the risks before rolling out a patch just because it's Tuesday. It might not be necessary at all.

Just because the OP has no self-control to 'not browse the internet' that doesn't mean his company has to assume the cost and risk of him doing so.

Re:No

[Anonymous Coward]

As somebody who does IT for a major research university: HA.

The idea that we get to control what the professors do with sensitive data is absurd. We HAVE to lock down laptops to the N-th degree, and even then, we can only lock it down to the point where if it's stolen randomly the data is secure... if it's targeted, we're still pretty much screwed.

Re:No

[Mista2]

Cheap option, buy a tablet.
Less cheap option, buy a netbook.
Cheapest option, if you have admin permission on the work computer, install virtue box, then a virtual Linux installation. I'm not 100% sure on features, but if you use VMware workstation as the virtual layer you can also password lock and encrypt the Gm guest. This is the path I use. It also means that I can pick from OS X or Linux mint 8).

Remember, it's the companies laptop, not yours.

Re:No

[Anonymous Coward]

IMO if the user is competent enough to install Linux or their own custom Windows image on there, I don't think you are any worse off than it was previously.

Speaking as an IT manager, this isn't a technical issue as much as a political one. If you let some employees do things you don't allow others to do then you will get accused of playing favorites, which generates the type of animosity that causes people to hate their IT departments.

Re:No

[Anonymous Coward]

Ahhh, Mister Uppity. This is why I like to deploy All-In-One computers (iMac with Bootcamp) and bolt them to the cube wall or on an arm. Have a Cat5 wire into a wall socket. Lock down the workstation OS so that you have the apps that you need. That is it. All other ports are off. All data is stored on the network.

We are paying you for 8 hours of work per day at our discretion. If you do not like that, then you can go 1099 and work on a project based timeline. Nobody is that important, especially you.

Have a pleasant day.

Re:No

[Anonymous Coward]

If...

A breach only takes one infected system.

...and ...

I dont trust ALL employees to know better

...then you're doing it wrong.

Disclaimer: I'm not the IT directory of anything. I just manage the IT security team for a university with 4k staff and over 20k students, where staff is free to use company laptops for personal stuff, and where we haven't had a serious breach in years.

(Anonymous because you don't need to know which university I'm talking about.)

Re:No

[Rary]

This is exactly right. It's amazing how many people immediately look for ways to go behind the employer's back. Why not start by just asking them? If the employer is expecting you to travel for extended periods of time, then there is an obvious need for getting a reasonable amount of personal use out of the laptop, as traveling with two laptops (one for work, one for pleasure) is just silly. Your employer is human, and likely a reasonable one at that (and if not, you should be looking to replace her or him). So, just explain your needs and come to an agreement.

Re:No

[Anonymous Coward]

Parent = computer janitor. Last I checked computer janitor != the person paying software developers for their work.

software developer > IT. If IT gets in the way of a software developer doing his job, the software developer should have his manager sucker punch IT guy's manager in the next sufficiently public meeting.

Re:No

[Anonymous Coward]

And how can we still protect company IP, when it's on your MacBook?

Re:No

[Anonymous Coward]

I would fire him instantly. Most companies have a policy governing this. I would hire someone who did not violate company property.

Re:No

[Anonymous Coward]

i had a job where i was expected to bring a customer issued laptop, my company's laptop, and if i wanted to use one for personal things like gaming, my own laptop. 3 laptops?? i found that my company issued dell latitude had a an easy to access hard drive that slid out the side with just one screw to undo. I put in a personal blank drive and installed a 30 day trial of windows, skype, openoffice (for schoolwork, I was working on my masters), and my favorite mmo game and brought that extra hard drive along on my longer travels of 2-3 weeks or more. i probably wouldn't have bothered for anything shorter. there was no way anyone at that company could know other than by checking the screw for the hard drive and then only if they hadn't removed the hard drive themselves. that chances of this infecting the company machine even if had downloaded a trojan on my personal drive are almost nil.

Re:No

[Deorus]

Parent = computer janitor. Last I checked computer janitor != the person paying software developers for their work.

Actually, I'm a software consultant / engineer who has to work at clients a lot.

software developer > IT. If IT gets in the way of a software developer doing his job, the software developer should have his manager sucker punch IT guy's manager in the next sufficiently public meeting.

This happens a lot more than you may think, especially in banking / insurance / military / air transportation (at least that I've worked with). You are often issued heavily locked down systems to work with minimum to no online access, and if you want any kind of online access, even for reference documentation, you have to bring your own tools.

Re:No

[Anonymous Coward]

But they haven't lost physical control of the machine, they've given it to an employee with clear guidelines on how to maintain security.

If you are caught tampering, you could reasonably expect to be walked off without pay.

If you really want to play games, buy a tablet and play angry birds or something.

Re:No

[FormOfActionBanana]

That is retarded. Why?

1. The laptops carry sensitive data. Treating them as hostile is a good start, but it in no way validates leaving the user to install his own malware/crapware, etc.

2. IT departments are pretty good about patching Windows/MS Office etc. It's the little 3rd party applications and homegrown software that is being left in the dust. This was carried on /. a few weeks back.

Re:No

[Tom]

All the information needed to access corporate services is in my possession anyway, so you're none the wiser. If you block Internet access at work, I will happily tether to my iPhone or bring my iPad.

Let me get this straight: You would connect to the corporate network using a private, unapproved machine? And you would then connect that machine directly to the Internet?

In several environments in which I've worked, as the IT Security/Compliance Officer I would recommend you for immediate termination.

Just because you think that you are entitled to your own rules doesn't make it so. If you don't like my rules, you are welcome to come into my office and discuss them with me. You better have good reasons, because I do.
You are not free to just break the rules and open up the corporate network to the world at large, bypassing all the security layers that are there for a reason.

Re:No

[Tom]

You can lock down a notebook well enough that it requires malicious intent and considerable technical skill to tamper with it.

The fact that there is no 100% security doesn't mean that there isn't 99% security.

IMO if the user is competent enough to install Linux or their own custom Windows image on there, I don't think you are any worse off than it was previously. Seeing how out of date some IT departments are with patching and service packs, the machine may end up being more secure.

Maybe. But that "more" of security could be in the wrong place, while the security that actually matters for the threat scenarios that the risk assessment has defined has been reduced.

Re:No

[Deorus]

That is precisely the point, you can't, so just think about that when you design the network. All portable devices should stay in an untrusted VLAN, company-issued or not. Each employee with a security clearance should have an inbox with an ACL that would only show sensitive message bodies to computers connected to the trusted VLAN, so they'd still be able to receive mail on their iPhones, but the sensitive message bodies would be replaced with a message informing them that the message can only be read at their desktop. Finally, secure messages should not be possible to forward to untrusted recipients.

If I was a network engineer, this is the kind of stuff that I would implement. Probably not all in one go, but I'm a software engineer after all, I can write network services very easily, and to me such an IMAP solution would be feasible to implement from the scratch within a week.

Re:No

[Anonymous Coward]

Placing company laptops in a DMZ doesn't always make for a productive work environment nor is your monitoring idea that effective

I disagree.

If you're going to harp about locking down equipment then you should be well aware that software mechanims that restrict the functionality of said environment are not hard to bypass by someone who has physical access to the laptop.

As other posters pointed out, there are hostile foreign governments, shady competitors who'd love to do some industrial espionage, and untrustworthy border security agents out there who'd love to get a keylogger or other piece of software on there running when the laptop is plugged back in at the office.

If your company data (be it IP or just corporate strategic information) is that important, you either need to wiping these laptops clean before they are plugged back in or you need to restrict mobile computing devices to a segregated LAN.

Anything short of that and you're not really taking security seriously.

I do draw the line at installing programs on the laptop.

Another (and more appropriate reason for the people I work with) reason being that the company I work for (and most others) consider the use of company equipment for personal financial gain as an offense worthy of dismissal and any goods produced on company equipment as their property

I believe altering the contents of a company laptop in such a drastic manner without the consent of IT may be a severe violation of the use agreement.

You seem to care more about rules-following rather than actual meaningful security measures. Amusing but not atypical for IT PHBs.

Re:No

[Collapsing Empire]

Name a piece of software that can detect when Windows has been 0-day'd to allow a monitoring kit to be installed.

Name a piece of software that can tell when a laptop is being tinkered with (perhaps by a guy with a USB key loaded with hostile software) while the employee is distracted.

Sorry, software does not solve these problems.

Re:No

[Anonymous Coward]

You won't be accessing company resources with non-corporate equipment where I work. The best you can do is VPN in and use a terminal server. If that's how you want to work, more power to you.

Re:No

[Collapsing Empire]

You should be embarrased to post that in what used to be technical forum

Name one technically inaccurate point made in my post. Tick, tock. I'm waiting.

A laptop in possession of a trustworthy employee governed by policy is not losing physical control

So you're saying that all employees will carry their laptop on their person at all times, including while they're going through airport security (in which the agent asks you to take the laptop aside), never left in a hotel room, never left in a meeting room at a conference while everyone goes to grab lunch, and etc?

You really have no clue. You should be the embarrassed one.

The OP didn't mention what the policies and so this entire thread will be a flame war.

Well thanks for taking the high road buddy.

Except the last paragraph which is dangerously naive

No, it's not naive just because you don't like the point I made. Just because you've never worked with a company that can't keep up with patches doesn't mean these IT departments don't exist. Unlike you, I've actually done real IT work, done IT consulting, and do IT security for a living.

Re:No

[Anonymous Coward]

As a software engineer, whenever I have to work with IT people like you, I happily leave the company's laptop unused and locked in a drawer beneath my desk and use my MacBook Pro instead. All the information needed to access corporate services is in my possession anyway, so you're none the wiser. If you block Internet access at work, I will happily tether to my iPhone or bring my iPad.

To put it simple: in this day and age you can't afford to think you have that kind of control. If there's sensitive information, the only way to be on the safe side is to ensure that it never leaves the company, which is something that you can still do.

^This

Re:No

[Collapsing Empire]

But they haven't lost physical control of the machine, they've given it to an employee with clear guidelines on how to maintain security.

Look, you don't get it. A desktop PC never leaves the office. You always know where it is. If your facilities are secure like they're supposed to be, you know who comes in and out of the building, and ultimately, who has had access to that desktop.

If you give a laptop to an employee for work use, you don't know *exactly* where that laptop is going and you don't know who else might have access to it while it is away.

If you think you do, you're really deluded. I'm not trying to be an ass, but I do IT security for a living. We go through these scenarios on a nearly daily basis with our clients.

You absolutely cannot trust a device once it has left the premises until it has been wiped totally clean and reinstalled from the standard company OS image.

A client I've worked with recently had their network breached because an employee connected to a rouge hotspot while traveling in China and picked up a virus from an exploit that the vendor had only *just released* the patch for but the company had yet to deploy. And that's just *one* scenario of what could happen with a mobile device.

Re:No

[Anonymous Coward]

You sound like a modern dictator and the whole stuff sounds like modern slavery.

While i can see your point from a security stance of view, it's still not a valid argument to think you -and you alone- have absolute control over someone else.

Also, your arguments will be bull. The information is not safe, whatever locked-up solution you use. People could always just make a photograph of the screen, if not anything else.

Your safety should come from the fact that you _trust_ your employees. And to tell a little secret. Trust must come from both sides, else it won't work.

You, as IT staff, you do your best to secure your network and hardware. But as you can read in the rest of this article, as soon you overdo it, employees will find a way to work around it. And no, you will not all see them in your office. What you need to do here, Sir, is to find that delicate balance between security and workability.

Another secret: If 'that information' is so sensitive, you should consider not putting it on a network at all. Assuming that your VPN powered-encrypted-access controlled intranet is secure is a thought fault in the first place, and blaming insecurity on your employees a second.

If actions of your employees compromised your security, YOU did something wrong, not them.

As for the slave -err, i mean- employer involved. Get another job. Or see your IT staff's boss and discuss the situation. As again, the real solution for added security is mutual trust.

Re:No

[Collapsing Empire]

1. The laptops carry sensitive data. Treating them as hostile is a good start, but it in no way validates leaving the user to install his own malware/crapware, etc.

Strawman. Nobody said the employee should be deliberately installing malware. What kind of idiot would think that is a good idea?

The point is situational - if the employee can be responsible enough to secure the laptop and get away with it (i.e. they don't have a little Hitler in the IT department with a keylogger running or something), then by all means I don't personally have a problem with it.

If the employee is actually handling sensitive data (i.e. something where law enforcement, lawyers, SEC, or shareholders might get involved if there is a breach or loss), then it is probably in his best interests to let the IT department take the heat if the laptop is hacked, stolen and then subsequently recovered, or found manipulated by a virus later.

IT departments are pretty good about patching Windows/MS Office etc

I love how you speak for all IT departments.

Just who's post is the 'tarded one now? (If you can bait the flames, then you can take the flames too!)

Re:No

[Anonymous Coward]

Exactly. With Trojans and viruses SO diffucult nowadays, as an IT Admin you have to lock things down. Ever tried to clean up a small virus from an active file server? YOU dont have 100's of gigs of infer tile file types... Corporate networks do... If you can even GET to the file servers from all the cross machine traffic infecting each other.

Point is that in a company with 1500 people even ONE hour wasted of everybody's time is tens of thousands of dollars... More if you actually make them redo work. We pay hundreds of thousands of dollars to install automatic tools for patches and virus/malware checking... We install firewalls and email filters to keep the bad stuff out... At my company they mentioned more than 50% of email to our server is rechecked out of hand... And you STILL get spam.

Needless to say, a mid size company is paying 7 figures to keep their network going... Not to mention the legal issues (trade secrets, customers, sox, and insider trading) that the COMPANY is responsible to monitor for. Some jackass that can't keep off Facebook for a few hous a day.... Really, grow up. Just buy an iPad (or other tablet flavor) with 3G and get over it. then you have access to you Amazon shopping and Slashdot at work, and nobody is spying on you!

Re:No

[Anonymous Coward]

As a systems administrator, whenever I have to work with arrogant sods like yourself, I simply go to your manager, tell them what's going on in their department, and wash my hands of responsibility for security of data on his systems and projects. In every case for the last sixteen years managers have no problem with this arrangement. And when your systems inevitably wind up trashed, ruined, stolen, hi-jacked, rooted or otherwise I simply point them to the record and say, "Well, that's how you wanted it so it's on your budget. You deal with it." And the presidents and boards of the companies have no problem letting the blame fall where it belongs. $15,000 to $150,000 to $1,500,000 off someone's bonus - or a department's bonus - or the loss of several employees - usually puts arrogant sods quickly in their place. Which is to say on food stamps and the unemployment line. CYA.

Re:No

[Collapsing Empire]

As an alternative, you can also compromise the boot loader and/or device driver that is used to actually enter the password to decrypt the system. Since the loader/driver itself is not encrypted, it is subject to being compromised.

Once the correct password is entered in later by the authorized user, the password can either be stored somewhere (maybe in the MBR) or if you're clever enough, you can actually use the compromised driver to run unauthorized code once the system is connected back to the internet.

Then there is the cold boot attack.

Encryption helps, but does not seal up all possible avenues of attack.

Re:No

[Collapsing Empire]

I respect your point, but I think you overlook some very easy to imagine scenarios where the laptop can be compromised.

One case would be the employee has his laptop out, lets say in a meeting (but this could be anywhere, like the airport lounge, cafe, and etc.). Employee is distracted for a while (maybe a phone call, or maybe somebody is striking up a long-winded conversation) - somebody has physical access to the laptop for a minute or two. A backdoor is loaded on the laptop during the distraction. The usual Windows group policies to lock out the laptop after 5 minutes are meaningless.

Is it farfetched? Maybe you think it is. But a long time ago, people never thought the exploits we battle today would be a problem on the Internet.

Again, the question goes back to what this employee is really doing. Does he want his ass on the line if his Ubuntu laptop gets compromised and then later traced back to his laptop? It's really situational. Not all mobile users handle sensitive data or are really targets for attacks. Not all laptop users travel - many laptops are just issued for home and office use.

Re:No

[Anonymous Coward]

I second the usb idea (I also do this). Just get a 16/32 gb thumb drive (or less if you dont need storage), install your favorite distro to it, then boot to it whenever you want to do personal stuff.

Re:No

[Mabhatter]

Well IT has been ORDERED to protect the network... Or we're fired. This is what they are paid to do.

Why do you NOT have the tools to do your job? That is NOT an IT problem, it is a MANAGEMENT problem. Reference material can be purchased as network copies from most major companies. Specific corporate sites can be opened up, or IT could provide a non-secure machine on a DMZ for browsing vendor reference. Of course when IT pulls the logs it's almost always that not just work related sites are accessed... Again, it's the people PAYING US BOTH that ordered the blocks...

Re:No

[Anonymous Coward]

"The real solution here is to leave your work laptop alone completely and get your own laptop for personal use."

My friend works for a company that does NOT allow personal laptops into the building.

Re:No

[Mabhatter]

It's much less work to just issue laptops with Bitlocker turned on and alt boot disabled. At the point you are wasting time to get around all that, you're at the point you KNOW you are breaking in and we can just get you fired.

Re:No

[defcon-11]

Why not just buy an iPad or personal laptop to use?

Re:No

[jellomizer]

For the most part I say leave your work laptop a work laptop.
If you deviate from its original use and something goes wrong you will be first to blame. Also first for a whipe and clean install, so if you any personal stuff it could be wiped at any time.

Next reason to not use your work laptop for personal reasons is for legal reasons, if there is a legal issue with your company you may need to give your PC as evidence.
Your personal stuff may incrimate you. If you are very careful and encrypt or secure delete then it may look like you are tampering with evidence.

The work PC is the property of your company you should leave it as such.

Re:No

[Gr8Apes]

Regarding attempting to connect to a corporate network? Yes, he would know, automatically, and with very little effort, provided that their network is configured appropriately. And yes, you could get around it, or attempt to, but you might be found out in the attempt. Much can be done on the network side that you are completely 100% unaware of, especially if you think you can hook up your non-approved, unregistered equipment and that a competent Network Security Admin would be in the dark.

Re:No

[Anonymous Coward]

Do they expect you to work from home? When using it for business, will you ever be the one who pays for the electricity, Internet access, or other physical necessities for being able to work (desk, chair, heat, lighting etc)? If the company is going to leach off of you, then they very well can't expect you never to use the laptop for personal use.

That being said, some actually do expect that. In those cases, (as noted above) you may be able to boot off a usb key/flash/pen drive and avoid the internal disk altogether.

Re:No

[sensationull]

No, arogant users, the job it to work with, not against the company and its interests. Only one of those interests is catering to all the whims of some prissy dev. Security, stability, liability and supportability are some of the other large factors your self centered world view completly misses.

Re:No

[Tom]

somebody has physical access to the laptop for a minute or two. A backdoor is loaded on the laptop during the distraction.

I think you need to be a little more detailed at the "and then magic happens" step.

If I can compromise your notebook in two minutes, it was never properly secured. How do you intend to get your backdoor on there? Type it in? Oh, you assume I have an optical drive and USB ports that will accept any arbitrary device someone happens to plug in?

Again, the question goes back to what this employee is really doing.

No, it doesn't. It goes back to what the company is doing. If they are in any business where lives are on the line, or actual damages could occur - I'm not talking about a dent in profits - then what the employee wants to stroke his ego doesn't matter.

Not all mobile users handle sensitive data or are really targets for attacks.

If your notebook goes on a network I'm responsible for, then it is a potential target. Even if it contains no data worth anything, it can bring malware into the system, or a nice piece of malware could download sensitive data unto it once it has connected to the network.

Read up on Stuxnet and how it got across not only firewalls, but airwalls.

Re:No

[Tom]

That's assuming you'd know. As I said above, you'd be none the wiser.

That's a criminal lawsuit right there, you are aware of that, yes?

As an IT professional you are supposed to work WITH me, not AGAINST me. Until you understand that, deceit is all you deserve.

I will gladly work with you. I told you how to initiate such a cooperative effort. Bypassing the corporate security measures is where you are working against the company.

I am 100% for making security a lot more user-friendly and cooperative than it is today. In fact, I've given the keynote on a security conference on that exact topic two weeks ago.

But that doesn't mean any joker who thinks he's smart can just go and violate all policies, bypass all security measures and put the entire corporate network at risk.

Re:No

[Mr. Slippery]

Let me get this straight: You would connect to the corporate network using a private, unapproved machine? And you would then connect that machine directly to the Internet?

Let me get this straight: your security plan assumes that no one does this?

Re:No

[Deorus]

Regarding attempting to connect to a corporate network? Yes, he would know, automatically, and with very little effort, provided that their network is configured appropriately.

We're talking about laptops here. There's nothing on a corporate laptop that I can't emulate on my own. Sorry to tell you, but you're clueless.

And yes, you could get around it, or attempt to, but you might be found out in the attempt.

ORLY?

Re:No

[Deorus]

But that doesn't mean any joker who thinks he's smart can just go and violate all policies, bypass all security measures and put the entire corporate network at risk.

The joke's on the policies, as the company was already at risk. It is WRONG to trust mobile devices, PERIOD, so if you're going to do it for whatever reason, at least do it transparently. Nobody's bypassing security that never existed to begin with.

Re:No

[Guspaz]

If you're willing to crack open the system, sure. But it *IS* possible to lock down a system sufficiently that you can't do anything to the system in software. Not necessarily with Windows, but if you're running an OS that doesn't let you do much, and the BIOS is locked, then you're not going to accomplish anything without cracking the thing open.

As soon as you're talking about soldering things onto the bus between the laptop's keyboard and controllers, you're no longer worried about the *employee* doing that, but somebody else who might steal the laptop.

Re:No

[Tom]

You sound like a modern dictator and the whole stuff sounds like modern slavery.

Please don't diminish the horrible reality of slavery by comparing it to policies within a corporation.

While i can see your point from a security stance of view, it's still not a valid argument to think you -and you alone- have absolute control over someone else.

No, but is the concept of "here are the rules, we expect you to follow them" really so hard to grasp? I am strict on enforcing the policies, yes. At the same time, I made it clear that the rules are not set in stone - give me a good reason to change them and I will be on your side.

Also, your arguments will be bull. The information is not safe, whatever locked-up solution you use. People could always just make a photograph of the screen, if not anything else.

Your safety should come from the fact that you _trust_ your employees. And to tell a little secret. Trust must come from both sides, else it won't work.

I'm not trying to protect against the user. That's idiotic, and any company feeling that it needs to do that needs its leadership exchanged.

I am trying to protect the user and the corporate network against whatever risks have been decided to need mitigation. In this context: Outside attackers. Usually, a part of the defense layers is network seperation. Someone who tethers the machine he's plugged into the corporate network to his iPhone so he can surf the web? I'm sorry, why are we even discussing this?

You, as IT staff, you do your best to secure your network and hardware. But as you can read in the rest of this article, as soon you overdo it, employees will find a way to work around it. And no, you will not all see them in your office. What you need to do here, Sir, is to find that delicate balance between security and workability.

I'd never have guessed. Oh wait, I just gave the keynote at a security conference on this topic.

One of the things I said is that we don't need more security awareness in users - we need more user awareness in security. So you can kind of guess that I'm all with you there on the basic idea. And still that doesn't mean any joker can violate the policies and push holes into the corporate security infrastructure just because he feels he's entitled to something.

I am entirely serious on the "visit me in my office" part. Don't take it word-for-word, what I am saying is that there should be a process for changes in the security rules and restrictions, and users need to be aware of it. If someone needs Internet access for his work, then by all means he should get it - but in a way that's in line with the requirements of the company, including security, and not by plugging his private notebook into the corporate network on one end and into his iPhone on the other.

If 'that information' is so sensitive, you should consider not putting it on a network at all.

Welcome to the 21st century. You can't really do that anymore. What you can do is having multiple networks, and if you require very high security, entirely seperated ones. Of course, that also only works until some joker tethers his iPhone to his... you get the idea.

If actions of your employees compromised your security, YOU did something wrong, not them.

That is a simplified view. In general, I will agree. However, there are many cases where organisational measures are more effective, easier or simply cheaper than technological measures. I could turn the entire building into a Faraday cage to make sure nobody tethers his iPhone to his... - but that's not exactly an optimal solution. Nor would the users be very happy that all their mobiles phones stopped working because I needed to make sure no idiot with an iPhone...

Yes, I am aware that I can stop him at the other end, and a properly configured network simpl

Re:No

[Deorus]

Sounds like you are more interested in punishing people than securing your networks... Your priorities are upside down.

Re:No

[Tom]

Let me get this straight: your security plan assumes that no one does this?

My network would be configured so that his notebook doesn't get talked to and a red flag in the NOC shows the presence of an unauthorized device. Because yes, my security plan would most likely say that we have defined connections to other networks, including the Internet.

Re:No

[Wescotte]

Because we are taught it's easier to ask for forgiveness than to ask for permission.

Re:No

[Tom]

You have a black-and-white image of trust and security that we abandoned somewhere in the 80s, I think.

Mobile devices are by nature less trustworthy than devices that remain within the physical perimeter you control, but there is no such thing as 100% or 0% trust in any halfway modern security view.

By all that is entirely besides the point, so let's burn the strawman down quickly and get back to the original point: Mistrusting the mobile devices was, in this example, exactly what the company is doing and is why our friend is putting his employer at risk so he can play FarmVille.

Security often relies on humans, like it or not. You can, theoretically, construct an entrance that guarantees through technological means that no unauthorized person can enter. In the real world, very few people outside certain TLAs would put up with something like that, and very few companies would even entertain the thought after you've told them what it would cost. Almost every real-world physical entry control has a human element.

The IT world is not so different, just less visible and touchable. Real-world security measures are a combination of technological and organisational countermeasures. You may be more familiar with the other term for "organisational measure": Policies.

Re:No

[izomiac]

Use a software firewall on your personal drive, or one of those portable miniature hardware firewalls. It's not like it can record very much into the BIOS. If you're extra paranoid, use something like System Safety Monitor to prevent the "self-healing" process. That-is, if it's more than marketing hype for a difficult-to-uninstall rootkit.

Re:No

[mindcandy]

As an IT professional you are supposed to work WITH me, not AGAINST me.
As an employee, you are expected to follow the policy as written, including the ones you disagree with.

Re:No

[mindcandy]

There's nothing on a corporate laptop that I can't emulate on my own.

When you get the phone call to pick up your already boxed personal effects from the guard at the gate, you'll re-evaluate the confidence in that statement.

Modern computers have a host of ways to verify a physical asset in ways that can't be copied (I'm not talking about spoofing a MAC address, I'm talking about device keys that are stored on the TPM chip).

Re:No

[Kagato]

I think there's more than just one solution. These days there's a lot of virtual and remote desktop applications. If you have a nice physical hardware barrier I think that's the best route to take. It will keep the employer from snooping and keep you off IT's radar.

I would also say that a lot of companies have intelectual property clauses that claim rights (at a minimun) to their time, their equipment. From that stand point I never work on my own projects on company hardware.

Re:No

[klubar]

If you are really serious about security on traveling laptops, one solution is a really dumb, cheap laptop and require everyone to securely VPN into a secure machine back at the office. When the laptop returns from overseas, it gets wiped, zeroed and re-imaged. If the value of the target is high enough, the laptop can be securely destroyed on return. (The cost of the laptop is probably less than the airfare involved in the trip, and then there isn't any question about a laptop that was out of company control being plugged into the network.)

If you're really paranoid you could rig a self destruct on the laptop if the proper code isn't entered every 24 hours.

Re:No

[walkeraj]

Agreed. There is no substitute for good network security. If your business doesn't have behavior and signature-based network security and an isolated-host wireless network with strong encryption and authentication, you are doing something wrong. Furthermore, if your VPN gateway is open to the world and the password is shared, ANY employee can log in using ANY machine they so choose. If this person is still able to get into your secured network despite reformatting the laptop, what does it matter which OS is on it? That said, it sounds like the real issue here is that you're going to be pushing your boundaries from day 1. You might want to cool it, put the POS company laptop into a box, and just use your own personal machine.

Re:No

[Anonymous Coward]

What a fucking idiot you are...

While on business, I left my laptop in a hotel... We did recover it...

According to you I suppose they should have just fired me.

Fucking tool idiot.

Re:No

[celtic_hackr]

You've never taken any computers into China have you?

Re:No

[mrzaph0d]

competent enough to install Linux or their own custom Windows image on there

I had this happen once. the "competent" user installed a pirated version of windows over the company image, didn't bother to put AV on there (which would have been included in the company image), had a partition with ISOs of at least a dozen pirated software packages (big ones, not joe blow's nifty gadget 1.0), and managed to infect his machine very badly before we caught it on the network and shut him down. i've still got his hard drive mounted on a plaque in my office.

Re:No

[celtic_hackr]

I think you need to be a little more detailed at the "and then magic happens" step.

If I can compromise your notebook in two minutes, it was never properly secured. How do you intend to get your backdoor on there? Type it in? Oh, you assume I have an optical drive and USB ports that will accept any arbitrary device someone happens to plug in?

How about this. I type in a url in your webbrowser and download my payload in 30 seconds or less and all your data now belong to me.There that wasn't so hard was it? It takes less than you'd like to think to infect a machine.

Re:No

[Mitreya]

Smartest thing I've read all day.

Not its not. "Buy yourself another laptop" is not a smart response at all! What is wrong with people who want to answer their own questions rather than the question asked? How retarded do you think the question originator is, anyway? Would they not think of such elegant solution on their own?? The original description specifically mentions travel, and having ONE laptop is hassle enough in the airport and weight-wise. Carrying a 2nd laptop defeats the whole "portability" factor.
The smart answers are "Carry a swappable hard drive for personal use" or "Have an external drive plus a live Knopplix boot drive".
And yes, trying to swap images on a work drive is a bad, bad idea, no argument here.

Re:No

[Runaway1956]

"A laptop in possession of a trustworthy employee governed by policy is not losing physical control."

You, me, the US Army, and Bradley Manning might kick that around in a discussion. We might come to some interesting conclusions.

Re:No

[Runaway1956]

What percentage of people are "deliberately installing malware"? All the same, we read of malware on government networks, corporate networks, banking networks, small business networks, as well as home networks.

On the one hand, I won't have a machine on which I cannot become root. On the other hand, if I have to administer a machine, I really don't want the user to be able to install anything.

  jhoegl wrote, above, "Not that I dont trust employees to know better, but I dont trust ALL employees to know better."

I add, "If I can't trust ALL employees, how do I determine which ones I can trust?

Re:No

[Anonymous Coward]

I second that (or 2,178,973 that). Leave the corporate HD alone. No touchy!!! Be VERY aware of a divide between your stuff and the company stuff. Watch what you put on your own USB (no work files), and make sure software on the USB is clean... 100% squeaky clean. A good network admin can see your USB or at least see running apps. Mucking with the HD would be an instant dismissal at most places I have dealt with.

Re:No

[Anonymous Coward]

Just carry a spare hard drive. When you want/need to do company work plug in the company drive. When you want/need to do personal work, power it down, plug in your own drive, and do what you need to do without worry.

Re:No

[Glonoinha]

Impressive. Does that work on against Firefox running NoScript and AdBlock on a Ubuntu boot thumbdrive that doesn't mount the hard drive?
I'm genuinely interested in an honest answer, and if the answer is 'Yes' I'm interested in details, because many on this thread believe that a boot thumbdrive running FireFox or Chrome on Linux is the holy grail (myself included.)

Re:No

[fast turtle]

The only true answer is to ask the IT dept first. Otherwise you risk the real possibility of being fired for little gain.

As a small business IT admin, we had an employee that violated the written policies and as soon as it was discovered they were fired for good cause. Keep in mind that no business is going to retain an employee that knowingly violates policy as the legal risks are too damn expensive. It's cheaper to get rid of the problem employee.

Once again, the first thing to do is ask as most companies shouldn't have any problem clarifying how and what constitutes a violation and if it's a large company, get it in writing for your records - CYA if they decide you violated the policy. If they wont put it in writing, forget it and get your own system to take with.

Re:No

[dj245]

The simple solution is get yourself a USB / livecd type distro. Don't touch the hard drive..

I agree, but you don't need a livecd. Livecd's have a lot of disadvantages when it comes to speed. For a while, I was using 2 hard drives, swapping them when I needed change between work and play. It only takes a couple minutes, and you aren't endangering the sensitive data on your work hard drive. You can keep the drives totally separate. The only problem I had was keeping the "other" drive physically safe. My "play" hard disk was an SSD so no problem there. But the "work" hard drive failed after a few months because it was not being transported in a shockproof way.

Re:No

[frup]

All of you who have replied to this are missing something crucial.

Sure he might have some silly ideas on what to do, that's why he is asking for your advice. But saying he should take a personal laptop isn't the solution. The reason he is probably looking for an answer is because he doesn't want to lug two laptops around!

I would think if your company denies you access to news sites and facebook etc. while you're away in your own time, that's a little harsh. But if the OP is just wanting to look at porn while he is away... come on, surely you can go without a few days!

Re:No

[Anonymous Coward]

Buy a similar hard drive, install OS of your choice. Swap yours for your employers as necessary. On most laptops this is dead simple. This works for me and my company laptop. One screw, replace cover...done.

Re:No

[toddestan]

Let me get this straight: your security plan assumes that no one does this?

You can buy routers and switches that can enforce this. So while you can't really assume that no one will try it, you can reasonably assume that any casual attempts to connect an unknown device to the network will fail.

Re:No

[Anonymous Coward]

By golly, yes, those rouge hotspots are not to be trusted. I'll never trust a hotspot that's wearing too much makeup.

Re:No

[ArsonSmith]

Inserting a small usb device that registers itself as a keyboard and continuously opens IE to a compromised page, downloads and runs a program using just preprogrammed keyboard shortcuts.

Re:No

[Anonymous Coward]

Let alone I can detect how you do that and catch you!

Re:No

[tlhIngan]

Yes, I'm contracted out to a company who has monitoring software on the laptop.

One guy got reported because he played an MKV file on the work laptop at home. Off a thumbdrive, so it was never even downloaded to the laptop - he just copied it to watch.

No, he didn't get fired, but it's ended up on his HR profile.

And no, you can't VPN in from a non-issued laptop - the VPN software verifies it's a company build.

I don't know when the software does its reporting, but to be honest, a cheap netbook isn't THAT expensive and they're fairly light and portable. If you spend a bit more you can get something like an ultrabook and use that for personal stuff.

And invest in a good 3G/4G dongle.

Re:No

[the_B0fh]

It really doesn't fucking matter - *IT IS NOT YOUR LAPTOP*

Re:No

[steelfood]

You're missing the fact that his company's setup even allows him to connect to the internal network with an unauthorized device at all.

And you're missing the fact that the IT people are currently "none the wiser".

Both speak of an incompetent IT department, or none at all. Any mid-sized or larger company's IT department would have first denied all unauthorized connections, and second be monitoring such breeches. There's a huge difference between a Mac and a Windows machine from an administrative standpoint, and a Mac would stick out like a sore thumb in a properly-monitored Windows environment.

And before anybody says it, any shop using Macs for an enterprise intranet solution is asking for it. There's a reason why every large non-software company has an Active Directory deployment for their employees' personal machines. Microsoft might make crappy home software, but their enterprise solutions are top notch.

Re:No

[Alex Belits]

No, it means that different employees have different levels of trust and different responsibilities.

Re:No

[Anonymous Coward]

No, you really can't. You might be able to fool yourself into believing you've done this though.

Re:No

[CSMoran]

if you're running an OS that doesn't let you do much, and the BIOS is locked, then you're not going to accomplish anything without cracking the thing open.

Well, there's this trick where they irradiate the RAM in your laptop or perhaps heat the CPU without cracking the laptop open, hoping for the right bit to flip in the RAM or the right register in the CPU and voila, suddenly you're executing attacker's privileged code. I'm not saying that's easy, but it's been demonstrated to be viable. The PC is not cracked open, and they've accomplished something.

Re:No

[unixisc]

Buy another laptop or tablet is definitely a smart response. What's wrong w/ people giving him just the advice that will keep him out of trouble, and in his job? If he's talking about what he does @ home, he can get his own laptop to use at home, assuming that what he does involves a lot of typing. Or else, he could use a tablet. If he's talking about travel, then as several people suggested, he can take his laptop AND tablet and go. If he plans to work on the plane, he can have his laptop bag as carry-on luggage, and if he plans to just play games, he can pack the laptop in the suitcase he checks in and play on the tablet while flying.

Swappable hard drive is fine, but has one problem w/ it - whenever he leaves the company and has to return his laptop, he will be forced to restrict his shopping to laptops whose form factors support his swappable drive. Or else move the data from there into his next laptop and have an useless piece of equipment lying around. Assuming that what he needs fits in an USB drive, that would be a somewhat better solution. But I just can't get over the apparent insistence on using the work laptop for personal stuff. Not only is that bad for his employer in terms of the company laptop being potentially compromized, but it's also bad for him, since he'd have personal data there (like bank account numbers) that are better off in his own laptop.

Re:No

[olliM]

That's what the rapists say...

Re:No

[Anonymous Coward]

Warning: Parent is clearly a DEV-OPS type who knows better than all his other colleagues in IT.

Re:No

[Anonymous Coward]

That's a criminal lawsuit right there, you are aware of that, yes?

Dude - you are full of shit. *YOU* are *NOT* his manager. If it is approved by his manager *YOU* have *NOTHING* to say about it, including accusing him of doing a crime!

Re:No

[SpooForBrains]

Just don't put your laptop to sleep running Linux, forget and swap your Windows hard drive in, then wake it up. I'm still puzzled as to how that made such a mess of that drive. (To be fair, this was in the days of EPM suspend and the Windows drive was running Windows 2000)

Re:No

[Tom]

I'm the guy telling his manager what he can and can't do on the network. His manager can not override corporate policies. Have you ever worked in a corporate environment?

Re:No

[Tom]

Assuming an unfiltered network connection, the ability to install your payload, a machine policy that allows you to get at the data, etc. etc. etc.

Here, take this: upload your data to your evil.com website. That is a realistic scenario. Hide the window so the upload can continue in the background.

But that doesn't compromise the notebook.

Re:No

[Deorus]

When you get the phone call to pick up your already boxed personal effects from the guard at the gate, you'll re-evaluate the confidence in that statement.

I won't, I am 95.2% disabled, I can justify my hardware choices and it only takes a little resistance from IT for my responsibilities to be waived. Companies are entitled to benefits for employing me, and as the saying goes: Money talks; bullshit walks. ;)

TLDR: I own your ass.

Re:No

[Anonymous Coward]

It isn't a "criminal lawsuit" offence to connect your laptop to your work's network, assuming you had no malicious intent. I can't see anyone wasting their time prosecuting this.

It would be a civil suit at best, and even that would be a waste of the companies time. If the guy broke the rules he would get fired, and of story. If the company could prove he was responsible for some loss, then perhaps a civil suit would have some merit, but unless he has money, it would be a waste of time. Most level employees that are going to pull this shit aren't swimming in money.

Re:No

[Anonymous Coward]

OP - here's the one piece where your plan fails : the active directory connection establishing your machine as a trusted member of the domain, and your user as the domain with the same name ... disconnects if it hasn't been refreshed in a while. I don't know how long it takes, but it happens. And it is a particularly uncomfortable discussion with corporate IT explaining why, given that your machine looks exactly like it did when they gave it to you, and you have been using it for a few months. The question is going to come up 'What did you do to it?' and you are going to answer just like they expect you to 'Nothing.' ... and it goes downhill from there.

I think you are seriously overestimating most corporate IT. In my experience, the average IT worker dealing with PC or network problems isn't terribly clever or well educated and likely as not they will just want to re-image your system. I have worked in a couple of the biggest IT companies in the world, and we just built our own images and if we had a problem, central IT would just stick the standard image back on. Often standard corporate platforms don't work too well for developers and there is just no choice but to work around them. The trick is simply to have someone important that knows what you are doing and will cover your back if anyone complains.

Re:No

[wvmarle]

Agreed. Leave the thing alone. The software installed on it is there for a reason; it's the way the company thinks is safest and most productive.

Now if you re-install it with your flavour of Windows, with your flavours of security software, and something goes wrong (you leak data): it's your fault, period.

If the laptop is with company-mandated software, managed by your company IT department, and you lose data: you can put blame on the IT department for not having it secured properly. This assuming you followed their regulations.

Re:No

[Anonymous Coward]

IMO if the user is competent enough to install Linux or their own custom Windows image on there, I don't think you are any worse off than it was previously. Seeing how out of date some IT departments are with patching and service packs, the machine may end up being more secure.

I can imagine an approximatively installed Linux system with a weak password and an uncountable number of services and servers that this user don't even know they are actually running. In this case, an outdated MS-XP with a good firewall and all the carrying of the IT department would be a more secure option.

Re:No

[Anonymous Coward]

"Computrace will self-heal onto your second drive" ...how, pray tell, might this mysterious "Computrace" achieve this? Modifying the BIOS?

Re:No

[Anonymous Coward]

I'm the guy telling his manager what he can and can't do on the network. His manager can not override corporate policies. Have you ever worked in a corporate environment?

I don't think the Tough Guys(tm) posting here ever have, especially the one who said you'd be "none the wiser" (right up to where the MAC address hits the switch port).

In 20 years and 6 employers, I've never worked for a manager who would've approved such behaviour. Nor have I worked for any company who would have tolerated the behaviour, even in the face of management approval. Such a manager would have been shitcanned right alongside me. In at least one case, _yes_ there would have been charges, as there would have been external consequences to the company violating customer agreements vis-a-vis security, as in, say, military contracts.

Posters advocating for such behaviour need to realize that it is not their equipment nor infrastructure to use. They are not entitled to its use, nor are they entitled to a policy that's convenient to them. They can raise the issue with management, they can lobby their IT department for exemptions or dispensation. But ultimately, if they well and truly cannot tolerate the conditions of employment, they are free to seek employment elsewhere. They are not and never have been free to disregard and subvert their employer's policy in the use of their employers equipment on their employer's time.

My advice to the OP, get your own gear. Proceeding down this path will only in tears.

Re:No

[Anonymous Coward]

My solution has been to install an operating system on an eSATA or USB external drive then boot the laptop/PC from it rather than the internal drive. So long as I don't mount the interal drive all I've done is run my operating system of MY drive on THEIR computer without touching any of their storage. At the end of it all there is not even any log files left on the internal hard drive to indicate that there has been anyone using the machine.

For work I boot from the internal drive. For personal use I boot from the external drive. It lets me get away with all sorts of naughty things. :-)

Re:No

[blueg3]

Say what you will about Bradley Manning, but "trustworthy employee" doesn't really strike me as an apt label.

Re:No

[ImprovOmega]

OP - here's the one piece where your plan fails : the active directory connection establishing your machine as a trusted member of the domain, and your user as the domain with the same name ... disconnects if it hasn't been refreshed in a while.

Technically speaking, the machine account password is changed every 30 days. This change happens automatically and is initiated by the client (so the laptop that's been off the network for 6 months that's suddenly plugged in will still work). So if you gather an image and power it up in "work laptop" mode, you run the risk of the machine account password being changed on you. If you subsequently refresh the image the machine will not be able to talk to Active Directory because it is trying to use an outdated machine account password.

Bottom line, it is possible to flip back and forth through image gathering, but the only way to be safe is to gather a fresh image every single time you go to change the system from work to play mode. It's wholly impractical unless you're very very patient.

It would be better to get a cheap used netbook for personal use or in the extreme case a secondary hard drive that you physically swap when needed (still not recommended as I.T. may notice and punish you for messing with the hardware).

Re:No

[Tom]

It isn't a "criminal lawsuit" offence to connect your laptop to your work's network, assuming you had no malicious intent.

That depends on your jurisdiction. The UK laws are pretty strict and don't require intent (presumably because intent is always hard to prove). In the US things are more complicated due to varying state laws. Many of them require intent of your actions, not malicious intent. In other words, his way out would be to claim so much ignorance of security that he didn't know connecting a corporate network directly to the Internet is bad, or so much ignorance of networks that he didn't know his tethering action would open the corporate network to the Internet at large.

But my comment was even more specific than that. Note that I didn't make the point in my first reply, I made it after he basically wrote "fuck the corporate rules, I think they suck" - i.e. he is both aware of their existence and intentionally breaking them - and "I am intentionally deceiving you because I think you deserve this" - the legal term is fraud - he is intentionally hiding relevant information for his advantage, knowing that doing so causes another party damage. That is the legal definition of fraud, and fraud is a criminal offense.

Re:No

[Anonymous Coward]

The real solution here is to leave your work laptop alone completely and get your own laptop for personal use.

Go Fish. This post is entirely suspect. You know who you are. We are living in a day and age when comments so obviously corroborative with national security under guises of incompitence such as this one is so in need of spanking. Don't waist these readers' time with this psuedo grovelling baited malarky. As if it isn't so obvious as answered by the very first comment.. get your own laptop.

Re:No

[Creechur]

Agree completely. But on the flip side: as a developer, I'm not being paid to care about those things, I'm being paid to get my work done. When IT policies make it nigh impossible to do my work, and my choices are 1) spend months trying to cut through red tape, instead of doing my job, just to do things that I'd be able to do if there were no IT department at all in place, or 2) bypass some policies and do the things that actually make money for the company, #2 starts to look damn attractive.

A lot of this depends on the company. I've seen the other side of the fence, and understand that point of view. Even at companies with well-run, reasonable, flexible IT departments, there's always gonna be a few know-it-all clowns that want to bypass IT and do stupid things, because they think they're smarter than they are.

But some IT departments are so rigid and inefficient, so narrow-mindedly set on enforcing policies that only work for general office workers (who can do their work just fine with a very limited number of tools), that working around them is the only practical solution for some employees. If that's not how your IT department is, then I applaud you. But don't assume that everyone who bypasses their IT department's policies is simply "arrogant", "self centered", or "some prissy dev".

Re:No

[Coz]

Agreed. I carry my own laptop and the work laptop when I travel. The work laptop is imaged, controlled, and dedicated to work, and I don't do ANYTHING not work-related on it. If I want to video chat with my wife and kids from across the country, I do that on my home laptop.

Do NOT screw around with these machines. If you work for my company and it's discovered you've done something like this, for any reason, you're gone, and they're going to dissect the machine and see if you were careless with company confidential material, or if you used peer-to-peer software, or anything else that would put their data at risk. Porn, gambling, or other similar behavior is an escort-you-from-the-building offense if done on work systems.

It only takes one breach to make companies paranoid, and most have had that breach. Don't be tempted - be responsible.

Re:No

[Anonymous Coward]

If you are an IT Security/Compliance office, and allow an unapproved machine on the network, I would fire you. You claim to know something about security. You either design your network so it can be secure allowing any device to your network, or you only allow secure devices.

Re:No

[AG the other]

The problem with trying to boot to an image or live CD is that where I used to work all computers were set to boot to the hard drive first and had a long and non simple BIOS password so that users couldn't change any settings.
I'd agree with you that he should get his own machine.

Re:No

[anyGould]

If technical answer #1 doesn't work for you, here's technical answer #2 for you : remove the work hard drive, install a new hard drive, install your own OS on that and swap out drives for work / pleasure. Downside is limited to the danger of physically borking the work drive while removing it or storing it while it is out of the machine. Explaining how you managed to mangle the SATA connector on a work laptop is a very difficult discussion.

Also, cracking the case on your work-issued machine is likely to make you few/no friends, either in management *or* IT. The IT folks won't like that you're fscking with the hardware unnecessarily. And management will put you in the same category as the folks who dismantle their desk.

If you need access to XYZ for work, go get it approved. If it's for pleasure, get your own gear (or at least get a nod-and-wink approval from IT before you start tinkering with their equipment).

Re:No

[Anonymous Coward]

While you talk big, as soon as you try to say my-way-or-terminate to someone (an executive) that is far beyond your pay grade, *you'll* be given the choice to do what he wants, or you'll be terminated.

Your 'for a reason' has many caveats. You may be the Compliance Officer, but you do not have control over the business.

Re:No

[Tom]

That is why the Security/Compliance Officer reports to the C-level executives, and isn't some kid stuffed away in the IT department. If your boss has a boss who talks to the IT director, then you aren't a Security Officer, no matter what your business card says.

Look, when I say "for a reason", I don't mean "I made something up". I mean there has been a risk analysis, signed off by top management, resulting in a corporate security plan, signed off by top management.

With that in my pocket, I will tell anyone of any pay grade that he can't do this. If he is a bug guy, I will add that he is, off course, free to talk to the top management if he wants the policy changed. But until then, I have the signature of the CEO that what he's doing is not allowed.

Re:No

[Tom]

If you are an IT Security/Compliance office, and allow an unapproved machine on the network,

Strawman. Whether or not his setup would even work isn't the topic under discussion here. You are right that it shouldn't even be working, but that isn't the point.

Re:No

[Gr8Apes]

When you get the phone call to pick up your already boxed personal effects from the guard at the gate, you'll re-evaluate the confidence in that statement.

I won't, I am 95.2% disabled, I can justify my hardware choices and it only takes a little resistance from IT for my responsibilities to be waived. Companies are entitled to benefits for employing me, and as the saying goes: Money talks; bullshit walks. ;)

TLDR: I own your ass.

IOW you are capitulating and agreeing that you cannot connect things to a network without being found out?

Just wanted to be clear here since it appears you stepped outside the original claim and are now using a completely orthogonal clause to remain employed. I should also note that it would strongly depend on the company you're employed with, several I've been associated with would still give you that call, from the gate, if you were lucky. At least one you'd get that information as you were being booked into a federal prison. (Something about circumventing national security and them not giving a rats ass about you being disabled)

The hubris you exhibit, independent of the truthfulness of any of your other claims, would instantly put your application in the round bin were I your interviewer.

Re:No

[celtic_hackr]

Depends. If I have time to be at your computer while you're logged in, it takes only a few seconds to disable noScript and Adblock. Restarting FF or Chrome, if necessary. So NoScript and Adblock are NOT a defense against the Black Arts against anyone who has, limited, physical access to your machine. Running off a thumbdrive, still allows one to compromise the thumbdrive. unless you've made the thumbdrive non-writtable in some non-trivial way. Compromising Linux is harder, unless the user is running with root privileges. If you've just run a "sudo" command recently you are vulnerable to any attack needing root privs. A "smart" malicious code running in RAM, should be able to detect such an event and exploit it. I'm not sure, if anyone has made such a hack, but I could do it fairly trivially. If I can do it trivially, there are thousands of others who could also. While. I'd like to claim to be a super elite Linux white-hat/gray-hat hacker, I'm not. Sure, I know how to write drivers and shell scripts, and can code in many computer languages, I'm no Alan Cox.

Your holy Grail is more holey than Holy. There are very limited things that can be done with stock equipment, and physical access to a machine will always be among the most dangerous attack vectors. Still the thumbdrive, with no privileges and no sudo, running only in a VM is about as close as mere mortals can reasonably hope for now. So it really depends on how secure you made the thumbdrive. Implementation is important. Your design may be a good one, but unless it is implemented correctly it is not going to be necessarily effective.

Re:No

[Anonymous Coward]

Windows is so full of glitches, that everyone will think this is another random bug.

Re:No

[Anonymous Coward]

This. So much this.

If you ask if you can check your personal email and Facebook, there is a good chance that IT has to say "No, you might expose the company to harmful viruses that you may receive through these non company methods of communication." But if you get 'caught' using them, IT won't care, unless they told you not to.

I'm talking from personal experience here. I know somewhere in company IT policies, I should never check personal email from a company machine, but both IT and my direct managers have observed doing it and do not care what-so-ever.

Of course if he was going to be fired for some other reasons, I'm sure they would tack minor violations like this onto their reasons, but until then, it is easier to bring one laptop on business trips and not have to deal with live CDs.

Re:No

[n7ytd]

Once you lose physical control of a machine, you really can't say much about the security of it. You don't know where that laptop has been or who else might have tampered with it while it has been traveling the globe.

And once the user turns it back into the IT department for replacement/reassignment/disposal, the a competent IT department will wipe and re-image the machine anyway, so it really isn't an issue unless you are allowing the computer to connect to your internal network without any firewalling or virus scanning.

The correct approach for the OP is to ask the question of his IT people what their expectations are, not Slashdot. A reasonable person would expect that some personal use will occur, but then again, it's really up to the owner of the machine.

Re:No

[Anonymous Coward]

Let me get this straight: You would connect to the corporate network using a private, unapproved machine? And you would then connect that machine directly to the Internet?

It's what users are going to do, regardless of what you tell them. You can either design your security policies to accommodate it, or keep trying (and failing) to change them.

Re:No

[Mista2]

And users like you is why we have Network Access Control on our switches. If it doesn't authenticate, it goes into remediation VLAN where it can see our av update server, and that's it.

Re:No

[Runaway1956]

That was more or less my point. ;^)

Obviously, some people at some time believed Manning to be trustworthy, or he wouldn't have had the clearance to do his job. But, added into the statement that Manning was NOT trustworthy, is the fact that the US Army was incapable of recognizing that Manning was demonstrably NOT trustworthy.

I mean, please - how many times must a person verbally and/or physically assault his supervisors, before he is dismissed?

Re:No

[Flendon]

Their are several well known adages in the IT security field. The most important one is that the usability of a system is inversely proportional to the security of the system. The corollary to this is, the only secure system is the one locked in a safe with no power or internet connection. I've worked cases of documents being stolen from computers which had never been connected to the internet and had all the security bells and whistles. If the computer is required to be capable of running software (kind of important for most users) security holes will be found. No exceptions. The biggest threat I've seen to network security is admins who are overconfident in the security of their network.

Re:No

[Glonoinha]

Ahhh - I missed the 'you take physical access of my machine for a few minutes without me being present' part.
Yes I agree with you on that part - the minute someone loses physical control of the hardware all bets are off.

I was more interested in how effective the setup I described was against anything I could accidentally run across on the web on my own, while still being the only one touching the keyboard. I prescribe it as the Holy Grail for people that surf indiscriminately, in the wild wild west, but maintain physical control of their box. I was hoping to get either affirmation or a description why I was wrong in that case (and if you're still reading, I'm still interested.)

Re:No

[Flendon]

Given that mode of thinking, I would assume you would check the image of returning employees laptop hard drive for malicious changes installed by professionals.

That is the funniest thing I've read in a long time. Thanks for the laugh.

Even if you trust your employee completely, the laptop has been in the hands of customs and other unknown people while in the world. It can't be assumed safe until re-imaged. Finding any attackers code would be a bonus of the 'standard' harddrive swap by IT on return.

Very true here. However, most IT departments have more important things to worry about, like making sure the new security patch isn't going to interfere with the CEO's favorite gambling website. Looking for malicious code isn't going to be on any priority lists when a wipe will "solve the problem".

And no it wouldn't be that bad. Employee has only had laptop for a few days. Tech pulls old drive, installs standard image replacement, checks for nonstandard flash, updates crypto, puts back on shelf. Tech installs old drive in USB enclosure, enters crypto key, scans then copies data folders to employees user folder, then runs paranoia process on OS and drive. If nothing found drive re-imaged and put back on shelf.

To the employee it looks like he turned in his machine and his data showed up in his folder 30 minutes later. To the tech it looks like he has a job doing paranoid shit, until one day he finds the next Stuxnet.

An anti-virus scan will only catch malware that is widespread and has been in the wild for several days. Look how old Stuxnet was before it was detected by A/V. Their are other custom jobs that have gone years without detection as well. The 'paranoia process' would require a forensic examination. A decent forensic triage takes at least 4 hours on a smallish drive. A full examination can take days just to determine if something unusual is present. Than you have to take apart that unusual piece of software just to find out you are chasing down the wrong rabbit hole. This is the kind of work it takes to find the next Stuxnet.

Unless you are in the security industry then some VP is going to look at a poorly done risk assessment, look at the pricetag as overhead, and slash the budget, thinking "that won't happen here" and put down on his next review how many millions he just saved the company. Even in the security industry this isn't done nearly as often as it should.

Re:No

[Anonymous Coward]

Please stop using common sense it confuses me.

Re:No

[rtfa-troll]

This doesn't work against hardware encrypted hard disks which is what the "lock it down completely". E.g. if you steal a Thinkpad you will end up having to replace the TPM and the firmware of the hard disk completely. My methods, basically variants of the "Evil Maid" attack will allow you to attack even those systems.

Re:No

[HornWumpus]

Remember this OS went out as a locked down image.

If anything added itself to startup (or alternatives) then you have a person look at it.

If binaries have changed then you have a person look at it.

If there was one admin equivalent login while in the world you have a person look at it.

Finally I haven't worked it an environment where corporate espionage is known to be active, I doubt you have ether. I would think Intel (for example) would have military grade security at it's chip design centers.

Any F1 team that didn't do this kind of thing would be owned by the red team in seconds. I had to laugh at how Ferrari's spies setup MacLaren's spies a few years ago. How much did those forfeited points cost them (millions I know).

Re:No

[HornWumpus]

I'd just like to add that finding the attackers code has a very large upside.

If you can feed your competition bad information you will own them.

Re:No

[Anonymous Coward]

Oh, you assume I have an optical drive and USB ports that will accept any arbitrary device someone happens to plug in?

Are you running windows? Then yes I do assume I can access your usb ports.
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-0638

Re:No

[Anonymous Coward]

In several environments in which I've worked, as the IT Security/Compliance Officer I would recommend you for immediate termination.

I think I would recommend you for immediate termination if you let untrusted computers on your private network.

Re:No

[celtic_hackr]

Yes, running from a thumbdrive is extremely effective, at protecting your unmounted harddrive while browsing. In addition, you could keep a known clean image of the thumbdrive on your harddrive, and everytime you plan to use the thumbdrive you first push down the clean image from the laptop. Or keep several thumbdrives, that you cycle and refresh. That way you minimize the risk of infecting your machine from the thumbdrive. Different root passwords for the thumb and laptop. Etc.

Lots of other tricks.

Don't go there...

[icebike]

Just get a Tablet/Netbook of your choice and use that for web surfing, personal email, video and music streaming, etc.

Its a far more honest way of going about it, and by shopping around you will find a tablet that fits your needs, and can be slipped into the same carrying case the laptop uses. You may only need a wifi model, but tablets with data plans are not that expensive. You can add encryption to the tablet, if you want.

This gives you the freedom to do as you wish, and you can still move things back and forth between the tablet and the laptop as needed via any number of means when you have a legitimate reason to do so.

If you expect there to be tracking software on the machine out of the gate, then trying to go down the deception road is just a Bad Idea. Key loggers will log what ever you do, and removing them is not likely to go unnoticed. Key loggers things, if properly installed, can even read work you do in a USB thumb-drive based Linux distribution. And depending on how savvy your company's IT department is you may find any attempt to use the laptop in way other than what was intended will trigger alarms. Wiping the drive and restoring it to some back level state amounts to an admission you were doing something you weren't supposed to do. And you may not be given the opportunity to do so, when IT walks in (or accesses it remotely) to do a routine upgrade, and finds all sorts of ebooks and games, etc.

Nope, my advice is to celebrate your first pay check with a gift to yourself of that Tablet or Netbook you've always wanted. This way, you and your employer stay on each other's good side.

Re:Don't go there...

[Anonymous Coward]

Agreed. It's THEIR notebook, not yours. They bought it. It belongs to them. They have loaned it to you for work purposes. Don't abuse that by messing around with it.

If you want to do other stuff, buy your own notebook, tablet or smartphone.

Re:Don't go there...

[jjp9999]

And even if you do wipe your notebook and this works, it will look weird when they look at it and ask you why it has no work logged on it.

Re:Don't go there...

[vlm]

Key loggers things, if properly installed, can even read work you do in a USB thumb-drive based Linux distribution.

Thats weird, unless you're talking about a hardware logger, and thats even weirder because most laptops don't have space for it. Plug in a USB keyboard?

Re:Don't go there...

[K. S. Kyosuke]

Agreed. And if you happen to recollect that you have to stop by the grocery store on your way from work while driving your company's car, park it at home, get into your own vehicle and only then go shopping, because that's clearly the most reasonable thing to do.

Re:Don't go there...

[philip.paradis]

Key logging can also be done in BIOS.

Re:Don't go there...

[icebike]

If they give you a company car to take home, chances are they allow grocery shopping.

But if you have to jump on Slashdot and ask about GPS jammers and how to disconnect your built in Nav in a company car so that the company can't know that you routinely stop by the strip club on the way from/to customer meetings, you already have stepped over the line.

Re:Don't go there...

[Patch86]

I doubt they'll mind him reading his favourite news website or going on Amazon on the new work laptop, you know. They might take issue with him installing a pirated copy of Crysis, or downloading porn.

The question isn't really whether they'll mind him doing stuff on their laptop, but whether they'll mind him massively messing with their software and hardware setup- live booting, partitioning, wiping and restoring, swapping out HDD, and all the other stuff suggested in this thread. If nothing else, it's classic "guilty behaviour"; how do they know whether he's doing it to hide his porn habit, or hide his massive illegal company fraud? If they think he's going to a lot of effort to deceive them and hide his behaviour, they're going to assume the worst.

Going on Amazon on the company laptop is the equivalent of going to the supermarket in the company car. Wiping the company laptop's HDD is the equivalent of popping the company car's bonnet and replacing components with ones you've bought on eBay.

Re:Don't go there...

[Anonymous Coward]

How exactly does the BIOS transmit the keystrokes back to a server? Can you give an example of a laptop that does this out of the box?

We'll assume this is technically feasible out of the box (a BIOS with a TCP/IP stack, ethernet drivers, and wi-fi drivers built in)

IMO, if the company is dedicated enough to log keystrokes and actually review them, you either work for a psychopathic CEO/CIO with a *lot* of time and money to invest in monitoring their employee base (how many employees are they actively monitoring at what cost?) or your job is *very* sensitive to demand special monitoring (government, financial data, or millions of dollars of highly sensitive trade secrets that absolutely can't be lost). But chances are you know that already if you're in one of these situations.

The average employee who carries a laptop is NOT in one of these situations. I can also tell you as someone who actually has been involved in a corporate laptop rollout, none of the laptop options we were made aware of in the selection process included built-in keyloggers like you described. A keylogged laptop would be either a custom job ($$$) or in the higher-end / expensive line of corporate laptops if they even exist in the standard lineups.

If I had an employer like that, I'd be more worried about them turning on the camera and microphone.

Re:Don't go there...

[golgotha007]

I haven't been on Slashdot in years, but I can see that the trolls are still out in force. One day...

Re:Don't go there...

[Anonymous Coward]

If some company installs GPS trackers to find out where their employees spend their leisure time, i'd say it's the company that crossed the line first. I can't imagine any reason to put up with shenannigans like that. Employees _do_ have a right to privacy, even in the face of corporate paranoia.

Re:Don't go there...

[Oligonicella]

And my guess is he can watch a DVD on it. Equivalence met.

Don't drive across state. More equivalent to installing your own software or bypassing security.

Re:Don't go there...

[Anonymous Coward]

So yeah, anything that the company lets you borrow is up for abuse however you see fit. You deserve it. Take the office chair home with you on the weekends, remove the blinds from the cafeteria and install them in your house, file expense reports for your trip to the strip club - you briefly thought about the secretary at work during the pole dancer's routine, after all! And of course, install whatever you want on your work computer regardless of the policies. Those stupid IT guys should have no problem supporting 50,000 unique workstations, each with different combinations of software. You're a "computer guy" anyway, so you don't need their support.

Re:Don't go there...

[Oligonicella]

Company cars aren't for leisure time. Use your own car.

Re:Don't go there...

[nbvb]

Not true.

It's absolutely accepted - and encouraged - to use our company-issued vehicles for personal use, including vacations.

Not all policies are completely draconian.

Now, having said that, modifying the vehicle (i.e. adding a remote starter, changing the radio, installing NOx) is strictly forbidden.

The person who posted this "question" really just needs to buy his own laptop. A MacBook Air would work well for travel. Even at home, I do the same -- work on one machine, personal on the other. Point, set, match.

Re:Don't go there...

[moronoxyd]

Agreed. And if you happen to recollect that you have to stop by the grocery store on your way from work while driving your company's car, park it at home, get into your own vehicle and only then go shopping, because that's clearly the most reasonable thing to do.

Apples and oranges.
Driving around with two cars at once isn't possible.
Carrying two laptops (or a laptop and a tablet) is.

Plus, the equivalent to do grocery shopping would be browsing some news sites or reading private email. That would probably not be a problem with the work laptop.

But making an image of the hard drive and installing a different system is more like changing the engine of your company car because you want something with more power and storing the original one in your garage.
I'm pretty sure that even you would agree that that wouldn't ok.

Re:Don't go there...

[icebike]

It's absolutely accepted - and encouraged - to use our company-issued vehicles for personal use, including vacations.

Where is this accepted?
Perhaps for upper management where they write a perk into their contract, but it is not at all common or encouraged.

Re:Don't go there...

[unixisc]

If a company feels the need to install GPS trackers, they shouldn't be issuing company cars in the first place. But here too, I agree - use the company car only for work related activity (like driving to another office, or to your sales rep) and bill them whatever you spend on gasoline. But once home, for anything else, from picking up Suzie from school to going to Costco, use your own car.

Re:Don't go there...

[rtfa-troll]

Company cars aren't for leisure time. Use your own car.

Neither you nor the other who replied to you are right. Some company cars are taxed benefits and you have the right to do what you want in them in full privacy. Others are untaxed and you should only be doing work in them.

Re:Don't go there...

[PNutts]

Posting as AC is good when you don't understand the discussion.

Re:Don't go there...

[philip.paradis]

It doesn't transmit keystrokes back to a server. It simply logs them, and the administrator audits that later. There are a couple of commercial systems available that do this sort of thing.

The BIOS-based stuff has certain limitations, though. For extra fun, there's some evil stuff based on SMM floating around.

I'm not going to make a judgement call on the psychological state of any given company's management. That said, you might be surprised how many organizations are very interested in utilizing techniques like these to monitor all sorts of things. In the end, it is their equipment.

Re:Don't go there...

[Anonymous Coward]

Just for the record. I've expensed strip club costs. I was buying drinks for clients. The girls don't give receipts so I was out most of the money, at least I didn't waste it.

This is routine when your clients are government sponsored non-profit monopolies full of Engineers. They all have strict rules against this stuff, but, in my experience, all have loopholes a mile wide.

We billed them back the expenses (+15%).

Big cheeses we took (with their wives; squares) for $300/person dinners, plus wine. Again, we billed it back. At least snooty waiters take plastic. Strippers would have your ass kicked just for trying to swipe your card (not a black AmEx, that's different, a black AmEx would make a stripper orgasm).

Good times.

Re:Don't go there...

[fafaforza]

I don't see browsing cnn.com while waiting on hold for a conference call or something as abusing their property.

If concerned, ask them what is allowed. If you want to keep everything separate, install a VM and use that so that nothing on their system is affected.

Re:Don't go there...

[FormOfActionBanana]

In the United Kingdom this is pretty standard.

Re:Don't go there...

[Anonymous Coward]

It is in the company Fleet Management Policy, which I have to sign and agree to yearly.

To quote: "Please note that participants are permitted to use their Fuel Card at any time when operating their company vehicle (e.g., after business hours, over weekends and while on vacation within the US). However, Fuel Cards are only valid and useable in the United States."

That's only one section which indicates how and when personal usage is not only permitted but encouraged.

I'm just a grunt - no management whatsoever. This is how my employer has chosen to manage its fleet - and you'd be surprised at who my employer is. They're a pretty big company.

Re:Don't go there...

[Anonymous Coward]

I was waiting for a car analogy so that I could finally understand this issue. I appreciate the strip club bonus too. Thank you.

Re:Don't go there...

[ray-auch]

> Where is this accepted?

Every company car I've had and everyone I know who's had one.

The minute you are given a company car "to take home" [see post above], as opposed to driving to/from work in your own car and picking up a pool car from work for business miles, then you are on personal use, by definition.

Here, you would also be immediately on the hook for tax based on list price of the car, precisely because you've been given a car for personal use.

Saying "take this car home, here's the few thousand tax bill because we've given you a car for personal use", and then saying "you are not allowed to use the car for anything personal" simply makes no logical sense.

Re:Don't go there...

[Anonymous Coward]

If they give you a company car to take home, chances are they allow grocery shopping.

But if you have to jump on Slashdot and ask about GPS jammers and how to disconnect your built in Nav in a company car so that the company can't know that you routinely stop by the strip club on the way from/to customer meetings, you already have stepped over the line.

Sure, but on the other hand, fuck the line. Maybe the employer is an [type that deservs it] and the worthy cause of [worthy cause] is what the playing around with the laptop is for.

But, anyway, whether or not to do it isn't as interesting as discussion about what one should hypotethically benefit from knowing about how to play around with the laptop.

Re:Don't go there...

[Anonymous Coward]

jump on Slashdot and ask about GPS jammers and how to disconnect your built in Nav in a company car so that the company can't know that you routinely stop by the strip club on the way from/to customer meetings, you already have stepped over the line.

I just park at the doughnut shop across the road from the strip club, then buy everyone at the office doughnuts once I'm finished. Sometimes low tech solutions are the best.

Oh, wait, you weren't asking about how to get a lap dance on company time? Never mind, forget I said anything.

Re:Don't go there...

[Anonymous Coward]

Correctamundo!

We have a monthly 'fee' that offsets the tax liability. Works out great.

Re:Don't go there...

[fermion]

If they are tracking, they can be tracking everything you do, even if you are running software and data off a USB driver. If it has a camera, the camera potentially can be turned on without your knowledge.

I don't really go for such paranoid stuff, but I don't use work laptops either. I have a macbook air that I use for personal stuff and most work stuff I need. If there is something specific that needs to be done for work, I take and use the work laptop, but not for personal stuff. It is just a phone. I would never conduct personal conservation, live or text, over a corporate phone. I just don't want anyone to know those things. And I know if that if a device belongs to corporate, they are free to do whatever they want.

So there are three choices. Use the work laptop and hope that none of your personal life gets caught up in the IT net or snoopers who have nothing better to do. Use a personal machine and work machine, maybe personal is a tablet. Or use a personal machine for most things, and the work machine only when you have to.

Re:Don't go there...

[mordejai]

Sure............ All companies giving notebooks to their employees get a modified BIOS just for spying on them.

Re:Don't go there...

[jrumney]

On the other hand, the time he spends in hotel rooms while on a business trip is HIS time, not theirs. They are not paying him for it, it belongs to him. He has loaned it to the company for work purposes. Don't abuse that by being arseholes about whether he can use his work laptop for personal use while on business trips.

Re:Don't go there...

[philip.paradis]

Where did I say all companies do that?

Re:Don't go there...

[Mal-2]

It's accepted practice in the companies where I have insured their fleets. Pay for your own fuel when you're doing your own thing, that's all they ask. I'm in Southern California, and one client had a 170-vehicle national fleet for their sales force, as well as another 15 or so for the Canadian branch (also scattered across Canada). For the most part, people with company vehicles DIDN'T OWN ONE, or had relegated the family car solely to the spouse because they had theirs. The company didn't care because the cars got sold after 4 years whether they had a few miles on them or (as was more typically the case) upwards of 100,000 miles. Frequently, the employees bought the retired cars since they were equipped with very nice racks and fittings for hauling the company's gear around and this was not stripped out when the car was sold.

Personally I wouldn't buy a 4 year old Dodge Journey with 120,000 miles on it, but if I'd been driving it the entire 4 years I might feel differently.

Re:Don't go there...

[Anonymous Coward]

Exactly my first reaction. Why mess around with the company hardware. Use a tab or smart phone. Anything else is stupid.

Re:Don't go there...

[Anonymous Coward]

They certainly are, if you're an executive.

Re:Don't go there...

[Lucky_Norseman]

If they install GPS trackers I would go even further.
Leave the car parked at work and drive your own car to and from work.

Re:Don't go there...

[Provocateur]

The above is the simplest of reasons. What happens if you lose the laptop? Will your first cry be 'My pr0...my movies!' or just a dismissive, How soon will the replacement arrive?

Re:Don't go there...

[Tim C]

A bit of light, non-controversial browsing isn't abuse, but imaging the drive, wiping and reinstalling (as the submitter himself suggests) most certainly is.

It's risky

[Anonymous Coward]

I used to watch pr0n on my work laptop a lot until I was caught.

Wow

[Isarian]

You're kidding right? Don't be an idiot, follow the terms of your employer and get your own damned machine.

Re:Wow

[rew]

So you enjoy lugging around two laptops when sent on a business trip?

Re:Wow

[Alan Shutko]

Nope. But that's life.

In my case, I worked to get rid of the company-issued laptop in favor of citrixing into my desktop at work. That means I have to carry less, and since I'm not constantly on the road, works well for me.

Re:Wow

[Anonymous Coward]

"Lugging around"? Lol, he's not carrying a refrigerator, it's a laptop. He could carry two in the same case, and it's not like they weigh more than a few pounds each. Maybe if he can't handle that he should get a job as a hairdresser.

Re:Wow

[TheSHAD0W]

They keep getting smaller. A pad or a netbook added to your bag is barely noticeable. Dual-core netbooks are awesome and cheap; just look for one with an Atom N550.

Re:Wow

[Billly Gates]

Then get a smart phone?

I finished a project at a company doing a Windows 7 upgrade. The sales people were always pissed that we decided to put Windows 7 locked and encryped vs the full do whatever you want with XP laptops previously.

Buy your own of get a smart phone to browse your porn (assuming thats why he wants a second). You can thank the lawyers who invented sexual harrasement for these restrictions as well as the BSA. The employer has a right to look after their own self interests without being sued.

If he/she buys his or her own laptop with Office and VPN then they can do what they want and still get work done. If it is a shared drive issue then tough. Netbooks are tiny and can do skype and porn just fine. Sorry but the cool toys are not yours.

Re:Wow

[Beelzebud]

Try construction work for one year, then tell me how horrible it is to lug around 2 laptops.........

Re:Wow

[Anonymous Coward]

Some employers are 'ok' with you surfing. Others are not. I have seen ones where it is 'we are having a get together at a bar' look it up to find the address 'you have violated the corporate policy'. Others you can surf porn and no one will care. It depends on the place you work at. Usually the bigger the company (and the longer it has been around) the more restrictive the policies are. New startup company and they usually do not have any exp with it and just let you do whatever. Go to some fortune 500 that has been around since 1900 and you will find it very locked down.

Re:Wow

[walkerp1]

So you enjoy lugging around two laptops when sent on a business trip?

Not really, no; however, I do enjoy other things like having a job...and integrity.

Re:Wow

[tepples]

Do you do your citrixing even when your laptop is out of range of public Wi-Fi? If so, how many cellular gigabytes per month does your citrixing use?

Re:Wow

[Anonymous Coward]

Millennials...no wonder HR departments are having such a hard time dealing with the new generation of "it's all about me" people:

http://www.cbsnews.com/video/watch/?id=3486473n

Re:Wow

[Anonymous Coward]

the terms might very well have a provision for using it for personal use. but he would still like some privacy on it.

booting off an usb stick might be the best though in that case. using a vm inside the computer wouldn't provide much use anyways if they have remote access setup from company it to it and the company does(illegal in most western countries, pretty much no matter what terms) peeking what the guy does. it's also probably not a very good setup for a secure system to have such remote access setup in the first place though.

Re:Wow

[Anonymous Coward]

Maybe if he can't handle that he should get a job as a hairdresser.

Hairdresser? Geeks here whine about "gorilla arm" problems whenever "minority report" UIs are discussed. Now think about what a normal hairdresser's work requires them to do.

Re:Wow

[zippthorne]

You're assuming that the work he does wouldn't require an internet connection anyway. I'm not sure that that's a reasonable assumption, though. I'd suspect that more often than not, if they're considering issuing a company laptop, that the work probably involves connecting to the company network to do stuff anyway. In which case, the network access issue wouldn't be relevant.

However...

Why use citrix, when you can use the OS's built-in remote desktop capability? Or in the case of unixy machines, the even better solution of X-forwarding.

Re:Wow

[Anonymous Coward]

"So you enjoy lugging around two laptops when sent on a business trip?"

Enjoy? No. But I enjoy surveillance even less.

A nice MacBook Air will last practically forever, is extremely secure, and does everything. If you're into hardcore gaming, there are adequate Windows ultrabooks starting to come out. For reading books and watching movies, an iPad is a great travel companion.

None of these solutions will break your spine to lug around. On airplanes, I keep my company laptop in my suitcase and work and play on my personal machine.

Re:Wow

[Anonymous Coward]

If he/she buys his or her own laptop with Office and VPN then they can do what they want and still get work done.

The whole reason for having locked-down, company-issued laptops is to keep personal machines off the network and to have control over what software is installedj. You do not want the company network getting infected because someone connected their personal laptop to the network. Connecting your personal equipment to the company network is also a good way to get fired.

Re:Wow

[Oligonicella]

That was 2007. I'm pretty certain those same people are showing up at 9 and working until done now. Changing the situation of "more jobs than kids" to "less jobs than kids" changes a helluva lot.

Re:Wow

[Anonymous Coward]

"If he/she buys his or her own laptop with Office and VPN then they can do what they want and still get work done."

In this day and age, for some companies, I would not install the corporate VPN stuff on my own machine. It can and does often come with "extras" which install for monitoring employee activity, defeating the purpose of having a personal machine. Plus, the VPNs are routinely tuned to disallow many Internet-based processes. Fire up the VPN, other stuff stops working or slows down.

For this situation I use a virtual machine. Run the VPN in it, and your host machine's ability to use the Internet is unimpeded.

Re:Wow

[Oligonicella]

Privacy is not his number one concern, else he would get his own lap top and any GPS is to recover a lost/stolen machine, not track his private wanderings.

Not being found out as having used a company device for personal jollies is his primary concern.

Re:Wow

[Anonymous Coward]

I don't enjoy having to drive 55MPH just because of the 70's oil embargo and other people's inability to drive competently. I have a BMW, damn it. And before you say "that's different", well, the corporate laptop policies are there to protect other people on the network and to protect company assets. The difference is that my car actually can handle higher speeds as safely as the lowest spec legal automobile can handle 55; visiting sketchy web sites and screwing with the computer isn't safe at any speed.

Re:Wow

[cloudmaster]

Sprint tethered cell phone plan FTW!

/uses ~8GB/month, no throttling, no extra charges

Re:Wow

[unixisc]

If it's a long business trip, then he'd do well to use a tablet or a smartphone, as discussed above. If it's just for a handful of days, he can get to the e-mails when he gets back, and everything else - the kid's homework, the porn, can wait for him until he's back.

Re:Wow

[PNutts]

Agreed. Someone has to say it: First world problems.

Re:Wow

[unixisc]

I'm assuming that what's being discussed here is connecting to work from home. In which case, the employee has to connect a laptop to the wi-fi connected to his personal internet connection (be it DSL or Cable) and then do a dial-in connect to the company's VPN. If the IT dept wants only company laptops on the VPN, then they'll only install the VPN on those laptops. One couldn't connect to the network in such a case from the home laptop: in such a case, it could only be used for checking his webmail account.

Re:Wow

[fafaforza]

I'm not terribly sure what you wrote above :) but the likely case is that the VPN software is set to reconnect automatically, over any network it finds, so the machine that's being used to access various sites could gain privileged access to the corporate network from any connection.

Re:Wow

[fafaforza]

All this talk of being employed and having integrity, and the OP hadn't even asked his boss or HR department about what's allowed. Wouldn't it be funny if all the people here recommending lugging around 10 pounds of laptop stuff found out that the company had no problem with them browsing the web and such.

Re:Wow

[ottothecow]

Citrix's published apps are the equivalent of X-forwarded applications.

In my situationn, you can't remote desktop if you aren't on the network and you can't join the VPN unless you are on their hardware (and if I have my vpn-approved laptop with me, I won't need to remote desktop to it anymore). If I pull up the citrix desktop on my personal machine, I now have a desktop that is running inside of the corporate network with an RDP client that will let me remote desktop into other machines...so basically I only use the citrix desktop itself for 30 seconds while I connect to a second full screen remote session. Its not ideal, but hey...it works fine and more importantly, I can use a linux or mac citrix client and then RDP perfectly into a windows work machine.

It gets better though when you look at the published apps. If I just want to get into the billing software, run the ridiculously expensive data analysis software (which requires connectivity to work anyways since processing and storage are on the server), or run excel from a non-windows machine, I have those all available as published applications. If I run one of those through citrix, it just opens up in its own window as if it were a local application (just like an x-forward).

Re:Wow

[walkerp1]

Wouldn't it be funny if all the people here recommending lugging around 10 pounds of laptop stuff found out that the company had no problem with them browsing the web and such.

Hilarious, and completely out of my experience.

Re:Wow

[6ULDV8]

I've done it for years and it's not a big deal, but I don't do it because of employer rules. I do it because the company laptop runs Windows and I prefer OS X. With the right case, it even fits overhead or under the seat.

Re:Wow

[fafaforza]

The point is that you're making assumptions, castigations, and recommendations based on possibly false premises.

Re:Wow

[walkerp1]

The point is that you're making assumptions, castigations, and recommendations based on possibly false premises.

Granted. I like the odds though.

Re:Wow

[tepples]

more importantly, I can use a linux or mac citrix client and then RDP perfectly into a windows work machine.

I haven't had a problem using Vinagre Remote Desktop on Xubuntu 11.10 to connect to Windows Server 2003.

Re:Wow

[Anonymous Coward]

I used NoMachine NX to connect to my linux server at home through a GPRS dialup speed cellphone connection. The X session worked pretty well, though it was obviously slower than sitting at the computer. http://www.nomachine.com/

Re:Wow

[KingAlanI]

I suspect it's an example of the male hairdresser --> gay --> effeminate weakling stereotype

Re:Wow

[anyGould]

All this talk of being employed and having integrity, and the OP hadn't even asked his boss or HR department about what's allowed. Wouldn't it be funny if all the people here recommending lugging around 10 pounds of laptop stuff found out that the company had no problem with them browsing the web and such.

Not nearly as funny as if he goes through the skullduggery of buying a spare internal hard drive, cracking the BIOS, and otherwise ducking the system, only to be told as he gets walked out the door "you know, we had no problems with you checking your email; we just can't trust you after voiding the warranty on your ThinkPad"

Re:Wow

[Anonymous Coward]

I worked construction, unless you're watching personal videos while framing, you're not going to have an issue. Stick your personal PC behind your truck seat and grab it at night...People wonder why we don't give good laptops to employees. Idiotic users do their taxes and leave files, put web toolbars that break program functionality through redirects, "smart" users who consistently expose confidential client data and crush bandwidth on the servers playing online games or streaming videos. Listen, I don't care what you do at home, I don't care if you pop a dvd in, or if you're smart enough to load knoppix onto a USB, but any time you touch the company hardware, regardless of how smart you are, you're inviting someone smarter than you to install a virus you didn't realize was there. Any site that requires action from the user is a potentially vulnerable site. I personally hate dealing with encryption, Blackberries or iPhones, but I've got a secure job as long as users remain "smart" enough to break the devices with the crap that they thought they were going to get away with.

Perhaps

[Anonymous Coward]

Ultimately, it depends on your company policy. Where I work, there is a policy about reasonable personal use of company property, and as long as we stay within those boundaries, we are in no danger of running afoul of our management.

Re:Perhaps

[icebike]

Even if such a policy existed, I'd do everything that was personal use related in the browser, (gmail account, or something similar), and not have the machine remember passwords, and set it to clear the browser cache upon close.

I'd use a different browser for work related stuff.

I'd never install anything on the machine itself for personal use. To hard to remove totally when the company "upgrades" your laptop and re-purposes the old one. (Or should you switch jobs).

Re:Buy your own

[ribit]

We don't know what the terms or the job are. If you travel a lot with work, having to haul two laptops around may be unreasonable.

Read the policy

[Jethro]

Read your company's employee handbook and policies. it's very likely that they allow "limited personal use". Just don't do anything stupid like watching porn or pirating stuff on the thing.

If you have any doubts about running any specific software on it, talk to your boss or call HR. They should know what the company's policies are.

I have a work-issued laptop. I'm allowed to browse the internet on it so long as it's a reasonable amount, and the corporate image came with media players, including a DVD player, so I'm fairly sure I can watch movies/listen to music on it when I travel.

But I never do. I take my own personal laptop with me. It's just a lot more comfortable that way.

Re:Read the policy

[Anonymous Coward]

I happen to be an admin, and where I work there is a limited use policy in place. Users can check their personal email, FB, etc. Our company is quite liberal as to the use of the machines. Of course no admin level is given, but there is no spyware or anything like it installed. I know that we may be an exception....

Best idea is to have your own USB drive for personal stuff.

Re:Read the policy

[leonbev]

Perhaps the places where you worked are different than the places that I've worked, but most of the bosses and HR people that I've dealt with didn't have a clue about technology. If I had a question about a specific piece of hardware or software I wanted to install on my company laptop, I'd ask my local friendly IT guy instead. That way,I make sure that I got a straight answer instead of a educated guess.

That said, you can get a decent laptop for $500 now. Even if it was allowed, do you really want put your personal stuff that you paid for on a company laptop, knowing that it's one IT security policy change away from being wiped out or corrupted?

Re:Read the policy

[Jethro]

Ask whomever is responsible, would be my point. I work for a very large company, and the employee handbook is very clear on such matters. HR would, at the very least, know who to refer you to. But yeah, ask whoever it is who's responsible.

And I agree about your second point, too. That's really why I use my own laptop. Just easier/safer that way.

Re:Read the policy

[Anonymous Coward]

DING DING DING! We have a winner!

I work in a creative field, have work-issued MBP and we get the same privileges (they were even nice enough to grant me admin rights). Granted, I do think twice about what kind of content I'm going to watch. Fringe DVDs? Yeah, no problem. Streaming DS9 from Netflix? Of course. Dawn of the Dead? Yeah.. no. Porn? No! Are you crazy?

At home, it's my bandwidth and time, and they don't care. I respect the fact they're letting me use something that belongs to them, but at the same time IT seems to take the view that you're not actually hurting anything by streaming Netflix after answering work emails in the middle of the night. It's not wasting company time, resources, or opening the door to a security breach. Granted, the laptop IS a company resource, but it's not getting in the way of actual work.

The way I see it, IT is doing me a favor, and I'm not going to do anything to make their lives more difficult. I'm sure somewhere out there exists an IT department that would fire someone for watching a Ken Burns documentary on their own time, but I'm glad I'm not dealing with them.

Dude, seriously?

[Anonymous Coward]

What everyone else said. It's not YOUR laptop.

But if you absolutely MUST use it for personal stuff, just make a boot CD or boot pen and do your personal stuff in a separate OS that doesn't even touch the work machine's hard drive.

Using Company Laptop For Personal Use

[SuperCharlie]

No.

Next Question.

Re:Using Company Laptop For Personal Use

[alex_podam]

My answer: Yes, use it for personal use. Just dont install any trojans or malware. None of my employers have ever had any problems with personal use. I surf the net, watch videos, install tools and applications, and on very rare occasions install games. Frankly if my employer would fire someone over using a company laptop for personal use then I would know they don't value their employees and I would move on. (Posting from company laptop)

Re:Using Company Laptop For Personal Use

[alex_podam]

What made you think I was lazy?
I am not talking about doing personal stuff in my work time. I am talking about using a company laptop for personal tasks when I am not on the clock. Personally, I dont torrent from my company laptop, but I do pretty much everything else.

But yes; any employer that would seriously fire someone for doing something as innocent as using it for surfing the web, watching videos or (in moderation) playing games is petty and I would not want to work for them.

Re:Using Company Laptop For Personal Use

[geekmux]

No. Next Question.

And I'd be willing to accept such black-and-white absurdity just as soon as you convince me that corporate laptops are not in use all the damn time for personal reasons.

Hell, I welcome people like the OP. At least he's honest enough to come forward and propose or look for an acceptable middle-ground. Hell of a lot better than listening to the standard bullshit of "I don't know what happened" as you spend the next three hours figuring out the unadmittable.

Re:Using Company Laptop For Personal Use

[Anonymous Coward]

In the UK the Inland Revenue taxes company laptops as a benefit because it expects them to be used for personal stuff. If my employer has a problem with me using the laptop for personal stuff they can take it up with the taxman; I'm paying for it.

Re:Using Company Laptop For Personal Use

[PNutts]

Just dont install any trojans or malware.

Um. OK. I'll mention that to my co-worker that got malware from The Druge Report. I should have told him to not install malware. Sheesh.

Frankly if my employer would fire someone over using a company laptop for personal use then I would know they don't value their employees and I would move on. (Posting from company laptop)

Your company appreciates your position and depending on their policies will take you up on that.

Re:Using Company Laptop For Personal Use

[PNutts]

shitcanned for being a lazy cunt

What made you think I was lazy?

If that was directed at me I'm not sure the first and only thing I would disagree with is being lazy.

Re:Using Company Laptop For Personal Use

[alex_podam]

As long as I keep bringing in good money for the company, my clients are happy and I am not compromising the security of the company then they don't really care what I do with my (their) laptop.

With an up to date browser, a malware scanner and decent virus software there really isn't much of any significant damage from normal use of a company laptop. And if I should happen to catch a virus or something like that, the ten minutes that IT has to spend reimaging the maching really is peanuts compared to the money I bring in to the company.

Why is everyone so aggressive here today?

Re:Using Company Laptop For Personal Use

[Geeky]

No. For the most part it doesn't.

http://www.hmrc.gov.uk/manuals/eimanual/eim21613.htm

Grow up

[clickclickdrone]

As others have said, it's not yours to mess about with and that crap about 'I just can't not surf the web' - jeeze, grow up already. Use your own kit for your non work related computer activities.

Read policy

[minstrelmike]

If your company policy is 'limited personal use," then you're covered.
That's a range of behavior. I would _NOT_ create encrypted partitions or do anything that would look like you're trying to hide stuff.
That's a big red flag and may get you noticed. Most of the time, they aren't going to examine your browsing history. Too much other stuff to do.

Legally, no one is sure what the 'limited' part of personal use means. Facebook and Slashdot and reading email and news items are probably okay.

Just don't do anything you wouldn't want your mother to see. If so, get your own netbook or option2: make a bootable Ubuntu USB stick and boot from it.

Get your own computer!

[DogDude]

Wouldn't it just make sense to spend a few hundred bucks and get your own computer instead of risking your job for no good reason?

Re:Get your own computer!

[tepples]

And how many bucks for a laptop bag that holds two laptops? And how many bucks for gym training so that you won't notice a second laptop?

Re:Get your own computer!

[Anonymous Coward]

My laptop bag could easily accomodate 2 laptops.. and if you find the added weight physically taxing, you really should be getting more exercise anyway.

Re:Get your own computer!

[DogDude]

If you have to go to a gym to be able to carry around two laptops, then I suggest seeing a doctor, instead. That sounds like a serious medical condition.

Re:Get your own computer!

[Patch86]

My netbook weighs about 1 kilo, and is small enough that I could fit about 4 of them in the laptop bag used for my work laptop. Was cheap enough new; practically throw-away price if bought second hand.

Honestly, the paper, media proofs and stationary in my laptop bag weigh far more than the weight of both my work laptop and netbook put together. It's not feather-light, but it's still not exactly working down a coal mine...

Re:Get your own computer!

[cloudmaster]

You might try getting a portable computer made in the last 20 years; they've come down in weight since the switch to LCDs.

Re:Get your own computer!

[Anonymous Coward]

Doctors don't have a cure for being a pussy.

Re:Get your own computer!

[toddestan]

Yeah, but try and convince my employer it's time to upgrade!

Bad Idea

[The Bringer]

My recommendation to you would be to leave the computer alone. Use it for work purposes only. It doesn't belong to you, therefore you have no entitlement for using it outside of the purpose for which it was given to you. That being said, talk to your IT guy, get an idea of how strict they are with regards to personal usage of company assets. You might find they don't care as much as you think they do. In my workplace, I have a strict "If it doesn't effect your job performance or compromise the security of our assets, then I don't care" policy. It is pointless for me to waste time reprimanding employees for checking their personal email or Facebook accounts periodically. Don't abuse it and it will most likely never be an issue, but you're taking a major risk to your employment regardless.

Are you serious?

[Pollux]

If you're seriously thinking that you need to go through that much trouble to hide your "bad work habits," the problem really is you. You appear to be aware of your less-than-exceptional work habits. Reading between the lines, it almost appears as though you lost another previous job because of your self-distractions during work.

Rather than try and hide your browsing history, why not try working for a change? They are paying you to work, after all. And on periods of downtime, bring your own laptop.

Re:Are you serious?

[tixxit]

Pretty sure he's talking about his use of the laptop off company hours. That is, he gets home from a long day of work and wants to browse the web. He's on a plane and wants to play a game. That kind of stuff.

Re:Are you serious?

[Oligonicella]

What he's talking about is not wanting to purchase his own portable. No more.

"Pretty sure he's talking about his use of the laptop off company hours."

Sorry, I jumped the gun there, as you agree with me.

Re:Are you serious?

[Asic Eng]

Purchasing is not a likely problem, laptops are cheap. He probably just doesn't want to carry it.

Re:Are you serious?

[uvajed_ekil]

"Bad work habits," "reading between the lines" to say the guy got fired, and "try working for a change?" Dude just doesn't want to lug 2 freaking laptops on the road if he doesn't have to, jeez. Who wants to tote a second machine around just to check their email, watch a movie ON THEIR OWN TIME (especially when travelling for work, or would hanging out at the hotel bar be better?), or pay a bill or something once in a while? Yes, the best solution is to use something other than a work laptop, but come on, be realistic.

I can't believe that comment got +5 for insightful. more like -1 for insults and made up BS. Not everyone downloads pirate torrents, looks at porn, or surfs mindlessly all day at work, but damn near everyone near a computer checks their email, which doesn't necessarily detract from productivity. It is 2012 not 1996, so we don't all play solitaire every time we're left alone. I can't believe employers are willing to fork over big salaries and give laptops out to employees they can't trust any more than a 4 year-old.

use a live usb stick

[Anonymous Coward]

I would use a persistent live distribution of some operating system. Just boot it off the USB stick. Your company OS won't be touched.

Re:use a live usb stick

[spafbi]

If the laptop has eSATA (many do), I'd take it a step further and boot off an external hard drive or SSD. That way, after selecting your external drive as the temporary boot device, you'd be able to use whatever OS you choose without having to sacrifice performance. I strongly encourage you to not modify the operating system and software of your company's laptop. It's not worth the potential headaches of termination and/or diminished professional reputation.

Re:use a live usb stick

[DaveAtFraud]

Why stop at a USB stick? Use a USB powered external hard disk. I've been running Fedora Core 16 on the company's laptop that way for several months now. What's really nice is that the external hard disk has become my "portable computer." I just leave the work laptop at the office and boot my personal laptop with it when I'm working at home. You just need CPUs with the same width (64 bit or 32 bit) since FC16 (and I think recent Ubuntu) creates the X config on the fly. Since everything is on *my* hard disk, no worries if I get some workplace inappropriate e-mail or something.

Oh yeah, I get to run Linux this way and keep the OEM install of Windoze in case I have to do something corporate-ish that isn't supported on Linux.

Cheers,
Dave

Yep, don't do that...unless you're allowed to.

[SecurityGuy]

I agree with everyone else. Trying to subvert your company's security policy, especially as a new employee, is an excellent way not to be an employee for very long. Just ask them if you're allowed to use the laptop for personal use. If they say no, then don't do it. If they say it depends, tell them what you have in mind. My employer wouldn't care if I was reading ebooks on it. Reasonable personal use also wouldn't be an issue. Messing around on FB on my own time? No problem. Browsing porn? Yeah, that's not going to be ok. Watching movies? Depends. DVD? Fine. Netflix (or anything else you have legit rights to)? Fine. Downloading them illegally to watch? Not a chance.

Basically, don't be an idiot.

Re:Yep, don't do that...unless you're allowed to.

[Quirkz]

Yep, pretty reasonable, assuming the company isn't completely paranoid. Particularly when it comes to travel, I have no qualms using the work computer after hours for my own entertainment. The computer may belong to the company, but after hours my life belongs to me, and if they're going to sent me away from the comforts of home they'd be pretty unreasonable to expect me to travel with two computers just to avoid doing a little web browsing or game playing on theirs.

Slow Nerd Day?

[Trip6]

The answer is so obvious to get your own laptop that I can't believe this even made it on the boards. Slow nerd day?

Re:Slow Nerd Day?

[tepples]

Do they even make laptop bags to carry two laptops, one for work and one for personal use?

Re:Slow Nerd Day?

[M1FCJ]

/me looks at my collection of company-supplied and privately owned backpacks: Yes. One even can carry 4 of the 15" garden variety comfortably and have space.

Re:Slow Nerd Day?

[X10]

The answer is so obvious to get your own laptop that I can't believe this even made it on the boards. Slow nerd day?

Must be a troll that got bored too much.

Re:Slow Nerd Day?

[Anonymous Coward]

If money is that tight, swap the hard drive out... its just not that expensive.

Re:Slow Nerd Day?

[Anonymous Coward]

Sure. With today's thin laptops (not to mention tablets), it's not an issue. The BBP Hamptons Hybrid is nice: http://www.bbpbags.com/hamptons.html --it accommodates my 15" MacBook Pro and my much-bulkier company laptop without issue. Many others do as well, including my semi-retired Targus laptop backpack.

Re:Slow Nerd Day?

[Anonymous Coward]

Lots!. I have a Victorinox briefcase (Architecture 2.0) that has more than enough space for 2 15-17" laptops and my diary / notebook, etc.

Re:Slow Nerd Day?

[unixisc]

Do they even make laptop bags to carry two laptops, one for work and one for personal use?

Yeah, my laptop bag has 3 compartments, and 2 outside (for manuals, cables, etc. I put the laptop in the middle slot, the docking fan in the lower slot and the cables in the upper one. If I had 2 thin laptops, they'd fit easily (my current ThinkPad is rather thick). But more to the point, depending on the duration of the trip, I wouldn't take my iPad unless I was going to be travelling for more than a week, and needed to do things like make online payments while I was travelling. Something which info I wouldn't dream of doing on my work laptop - last thing I want is any of my bank or credit card info in there.

Re:Slow Nerd Day?

[Mitreya]

The answer is so obvious to get your own laptop that I can't believe this even made it on the boards. Slow nerd day?

And I can't believe this hit +4 Insightful, so that makes us even. The answer is obvious, but that's an answer to a DIFFERENT QUESTION. Very common on slashdot.
He (she?) very specifically mentions travel, and having one laptop is hassle enough to travel (airport security, general weight of your bag, etc.). Buying a 2nd laptop is not practical. You might as well carry a desktop around.

Re:Slow Nerd Day?

[Anonymous Coward]

Carrying two laptops around day in day out, through airport security, on planes, trains,or even to and from work, etc... is just NOT an option.

I'm not for or against the OP's suggestions, but as someone who travels consistently for work there is NO WAY IN HELL I would lug around two laptops. That is the definition of retarded.

Taking Company Resources For Granted

[darkfeline]

I'm glad to see /. takes this stance on this issue. A company issued machine is company resources; you don't use it for anything else. If you worked for UPS, would you customize your mail van with decals, nitrous injectors, &c.? If you worked at a restaurant, would you customize your uniform by dying it blue?

Yes there is

[Billly Gates]

Want to browse porn?

Bring your own laptop or smart phone.

Want to hack, code for fun or use online banking?

Bring your own laptop or smart phone.

Subverting and sabatoging company equipment is not only a firable offense, but it is immoral and unethical. Yes the HR weenies will consider this sabatoge and hacking if you dick around with encrypted system volumes and corporate mandated software. It is not yours and belongs to someone else. Your employer wont care if you browse cnn or read your gmail or maybe even use online banking.

Also, what if you fuck up and need help to get your laptop to work? What then? Call help desk and IT? They will see what you did and your will be screwed. Meanwhile that report that needs to be worked on while you are on the road is still due and you will be screwed.

If you can get a discoutned smart phone you still technically own it and can do whatever you want. This is life and the employer has a right to specify what you can do on his own equipment just like you wouldn't do a special tune up and put a nitrogren accelerator in a company cars engine. It is the same concept

2nd os on your own drive

[Anonymous Coward]

Personally, I'd either add a 2nd hard drive or get an external drive to install some other OS on the machine. Linux, windows, whatever. Doesn't really matter. Just dual boot the thing, make sure that the boot loader is on the original hard drive and when it comes time to hand the laptop back over, simply remove your personal hard drive.

Re:2nd os on your own drive

[green1]

As many people have pointed out, using the laptop for personal use, regardless of the method, MAY fall afoul of your company's policies, and is a risk that should be weighed very carefully before doing so. Additionally I'd strongly recommend a method that leaves no trace on the laptop.

That said, I have done it. The company I worked for had whole disk encryption set up on the laptop, and I figured I'd be best not to touch it in any way shape or form. So I used an external USB hard drive and installed ubuntu on it and booted from that. the work part was completely separate from the personal part, and never the 2 did meet.

I did however buy an Acer Iconia tablet a little while back, and haven't used the work laptop for personal use since. Even for coding, web design, word processing, and other such things I just attach a USB keyboard and mouse and it's pretty much as good as any other computer.

Re:2nd os on your own drive

[Dr_Barnowl]

Be careful with this too ; I've had occasions where GRUB has overwritten the bootloader for the full-disk-encryption product, followed by embarassing visits from ICT who have to bring out a USB floppy drive blessed with an encryption key to reinstate it.

What I have now is a USB / SATA caddy with a 3.5" drive bay mount ; I connect the drive to work machines and boot Ubuntu from it, but I do any software updates involving GRUB or kernels from my personal desktop (which has the caddy slot installed in it).

Someone else's laptop

[gremlinuk]

Basically, this is someone else's laptop.

If you've been loaned a machine for a specific purpose, why would you expect to be able to use for a bunch of entirely unrelated stuff?

Travel with two laptops if you must, or get a slim tablet (I hesitate to specify a brand for so many reasons) if weight is a bother.

boot off a USB fob when you're "off the clock"

[Ritz_Just_Ritz]

When I am stuck traveling with the company laptop, I bring along a bootable USB fob with the latest Linux Mint on it and use that when I'm "off the clock." Some companies will try to lock down the bios so you can't even do that (forces the encrypted HD to boot first). So if that's the case, I'd just bring your own laptop/tablet along and call it a day.

I don't agree with companies to do this kind of thing, but in these economic times it's not worth losing a job over.

Best,

Miranda

[Jazari]

Anything you do on a computer which doesn't belong to you may be used against you in a court of law.

Carry a live-VD, buy a tablet, or use any other means to do your personal computing. Never use someone else's computer to log into your email accounts, surf, etc. And if you think you have "nothing to hide" and can't even imagine how it could be used against you, then you *definitely* need to heed this advice.

Re:Miranda

[Maow]

Carry a live-VD

I've got a live-VD that I'm just itching to share if anyone's interested.

Anyone? Hello? Is this thing on?

I am absolutely stunned

[msobkow]

I know people will go to great lengths to complain about their "right" to abuse company resources for their own benefit, but this takes the cake.

You want to WIPE the company hard drive and all the software that is provided for you to do your job, and you don't see a fundamental flaw in this reasoning?

You, sir, are a selfish, greedy, ignorant, and probably USELESS fuck who shouldn't be hired by ANYONE.

Re:I am absolutely stunned

[msobkow]

I mean, seriously. A new job, and your first concern seems to be "how can I steal my company laptop and use it for myself."

Re:I am absolutely stunned

[tomhath]

Even worse is that someone this clueless got the job at all:

I expect to not be the administrator on the device.

But he thinks he'll be able to repartition the hard-drive? Really?

Re:I am absolutely stunned

[tomhath]

...and yes, I know that if you can boot into another OS and If the drive isn't encrypted (both unlikely) there might be a way. But the words "grounds for dismissal" come to mind.

Re:I am absolutely stunned

[Anrego]

Yup. So much this!

I was like half a year into my first job that I felt comfortable enough to browse webcomics during my lunch break. And my company had a policy that allowed "limited personal use".

I can't imagine the guy who gets a job and immediately tries to see just how far he can push the rules (or blatantly break them in this case).

Best still, he's probably in some probation period where they can pretty much can his ass without too much trouble.

Maybe it's a generational thing, but I can't even put myself in this kind of mindset.

Re:I am absolutely stunned

[gl4ss]

I did that. Well, I just installed another hd. If this guys "work" stuff done on the computer would just be reading emails - with a system that you could read emails from any computer, that is if they have a web gateway setup for that or provide instructions etc, then he could do it and get away with it and even arguably be entitled to do it.

The company laptop was for nothing of relevance for what I did though, all the coding gigs coding from them happened on customer provided hw.
Getting a laptop however was one of the very few things I specified when I interviewed for the job(had to interview for a gig too to get the job though).

It's not that uncommon or unreasonable to assume that the employer will provide you with tools of the trade to play around with.

Some goes for company provided phone. That's the another thing I specify when applying for a job, though being a mobile developer that's kind of obvious that I'll have phones to use - but as there's some really crappy companies specifying these two things actually is a must, if they can't provide me a laptop and a phone to fuck around with then fuck them. Sure, they're "company resources" but also resources necessary to stay geeky, to keep in contact with family etc, it's a semi perk like a company car, but costs a lot less for the company to provide.

They can read my company email legally if they first apply for a permit and then only read the headers too. Scraping the emails off my screen would still be reading my emails and illegal(even if they were company related emails). Company resources or not.

(obviously legalities on the matter would depend on the country and this guy should probably just boot a live distro from an usb drive if the laptop is loaded with some company essential sw).

Re:I am absolutely stunned

[Anonymous Coward]

Maybe it's a generational thing, but I can't even put myself in this kind of mindset.

I definitely think it's a generational thing based on what I see in my own workplace. The older staff tend to follow the rules and "don't cross the wrong lines". The younger ones tend to get in trouble with IT by trying to "bend the rules". Some even take on the attitude, "You can't tell me what to do with my personal time." In one sense, your personal time IS your own, but not when it comes to hardware & network access that someone else owns.

Once I saw IT "take down" a guy for using TOR at work. You might think nothing of it, but IT definitely thought the worst of it (possible sending of confidential info outside the company, and this guy had that type of access). The guy is really nice and did not mean any harm; he just wanted to acces his PC at home from work. IT told him, "No, and don't ever do it again or else we have to involve HR since it violates our IT Security rules." It was bad enough that IT had to involve his manager, who is also a nice guy, to help "bust his chops" at bit. In the end the guy that got caught decided it was best to follow the rules, stop using TOR at work...and keep his job.

My advice to OP: You are "a n00b" in the new company so follow the rules from Day One. Don't do it. After 6 months or whatever the probationary period is, If you still need to "feed your needs", ask to read the company policy first. If you still are not sure, ask your manager and/or HR. If they leave you with the "limited acceptable personal use" line, ask them to spell that our in writing. Always remember, just because they let you use a laptop they "give to you", don't forget that they "pwn it" so they get to make the rules and have the final say over what you do with it.

For those that whine like spoiled brats about having to carry their own kit along with their work kit, get over it. Sometimes that is the absolute best way to avoid getting in trouble with your boss. On the other hand, if you do illegal stuff with your own kit, it's your arse in the slammer, but sooner or later it will come out in the news that your were "out on business" and not "on holiday" at that hotel. Yes, hotel staff will talk to anyone...for a price.

Re:I am absolutely stunned

[Anonymous Coward]

...though being a mobile developer...

Is this the same thing as being "periodically unemployed" or "living off the public dole"??

Re:I am absolutely stunned

[Securityemo]

I wouldn't say it's necessarily a generational thing, probably more of a personality kind of deal. When I've used computers at work I've limited use to generically reading newspapers and the tech sites at lunchtime. No personal stuff, i.e. nothing that I'd care if anyone else saw me looking at. And this was on a linux workstation I'd personally set up.

If I had a business laptop that belonged to my employer I'd probably treat it the same. If I had to go on business trips I'd bring an auxillary netbook or something.

Re:I am absolutely stunned

[gl4ss]

...though being a mobile developer...

Is this the same thing as being "periodically unemployed" or "living off the public dole"??

No. it's the thing when the firm goes bankrupt you're called for some other job on the same day or have an email waiting by the time you get home, the kind of even if you're a complete wreck at times you still end up getting the paycheck.. it's what I say to everyone who's bitching about not finding a job - that they should just spent couple of weeks and make a demo app of sorts for any mobile platform and then score a gig - it's an on going sweet bubble that's been bubbling and bursting for a decade now, platforms come and go so nobody is really an expert anyways.

unemployed! hah! that would be sweeeeeeeeet. but the finnish system right now is gamed by government so that it's really not that simple to get unemployed status, I was stupid and enrolled in an university(student benefits are way, way lower than social security checks even).

I'm an asshole with an attitude problem, severe problems with documenting and authority, but still employed and with what seems to be a sweet cv. and that is why I'm answering to some anon taking a jib at being a mobile developer(or perhaps I should have just said an app developer but that wouldn't cover the gigs mentioned).

Re:I am absolutely stunned

[Anonymous Coward]

"You, sir, are a selfish, greedy, ignorant, and probably USELESS fuck who shouldn't be hired by ANYONE."

Spoken like a true boss.

Re:I am absolutely stunned

[Anonymous Coward]

I would say it's necessarily a generational thing...

Mommy and Daddy have been buying all his xboxes, PS3s, smartphones, etc. and now he expects the same treatment from Employer Daddy. The same Employer Daddy that's gonna punt his ass to the unemployment line.

"Work is not about fun; it's about work! It's about seeing how much crap you can take from the boss man! And then takin' some more!"
"If it wasn't work, they'd call it 'Super wonderful crazy fun time,' or 'Skippedy-do!'" - Red Foreman

Re:I am absolutely stunned

[Securityemo]

Nah. I've had stuff bought for me by my parents, never had to do the dishes or laundry or cooking, or even cleaning. Quoting Ministry: "I've never had to work a day in my life." Still, I feel compelled to conduct myself professionally when at work. It just seems natural.

Re:Buy your own

[Albanach]

Perhaps, but lugging around an iPad or similar tablet won't add much. It's also probably a better device for things like reading a book, watching a movie or quickly checking email.

As others have suggested, a live CD/USB distro could be used as an alternative OS if the OP needs more, assuming the laptop can boot from either. He could even boot from a portable hard drive.

Another tale...

[Anonymous Coward]

..of a failed interview. The interview went so well - the newly hired employee wakes up and shows his true colors.

Shame that the industry is full of such people :(

Comply to the rules or quit

[heatseeker_around]

You chose this job. You know the rules. If you disagree with the rules, maybe it means that this employer work policies are not meant for you. You should search for an other job and quit. Otherwise, use your OWN laptop for personal stuff. Travel with 2 laptops, or a tablet, or whatever you use at home. Use your PERSONAL laptop for PERSONAL stuff (porn movies, bit torrent downloads, participating to DDOS attacks as an Anonymous peon, taking photos of your penis in the hotel room, etc.) and use your PROFESSIONAL laptop for PROFESSIONAL stuff ONLY. What is hard to understand ?

Get your own laptop!

[Anonymous Coward]

Get a second laptop for personal use - just a small netbook to keep with you at work. Any surfing on the *work* laptop should be either directly related to work or something so innocuous that you wouldn't mind if both your boss and grandmother looked at it with you.

At the same time, don't use your personal laptop for work-related things. No work code files. No transferring files via USB drives. No direct use of the corporate network.

Both the corporation and you are much better of with complete separation! Trying to carve out your own private area on your work laptop might work, but you'll look like a sneak if you're caught.

Re:Buy your own

[Alomex]

During the Cold War we use to read this stories of people being sent to prison in the Soviet Union because they had used the "<fill item> of the people" for personal use and wonder how could people let a bureaucratic system run so amok that it wouldn't allow for this minor, victimless transgression of the rules.

Yet, here we are...

Nooooooo!

[maroberts]

At some point your machine will go in for repair and some techy will get a laugh or possibly report what books/movies/porn and websites you have been accessing.
As others have stated, either use your own laptop or get a USB/CD/DVD live distribution which can run without touching the company drive.

Locked

[Zemran]

If their choice of hardware and ability of IT staff are good you will be unable to do anything as the settings should be locked (password protected) and it should not boot from anything other that the disk they set up. If they are useless enough to allow you in then I have little sympathy for them but they will not see it like that. I remember one company that I worked at where I could not do my job because I did not have the software I needed installed. After a few days I installed it myself (using the correct install disk which was waiting on my desk but involved changing the Admin password). It was 2 weeks before IT came along and I got into a lot of trouble. The fact that I would have been doing nothing for 2 weeks and I had customers that needed my work etc. did not count for anything against an established IT manager given that I was obviously a "Hacker". It is not really worth the risk unless you are a belligerent trouble maker like me.

Live CD & USB-Stick

[stiebing.ja]

Thats it. Just use a (customized) Live CD for the system and an USB stick for your data, if possible, else use online storage like SpiderOak with your live CD. That also saves you from surfing the web in the time where you should work ;-)
(If you are not allowed to use CDs, a disk image will save you neither.)

Re:Buy your own

[Beelzebud]

Except we're not.

Re:Buy your own

[Anonymous Coward]

1) Sometimes it's possible to just haul your laptop and do work on it.
2) Some companies aren't fascists - you can certainly browse the internet, watch movies. Just don't do anything illegal or "bad PR" with it. For example even if browsing porn is legal for you, it might be "bad PR" (or not[1]).

[1] But just because the CEOs have tons of porn on their work laptops doesn't mean you can use your work laptop to view porn.

How about a LiveCD

[naturaverl]

The prior suggestions to just get a 2nd laptop or netbook for your own personal use may be the most ethical. But from your original post I gather that that is not your concern. So...

Assuming that laptop does in fact have tracking software that can report on the applications that are running and/or be used to send screenshots back to your employer, your ideas to run standalone apps from a USB drive would only land you in "trouble" because the screenshots would still show "rogue activity". The other idea of imaging the whole HDD, re-installing, and imaging back sounds like more hassle than it's worth. But at least from this I know that your BIOS isn't locked down to the extent that you can't boot from external media. So...

What I would suggest is to run a standalone OS from a USB thumb drive or CD / DVD. In doing this, you can run the alternate OS of your choosing, while sidestepping the considerable hassle of creating the backup image, installing the other OS... Here is a rather comprehensive list from which you can choose. Knoppix, Ubuntu, or Mint are the ones I would try first.

swap the hdd

[Anonymous Coward]

That's the only way to be sure

wrong on so many levels...

[Anonymous Coward]

1) most work computers these days have disabled USB ports, or limited function (it will work with a mouse, but not a memory device).
2) full disk encryption is the rule, and if you stick your USB drive in (or your MP3 player), the software will helpfully encrypt it for you, rendering it useless for anything else.
3) Keep your work stuff and your personal stuff separate! put work stuff on your own laptop, and you've basically given work permission to do anything they want to your laptop, including remotely bricking it. And you'll be violating umpty zillion GOOD policies designed to keep information confidential. Put YOUR stuff on your work computer and a) you're using work assets for personal gain, which may or may not be verboten for you, but is a bad practice; b) there's the whole "shop right" thing for intellectual property... use employer's stuff to invent or create something and they have a license to use it for free, even if it's not in their line of business; c) your work can freely rummage through your stuff.
4) if your work stuff and personal stuff overlap in content at all (say you do software development on your own on your spare time, and that's what you do at work too, as opposed to, say, flipping burgers) you're letting yourself in for a whole world of IP ownership hell. You could literally wind up unemployable, because nobody will want to take on the risk of having to get involved in a nasty trade secret dispute between you and your former employer. All it takes is a off-hand comment from previous company to HR weenie or hiring manager at the new company about "we're contemplating legal action against Mr Smith", and instantly, your resume just went to the round file, and you'll never, never hear why. There's enough "unencumbered" applicants around that they don't even have to think about it.

Depends on the employer....

[achbed]

...but if you wipe the drive and install your own OS, or alter the machine in any way, you will be (a) fired, (b) sued, or in the case of some government agencies, (c) jailed.

What part of "Company Issued" do you not understand? IT IS NOT YOURS. Don't mess with it, if you'd like to keep your job and your freedom.

If the company/agency you work for is encrypting the hard drive, you're not working in a place that will tolerate ANY kind of tampering, even dual-boot. This may be for some combination of paranoia, trade secrets, legally-sensitive data, or national security. In any case, don't mess with it. Accept it and move on as a term of employment/

Get yourself a personal netbook, tablet, or smartphone and live with it. Or, go find yourself another job - one that allows you to hack company-issued hardware.

Don't Do It

[snowcat1964]

Don't do anything with the company notebook except work for the company. That is it's purpose. If you use it for person use then you may cause issues with the system that may cost the company resources to repair the damage. In the past I have always purchased my own notebook and used it for company stuff, but I was the IT Manager. But when I was just a developer I used the company units and travelled with two notebooks, which is a pain at airport security. Pick up a tablet or netbook for your own personal use. frank

Re:Don't Do It

[Anonymous Coward]

Use your work laptop for work and your personal laptop for personal use. Don't ever make the mistake of mixing the two as it can only lead to bad things later on.

Blah-blah-blah. What will happen, will the world explode if he does?

A better advice would be not to do anything illegal on any laptop, because it can always be stolen by thieves or TSA, exposing your data.
And don't forget to encrypt your homemade porn videos.

Re:Don't Do It

[unixisc]

How's this? He saves his bank account information in the browser in his work laptop so that he can easily access his account. At the time he turns in the laptop back to IT, he omits to delete that, or even if he does, it somehow pops up anyway when the next user visits the same bank site. And has a field day w/ his account.

The above is a way that can damage him personally. On the work side of things, he works on a work assignment on his personal laptop, and after his employment ends later, he uses that assignment - pretty close to the final approved one - for his next interviews, or to compete w/ his employer. That's why using his personal laptop for anything work related ain't a good idea.

As most people in this thread have suggest, simply keep them separate!

Short Answer: Don't

[monk]

Long Answer: Reword you request and the risk becomes a little clearer. "I'm starting a new job soon, and I will be issued equipment which I have agreed not to use for personal use. I am compelled to use it for personal use anyway. How can I do that." You have to first weight the cost and the benefit. Is surfing the web worth losing your new job?

On the other hand, screw Greyface, here's how you do it. Don't try any of the approaches you've mentioned. If they have tracking software installed they may have software keyloggers and remote desktops as well. They MAY have hardware keyloggers. They probably don't, but that's the risk you're taking.

Get an live Linux distro you can boot off of USB, one that allows you to store stuff back to the USB stick. Damn Small Linux is a good one. Do your personal stuff EXCLUSIVELY when booted to the stick. That's about the best you can do. Best of luck. May the Source be with you.

Re:Short Answer: Don't

[Nimey]

DSL is obsolete; the project's been dead for at least a couple years because of infighting. Better to go with something else, and unless the issued laptop is woefully underpowered there's no reason to not use something more modern anyway, like Puppy or Mint.

Re:Short Answer: Don't

[anyGould]

Even then, you have to judge whether it's better to be busted for "improper use of company equipment" or "deliberately circumventing company policy".

(Look at it from the other side: you've handed employee a computer with access to your Important Company Files, with the instructions "this is for your work use only". You run into him at the coffee shop, and not only is he looking at naughtyusbports.tumbler.com, he's doing it on the company computer, and the desktop looks totally different as well. Oh, and don't forget that booting to Linux isn't unknown as "how to get files off a computer". What's your first reaction going to be?)

Talk to your IT guys first, see what the enforcement/permission level is. I'd actually recommend the local guys over the management in general - they're more likely to be the enforcers, and it reduces the chance you'll get a knee-jerk reaction of "now that you've asked, I'm required to stomp on your head to CYA". If you can't live by the (enforced) restrictions, then perhaps this isn't the company for you.

They might be tracking your movements as you go.

[Anonymous Coward]

If you assume they are going to be putting monitoring software on the device, you certain can't make the assumption that it won't tell them what you've been up to the first time it connects to a wi-fi hotspot.

Re:Buy your own

[Anonymous Coward]

Except most places I've worked (actually all places I've worked that involved computers) allow for "limited, personal use of company assets". This is obviously highly subjective, but in general it means using your companies computer/network to browse cracked.com at lunch, using your companies phone system to call home to let them know you are going to be a little late for dinner, etc..

Obviously people push boundries (like using the companies large format printer to make a poster for their kid) .. but in general if you arn't torrenting / spending 4 hours a day browsing the web .. you're probably fine.

Second drive

[Anonymous Coward]

Why not just buy a second drive and load an OS and apps you want/need. The swap is simple and only takes a minute or two and it negates all the other issues.

Boot from VHD

[Anonymous Coward]

If it's a Windows 7 machine you can create a VHD (virtual hard disk) and boot from that. I believe you can even bitlocker it so that your employer won't be able to decrypt it. Other than that I'd say boot from USB. That's if you have to keep everything totally separate.

I thought most employers who send people on the road with a laptop are more sensible about this, and as long as you don't do anything illegal and you don't accidentally show off your porn bookmarks in meetings you should be fine. If that's the case then a separate non-work user account should be sufficient.

External Drive?

[TheNinjaroach]

Reformatting and replacing the system image that's provided for you does not strike me as a good idea. Perhaps your best bet is to get a speedy external drive and boot off of it when you absolutely need personal privacy.

Re:External Drive?

[cjjjer]

Actually they could have him charged with the destruction of private and intellectual property if he does what he is saying. Best solution so far would be to use a LiveCD and buy a 16+GB USB key to store the settings and such on it.

Or like others have mentioned just buy a tablet if it's just for entertainment purposes anyway.

Not yours

[Anonymous Coward]

It's not your laptop, you are not entitled to mess around with it.

That said, if you can boot from the disc drive or usb (if it hasn't been disabled in the BIOS) you could probably get away with a linux liveCD/USBStick. Actually doing anything to the hard drive itself is likely to ruin it.

The very fact that you'd consider it would make me want to fire you if you were working for me. If you are working, you use the work-provided equipment on work time. If you are not working, use your own equipment on your own time.

(Saying this as someone who had one parental unit use work gear for personal reasons all the damn time and was busted once, not by being stupid about it, but because the boss literately went out of his way to waste company time to spy on my parent during lunch. So what I'm telling you is that your boss might be a dick and look for an excuse to powertrip if you do anything to the laptop.)

It's not your property.

[confused one]

Just to re-iterate the dozen or so replies so far...

Don't fuck with the companies laptop. It doesn't belong to you. It's not your property. The companies disk image may be configured a specific way for security reasons; you can't just make changes to it without asking permission. As for tracking and keylogging, some companies use keylogging software to measure productivity. If you bypass the software, then you're productivity will appear to be ZERO.

For personal use on trips buy a tablet or netbook -- something light and thin that you can slip in along side the company laptop in your baggage.

Re:No, there's no need

[Anonymous Coward]

The parent correctly points out that you can use a live distro and avoid having to touch the company's hard drive. If you need a lot of personal data, you can use the cloud.

Your phone has a lot of the capabilities that a laptop used to have. You don't need to use the employer's hard drive for personal purposes because there are easily available alternatives.

Separate OS.

[rew]

The easiest ways of "keeping tabs" on a company laptop would be to install stuff like a keylogger and browser-history-catcher in the operating system.

That is unlikely to work if you install a new operating system. i.e. resize the partition where the main OS lives, and install a whole new OS instance on the free space. Best would be to install Linux while the rest runs mircosoft stuff. But installing your own copy of the microsoft stuff should work too. That would be reasonably convenient and reasonably safe. Of course it might not fit your definition of "reasonably safe" (or for "reasonably convenient").

Don't do it. Carry your own laptop.

[ChrisKnight]

If I may, I'd like to address a couple of assumptions in your post:

"I can make an image of the drive, then wipe the machine, and restore it back to its former state if I ever have to return it."
You can't guarantee this. I am on the security team at my company. When a person is being let go they called into a meeting and someone collects their laptop or desktop while they are in the meeting. In only one case have we allowed someone to access their system after it was collected, and that was under supervised conditions. We pull the laptop hard drive, label it, and shelve it. If that were your drive, we could have your personal information sitting on a shelf for years, waiting for someone to access it. While this didn't happen to me, a friend of mine was asked to peruse the hard drive of a terminated employee, and what she found led to criminal charges being filed against the ex employee. Not saying you would do anything illegal, but never put yourself in a situation where someone else has unlimited and unrestricted access to your personal data.

Also, this could be a violation of company policy and could be grounds for disciplinary action.

"I can use portable apps off a usb key and browse in private mode."
Yes, you can, but that doesn't mean you can bypass any monitoring or filtering software installed on the machine.

"Are there any other precautions I could or should take?"
It's just not worth the hassle, and potential employment repercussions, to modify your company owned system. I have two laptops that go with me everywhere. One is my work laptop, the other is my personal laptop. I keep both realms deliberately separated. Buy yourself a Macbook Air, or other maybe just a tablet since you mostly indicate you are browsing. Keep your work and personal life separate.

Common Sense and Company Policy

[Anonymous Coward]

Know the company policy and apply common sense. It is unlikely that while staying at a hotel they would care if you looked at cnn or slashdot. Most policies seem to be "limited personal use" and this is where common sense applies.

Surfing the web ok, surfing for porn bad.
Playing flash games ok, installing games bad.
Streaming hulu/netflix at the hotel ok, streaming at work bad.
Watching a dvd ok, watching an illegally ripped anything bad.
Installing anything outside of browsers and plugins (And even then that might be bad) is a bad idea. Trying to use USB to circumvent company policy is a terrible idea. If in doubt and about to travel ask your manager or IT what you can and can't do. Some companies have iron-fisted approach to computer management others do not.

Don't sweat reasonable use

[Anonymous Coward]

unless of course the company has an explicit policy against it.

Surfing news sites, Slashdot and other tech sites, ESPN, Facebook, Linkedin, personal email - OK

Occasional casual games like minesweeper - OK

Short YouTube videos like movie trailers and stupid pet tricks - OK

Porn sites - definitely not OK

Making inflammatory posts on political web sites - not OK

Watching streamed movies or live sports events - probably not OK

FPS and other long, involved games - probably not OK

This is pretty much common sense. Remember, everyone has to live by the same rules, and no one wants to be told that they can't check out the sports scores (men) or Oscar nominations (women).

tried asking?

[Anonymous Coward]

I see a lot of reasonable comment about legality and issues and such but not the single comment that makes sense:

just ask them, politely and focusing on your traveling issues.

Here's how to do it

[scorp1us]

First, this is the wrong way, but it works.
Use VMware player to install an OS image of your choice. Oh, but you don't have admin rights, so you might have to use QEMU. The networking might be an issue if you can't install the networking drivers, so you might have to find a way around that. Maybe USB? But once you have a VM with networking you can do anything in it with relative impunity. Your host will probably use a proxy (transparent or otherwise) so you still can't browse porn.

The right way is to get your own damn laptop. Newegg has them for under $500 (17" too!). I have to question your judgement if you in this economy would chose to use your laptop over a job. Also, if you do anything enterprising on your VM, your company can claim ownership of that too (if they know you have it). So just be smart and use your own laptop.

Get a secondary hard drive

[Anonymous Coward]

You could swap out the work drive and replace it with a new one with your own os on it. You'll be able preserve your own settings and files easier.

Not "Your Rights On-line"

[Torodung]

First off, I'm reassured at all the "get another device" replies. That's about the only sensible option you have, if you're reading your employment agreement properly (read it closely if you haven't already, as some have suggested).

Secondly, this is not remotely a "Your Rights On-line" issue, as it has been tagged by someone. This is contract law. You agreed to rights and restrictions under that contract when you signed the employment agreement. You waived any rights you think you had when you signed it. If you want to violate that contract, you need to renegotiate (or should have negotiated better terms in the first place), or should cancel the contract as per its terms (or via a legal defense like fraud, duress, or mistake) and find something else to do. Or, you pay the penalty for breach. Your choice.

Regardless, what you are asking shows a remarkable ignorance of "your rights" anywhere, and you should look to secure better terms in the future if an agreement is unpalatable to your lifestyle.

School up, brother, and good luck.

Re:Buy your own

[Luckyo]

Modern laptops weigh between 1.25 an 3 kilograms. Power adapter is another 500 grams or so and unlike netbook, it can stay at your hotel.

If you need ultraportable, get a brazos netbook. Else get a ~1k "desktop replacement" laptop within 3kg weight range. You'll be able to even play decently modern games at high quality levels. Personally I just got a cheap 2.5kg brazos laptop as I hate small screens of netbooks/tablets but also wanted a long battery life while being able to play starcraft 2 every once in a while. E-450 does everything I want, and 15 inch screen is big enough to browse with reasonable comfort. Weight is a bit of an issue though.

Conclusion: hauling a second laptop is worth the freedom it affords. And there are enough choices on laptop specifics to suit both "as light and little as possible" as well as "I want to play games on the move" crowds and everyone in between.

Do It and Show It Off!

[Anonymous Coward]

Here's what you do: wipe the hard disk; install an OS and apps of your choosing -- be sure sure to include an assortment of cracked, pirated, warez and other forms of illegitimate software; remove any and every password you can find; don't forget to disable TPM while your're at it; get rid of any firewall software; anitvirus software only annoys you - ditch it all; and if you have any spare components around your house be sure to upgrade it (or downgrade it if you happen to have a personal use for some of the parts in it). Then take your new and improved laptop to your boss and/or IT department and show it off. As you're being escorted to the door by security you can reflect on what an idiot you are and vow to yourself to not be so stupid again at your next job. (Hopefully you did this your first week on the job so you won't have a gap in your resume).

Re:No, there's no need

[icebike]

The parent correctly points out that you can use a live distro and avoid having to touch the company's hard drive.

Maybe, maybe not. There may be key-loggers installed which still grab your keystrokes.
Further, you can set up machines to prevent booting from anything other than the hard drive, then lock the bios.

Swap HD

[Anonymous Coward]

Two popular ways I see are to:
1) get a second hard drive and use it as your base system for personal use. Just swap them out between tasks.
2) Install VMware and virtualize the corporate image. Use the hypervisor or main system for your personal use and the VM for all things work-releated.

Alternatively

[Anonymous Coward]

You can carry the USB key with you, and just swap laptops as needed.

Common Sense

[buckeyeguy]

If you have a laptop that has remote admin/update software like Altiris on it, you'll probably screw up the PC if you start messing with partitions, folders, settings, etc. Would recommend against that. My latest work laptop (c/o the Fortune 25 company I work for) has the disk encryption, but no USB block or oppressive admin rights, and no huge caveats except to not install unlicensed software on it.

As for general use, are you traveling a lot? Employees that travel tend to have a bit more leeway with the use of their PC, browsing should be no big deal, but I would still recommend not loading up games or media on it. Get a smartphone or 2nd PC for that. And have some common sense; no porn browsing, period.

OT: sounds like there are a lot of 'bosses' on this thread ;0

Re:Common Sense

[Anonymous Coward]

wtf is all this 'no porn' crap? it's true you should probably avoid it if you're into some really weird stuff or don't want someone else to know that you're doing it, but there's nothing wrong/shameful/illegal about going '#3' and getting the semen out.

Re:Common Sense

[Anonymous Coward]

If it's a company laptop, "no porn" is not just advice for the people who're into really weird stuff. It's the rule: No Porn. You Will Be Fired. Do You Understand Now? It has nothing to do with how bizarre your porn is.

Simplest is goodest.

[blackicye]

Buy yourself another laptop.

Re:Simplest is goodest.

[Samantha Wright]

I have a better solution: learn to read a book, and work off your information overload addiction. The asker stuffs his life full of technology because it is empty. He should confront that emptiness.

Re:Simplest is goodest.

[The Good Reverend]

Perhaps you're injecting your own life into your posts here?

I love the internet. I love web surfing. I love communicating with friends and family that aren't close to me. But I also like to read, to go drink beer with friends, and to spend too many hours in my garden. The two are not mutually exclusive.

To say that he has an addiction because he's asking about technology tells much more about you than it does about him.

Re:Simplest is goodest.

[Anonymous Coward]

Yes, because reading an actual book as opposed to reading an eBook makes his life less empty.

Re:Simplest is goodest.

[Aaron B Lingwood]

Buy yourself another laptop.

Because when I travel for work, I like to lug around 2 laptops.

Re:Simplest is goodest.

[Samantha Wright]

I think that really depends on the length of the trip. If it's a two-week-long adventure, then yes, you're right that my suggestion is unreasonable. Not so much if it's just an over-nighter; this is something that can get you sacked (as some other comments higher up on this story have testified) and really shouldn't be done just on a whim.

Re:Simplest is goodest.

[John Bresnahan]

This is one of the reasons the iPad is so popular. It makes a good personal web-surfing device when traveling on business with the company laptop.

Re:Simplest is goodest.

[Anonymous Coward]

Don't travel for work if you don't like attributes of traveling for work. Jobs exist where you go to the same place every day.

Re:Simplest is goodest.

[Rakishi]

The ancient greeks would have said the same thing about your book. What an empty life where you don't interact with people in person to transfer information.

That said, I have maybe 50 years left on this planet baring a zombie apocalypse. I'm not going to piss it away in inefficiency for the sake of some worthless philosophical concept.

Just because you're incapable of dealing and managing with flows of information doesn't mean the rest of us have the same deficiency.

Re:Simplest is goodest.

[Beardo the Bearded]

Yep, this is the smartest option and the one your IT department will like the best.

Re:Simplest is goodest.

[Samantha Wright]

I'm amused how much ire that simple comment stirred up. For the record, I had made the assumption that the trip was going to be relatively short, and that the asker couldn't handle a day or two of, as you've called it, 'inefficiency'. If we're talking about week-long trips or extremely frequent trips then I completely understand, but the whole amount of productivity being lost if the trips are short is really relatively trivial when compared against the total amount of intellectual productivity he'll have in his entire lifetime. Wouldn't that strike you as just a little bit obsessive?

Re:Simplest is goodest.

[Anonymous Coward]

You must be new here.

Re:Simplest is goodest.

[Anonymous Coward]

"I have a better solution: learn to read a book, and work off your information overload addiction."

But he still needs a machine with Calibre installed to fill his ebook reader with 'free' books.

Re:Simplest is goodest.

[Anonymous Coward]

I know two people that have work issued laptops. They use them for work only. One has an iPad and the other has a TouchPad for e-mail, browsing and paying bills on the road. Buy an iPad or your favourite tablet for leisure.

Re:Simplest is goodest.

[Rakishi]

A hundred dollar bill and ten thousand pennies are the same amount of money.

Little things add up which is something a lot of people seem to not understand. Then they wonder why they're broke or have no time for anything.

Wouldn't that strike you as just a little bit obsessive?

No more than your desire to read books or the hundred other habits that make up your various routines and preferences. Humans are creatures of habit, we like out routines and keeping them makes us happy.

Re:Simplest is goodest.

[Anonymous Coward]

Hi Ted Kaczynski, glad to see they give you internet access in a supermax prison.

Re:Simplest is goodest.

[ottothecow]

what company has traveling employees and calls them out for email, browsing, and paying bills on the road?

I know some of my friends parents who basically use their work laptops as their only computers after the kids moved out and they stopped having to have a family computer...but I obviously see the need to keep my own systems independent from the work systems (things like my picture and music libraries should be at risk if my work laptop gets taken away...not to mention the NSFW stuff). That being said, I just got back from a business trip and am writing this post on my work laptop after finishing up a little work. The company's policy allows for such incidental use and when you are traveling, surely all non-work use is covered by this same incidental use classification--if not, maybe it is time to look for a new job.

Re:Simplest is goodest.

[Samantha Wright]

Attention, much like sleep and radiation dosage, does not add in a linear fashion like money. Contiguity matters.

As for habits: we should not let ourselves be completely subject to them. That's a great way to find yourself unproductive, evolutionary unfit, and having lived a repetitive and dull life. What exactly are you arguing for, here? That no one should ever suggest that living life in eternal comfort is a bad thing? This isn't a conversation about taking rights away or anything; if the guy's that desperate, then I would heartily endorse getting his own tablet or a LiveCD like everyone else has, just so he can retain more control over things. If he's only going away for a night or two occasionally, and the trips aren't too stressful, taking any action is excessive.

Re:Simplest is goodest.

[Anonymous Coward]

Wow. Thanks Sigmund Fraud, for sharing your problems with us.
Seriously though, just boot to a live cd (ubuntu, whatever), surf all you want and you're cool.

Re:Simplest is goodest.

[celle]

"He should confront that emptiness."

    All he has to do is get married and have some kids. His life will still be empty but he'll be to busy trying to keep out of bankruptcy to notice.

"The children were all plotting snug in their beds, while the wife's constant whining was splitting his head." - Al Bundy -- twas the night before christmas --- Married with Children

Re:Simplest is goodest.

[ub3r n3u7r4l1st]

Not in China where more kids = more prosperous family. I guess American men just want sex.

Re:Simplest is goodest.

[rtb61]

No, you carry around your personal laptop. You just carry a usb drive with company data to plug into your personal laptop. So leave the company laptop at work and carry around a thumb drive hooked onto your keyring for out of hours or away from office work.

Re:Simplest is goodest.

[Anonymous Coward]

Buy yourself another hard drive, put whatever OS you want on it and swap it out when you are at work/home/traveling. Whatever. Much cheaper (and lighter) than another laptop or netboot.

Re:Simplest is goodest.

[Securityemo]

I think what the parent is trying to express is that many people, me included, get a bit peeved when they're cut off from internet access for more than a day or so.

Re:Simplest is goodest.

[Samantha Wright]

I do, too, to be quite simply honest. I just don't think it's a good thing that we're so dependent on it!

Re:Simplest is goodest.

[celtic_hackr]

Do not flee from bankruptcy. Embrace it. It worked so well for SCO.

Re:Simplest is goodest.

[unixisc]

I think GP was talking about the personal activities that one does on his home laptop - e-mail (personal, such as PTA communications, how the relatives are doing, et al), browsing (porn, slashdot, news,...) and paying bills (as in oops, my PG&E is due today - let me make that payment online). Not activities that the company wants him to do.

Given how inexpensive laptops are, as well as the fact that one can get even cheaper desktops, tablets or smartphones, I don't think there is any real excuse for not affording them. We're talking here about employed people who are important enough that their employers are issuing them laptops. If that is the case, it's reasonable to assume that they can take $500 and buy one of these things for their home use, and not touch the company equipment for that purpose.

Re:Simplest is goodest.

[Rakishi]

You tried to argue that wanting computer access on trips was somehow an inherently bad thing. That time spent with a book is more worthwhile than time spent reading an eBook or being online. I simply pointed out that having such access is useful and that your argument held no water.

Then you tried to argue that it's the quantity of the time spent is what matters and the nature of the trip. I've already noted that this is, depending on the individual, a good habit and so simply pointed out that wanting to keep doing a useful habit isn't a bad thing.

I'm arguing nothing, I'm simply shooting holes in your arguments.

If he's only going away for a night or two occasionally, and the trips aren't too stressful, taking any action is excessive.

Why? Why should someone have a less pleasurable and less efficient use of their time simply because it's only a few days? To prove that they can? I could book a 1 star hotel but why would I if I had other options? I could live without AC in 100+ weather but why would I if I had other options?

Your whole chain of arguments is based on the view that how he wants to spend his time is inherently bad. Trying to hide that behind other arguments doesn't change it.

Re:Simplest is goodest.

[unixisc]

While China has relaxed its one kid family rule, the current rule is 2 kids. More kids != more prosperous family - I think that rule only applies in a seriously underpopulated Russia (and I'm not talking about Moscow here)

Re:Simplest is goodest.

[Samantha Wright]

Using a computer instead of another form of entertainment or distraction while on a trip is not directly equivalent to a more expensive hotel. It entails eyestrain, engages the mind in certain ways, and creates a barrier between the user and his or her environment. I am arguing for moderation on the behalf of mental and physical health. And yes, that includes talking to other human beings, not just reading from a book instead of saturating yourself with the hundreds of little distractions that come with reading something on a computer.

Given that you seem to think that spending your entire life glued to a computer is "a good habit" "depending on the individual" even when such always extends to include entertainment, and decided that encouraging someone to be independent of computing was evidence of a "deficiency" in "dealing and managing with flows of information," I really would not recommend trying to claim that your reductionist viewpoint is more sane. You're not a cog in a machine, Rakishi; you don't have to worry about "pissing away" the next fifty years of your life.

Re:Simplest is goodest.

[John Bresnahan]

what company has traveling employees and calls them out for email, browsing, and paying bills on the road?

Maybe you have it backwards. Maybe it isn't the company worried about an employee's personal use, but the employee worried about the company having access to non work-related activities. And, no, I don't mean porn. I mean things like online banking. Even if the company is honest, I wouldn't necessarily trust the company's network administrator. I've known too many of them who loved to monitor what people were doing on "their" network.

Re:Simplest is goodest.

[Anonymous Coward]

If the trip was going to be relatively short, he'd have less clothes to pack and plenty of room in his suitcase to include a personal laptop.

Re:Simplest is goodest.

[blackicye]

Buy yourself another laptop.

Because when I travel for work, I like to lug around 2 laptops.

Because if you enjoy travelling for work, you should try your best not to do things that might result in your termination.

Yes.

[dalias]

Yes, please feel free to do this. Get your dumbass self fired so somebody with a clue can have your job.

Is the employer really that draconian?

[swillden]

The other posters have covered well the fact that you really shouldn't try to work around the employer's policies. Getting caught is likely, and almost certainly grounds for termination. Don't go there.

That said, you should find out what the employer's policies actually are, rather than just assuming they're going to be insane. I've had a company-issued laptop since the mid-90s, with several different employers, and none of them have done what you describe. Moreover, I've also spent years consulting with dozens of companies about their IT security policies, including management of laptop use, and none of them have approached it the way you describe, either.

Most employers care about (in decreasing order of importance):

1. The security of their data. There are lots of good reasons for this, obviously. This includes things like full-disk encryption to ensure that if the laptop is lost the data it might carry is not revealed, and mal-ware prevention in order to prevent mal-ware from revealing important data.

2. The security of their network. Since you'll bring the laptop into the office and connect it to the network, employers don't want the laptop to be a vector for malware or targeted attacks.

3. Preventing HR problems. Stuff like porn on screens in the office can create sexual harassment lawsuits. This is the primary reason for anti-porn rules.

4. Productivity. Misuse of company equipment on company time means (arguably) that productive work that should be done isn't. This is another reason for anti-porn and anti-surfing rules.

Different companies take different approaches to managing these risks. A common, if very authoritarian, approach to limiting malware, for example, is to allow only software which is specifically approved by IT to be installed on the machine. Keylogging doesn't really accomplish any of the above, however, and I've never seen any company who does it, with the exception of one company that installs a browser plugin which watches for users typing their corporate password into non-company web sites.

If you're using the laptop at home, on your own time, I don't think most employers will care if you surf a little, check your personal e-mail, watch Netflix, etc. They may or may not care if you surf porn. I think most would rather not know. Outside of that, if it doesn't require changing the security configuration of the laptop, doesn't require installing software and doesn't interfere with productive work, I doubt they're going to care.

Check out the policy carefully, ask questions to make sure you understand it, and then comply with it. But I would be surprised if the policy truly is as draconian as you say.

Re:Is the employer really that draconian?

[HapSlappy_2222]

Good points, all. I'd even go one further and say if the policies truly ARE this draconian, the OP should simply use the laptop for work, only. His "I can't just not surf the web!" argument just won't fly if his company has him locked down this tightly.

Re:Is the employer really that draconian?

[Anonymous Coward]

4. Productivity. Misuse of company equipment on company time means (arguably) that productive work that should be done isn't. This is another reason for anti-porn and anti-surfing rules.

My brother worked at a startup that was almost killed when the police seized the sales/marketing guy's laptop on suspicion of kiddie porn. They no longer had access to his legitimate files and had to buy new hardware. They got another sales guy, but he had to start from scratch. After I left HP, a former coworker got fired for downloading porn using his company laptop while on personal time. If you don't want to be bound by corporate policy, get your own laptop/netbook/tablet. If you're going to be following the corporate rules and are just worried about the IT viruses/spyware getting hold of your personal data, get an external drive. If IT hasn't locked down the BIOS, you can set it to boot off the external drive when you want to use it for personal use. You can install the OS of your choice and store your files, movies, music, apps, games, etc while keeping the company disk clean. I'd make sure the corporate drive isn't even mapped in the external OS. I'm not bothered about my company snooping because I know what they monitor, but I travel with a 3.5" external drive because I don't want to clutter up the internal drive with GB's of movies, etc.

Re:Is the employer really that draconian?

[swillden]

Ouch, yeah, businesses can also be significantly damaged if employees use their equipment for illegal purposes. I never met a CIO that brought this up as a major concern, though.

My current employer (Google) allows me to do whatever I like with my company computers (laptop and desktop) as long as I don't circumvent the security policies. Oh, and they also don't promise to help me recover any personal data if something happens to the machine and tech support needs to work on it. Of course, the drive is a 128 GB SSD so there isn't room for very much on it anyway. I have a 1 TB external drive for most of my stuff because there's just not much room on the internal drive.

Re:Is the employer really that draconian?

[Anonymous Coward]

That's it, Shitden. I'm reporting you to HR for discussing internal Google policies on Slashdot.

--
The Strong Jas!

Re:Is the employer really that draconian?

[swillden]

I'm reporting you to HR for discussing internal Google policies on Slashdot.

Feel free! I don't believe I've said anything out of turn here.

Re:No, there's no need

[Anrego]

I would take any of that as a sign that your employer is serious about controlling their equiptment and trying to subvert their control is a sure way to find your stuff in a box at reception when you get back from your trip.

In other words, a sign to buy your own laptop ;p

Don't do that

[archen]

Like others have stated, I wouldn't even try to do this. That said, if I were going to do this, I'd try installing an OS on a usb drive and boot from there. I'm not sure if Windows supports that, but Linux and BSD can. That also requires you can specify the boot device in the BIOS.

Second hard drive - swap them

[Anonymous Coward]

Just buy a second hard drive and swap them out. Make sure you have two of the right size screwdriver in your laptop bag in case you lose one.

Takes maybe 3 minutes per swap once you've done it a few times.

Of course, you *could* ask your employer (A) if that's OK, and (B) what their policies are for people who travel. You won't be the first person to ever face this problem with them.

Re:Second hard drive - swap them

[nedlohs]

Make sure those screwdrivers are only 6" long too. Otherwise they'll both get lost at the same time when the TSA guy bothers watching the X-X-ray screen. In fact shorter ones might anyway - it's not like they actually bother following their own rules.

Re:Buy your own

[ribit]

I found an iPad v1 really useful when I was working in an office where product security meant you weren't allowed to bring in your own laptop, or anything with a camera.

Re:Buy your own

[Razed By TV]

Buy your own laptop to fuck around with you cheap bastard. The laptop is the property of your employer and if you don't agree to the terms they set then don't work for them.

What he said. Seriously, you can find something decent for under $300. If you have a position that received a company issued laptop, I can't imagine how you can't afford $300. Yeah, so you have to lug around one more device, big deal. A tablet or a netbook really isn't that back breaking.

There's an easy answer...

[slk]

This is what tablets and smartphones are for. Bring your own tablet and/or smartphone, keep the personal surfing personal. Nobody will ask, nobody will care... your iPad is for watching movies on the plane, reading eBooks, random surfing, etc.

Also, having written a few AUPs myself... the exact restrictions tend to be pretty well documented, and driven by security and compliance requirements that your employer would be in trouble for violating. Read the AUP in full and make sure you understand it, ask questions if needed. Those of us who have to help maintain compliance / security would much rather get a few "silly questions" than have to clean up a mess. When in doubt, use a personal device. There's absolutely no excuse not to have one.

And to the employer... think about VDI+BYOD. Move the security back into the server room, let employees use "whatever". Keeping the personal surfing out is a losing battle, no matter what your compliance requirements are.

Re:There's an easy answer...

[Anonymous Coward]

Bingo. There are a lot of cases where using Citrix and desktop/application servers will immensely help security. With that in place, BYOD can become the norm, while still complying to policies/laws/regulations/contracts.

I'm looking forward to newer phones and VMware like "LPARS". That way, a remote wipe from work only erases that partition while leaving the personal stuff intact, and there can be assurance (perhaps by another PIN/password) that the work based items will be stored securely.

Re:There's an easy answer...

[Anonymous Coward]

Finally a poster who thinks outside the box. Thank you.

Ask First

[wisnoskij]

If the boss says no then it is not worth going against him.
But as long as you are not installing anything then he should be reasonable.

Use the laptop for personal stuff!

[Anonymous Coward]

I work for one of the major global consultancies, my last job was also with one of the big global players. It has never been a problem that we use laptops for personal stuff. I watch videos, install applications & games and sometimes watch porn. I dont download stuff though - for that I use my NAS.
 
  I can't believe all the scaredycats here replying that you should buy your own laptop and drag around two laptops. That seems stupid and inefficient.
 
Sometimes employees have gotten malware from personal use, and sometimes company laptops get bricked (never happened to me). No big deal. Getting a new image is a fairly effortless jobb for IT support, but it can be embarrasing of course..

In return I don't have to buy and carry around two laptops, I am more efficient because I can quickly switch between personal and professional tasks when I am working from home in the evening.The laptop is then seen as a small perk in addition to being a tool I need to do my job..
 
  I am in Norway and I have NEVER heard of anyone being fired for something like this, and quite frankly if an employer will fire an employee for surfing slashdot or watching porn on a company laptop then they don't really appreciate their employees.

Re:Buy your own

[Anonymous Coward]

I quick google turned up nothing on this. Do you have any examples?

Re:No, there's no need

[Bluecobra]

Maybe, maybe not. There may be key-loggers installed which still grab your keystrokes.
Further, you can set up machines to prevent booting from anything other than the hard drive, then lock the bios.

How exactly will a software keylogger installed on the operating system on the local disk be able to grab keystrokes if you booted off a livecd? If you are talking about hardware keyloggers, that may make sense for a desktop computer in where the keylogger lies between the USB or PS/2 connection. I really doubt that a company would go through the trouble to install a keylogger in the proprietary ribbon cable between the laptop keyboard and the motherboard.

My solution

[AliasMarlowe]

I bring a Knoppix live CD, a ruggedized 500GB USB drive (Adata SH93, which is powered from a single USB port), and headphones. In total, this adds less than half a kilo to the mass I have to carry, and almost nothing to the bulk. The laptop hard disk is untouched, as it's not even mounted when Knoppix boots. I'm only using the laptop for personal purposes in hotels to either (i) surf the web, (ii) access non-work email accounts, or (iii) watch movies. I generally copy a selection of movies from the home media server to the USB drive before traveling - hotels often charge outrageous amounts for their limited selection of premium channels, and the company won't cover such charges. If I download anything, it also goes to the USB drive.

Re:My solution

[Anonymous Coward]

You don't even need a live cd, you can run it all off of the usb hard disk.

Re:My solution

[AliasMarlowe]

You don't even need a live cd, you can run it all off of the usb hard disk.

Not in my case. USB media are not bootable due to BIOS lockdown.

Re:My solution

[Anonymous Coward]

Interestingly, there are some USB devices which enumerate as an optical drive, but have flash memory -- for purposes like installing some OSes on netbooks -- and they might work for this, depending on how the boot lockdown is implemented, some bioses treat USB-attached CD-ROM differently from USB mass storage for such purposes. Still two things to carry, but less bulk than a CD-ROM, and a little less susceptible to mechanical damage.

Re:My solution

[Anonymous Coward]

My company does not allow ANY equipment to be connected or mounted (USB or SD cards/drives), to any of the laptops/desktops. Further more, when traveling and you connect at the hotel, you must log into work via VPN before you can do anything. Not doing so is a firing offense - and folks have been fired over this - yes, senior management too.

Smart phones are also not allowed to connect to the internet and have been locked out.

Re:My solution

[interval1066]

This drive isn't USB 3.0, although not a killer, there's no good reason for it not to be, especially if the company laptop has one. I would look for a drive that has it.

Re:My solution

[interval1066]

Just get your own net book man.

Re:My solution

[Anonymous Coward]

Seriously. Or a tablet, if all you're doing with it is web surfing and consuming media.

Re:My solution

[Anonymous Coward]

"premium channels", "a selection of movies from the home media" ...

You mean, pornography?!?!

Re:My solution

[Anonymous Coward]

In that case put a boot loader on the CD and run the OS from the USB hard disk. Heaps faster than a live CD. You can copy the Knoppix folder to the hard disk and have the CD look for its filesystem image there, if you don't want to set up your own OS.

(I assume you cleared personal use of company property with your boss.)

Re:My solution

[AliasMarlowe]

Just get your own net book man.

Why? My present solution is better in several ways.

First, the work laptop has a 17" 1920x1200 LCD, and I have full HD videos on the USB disk, while I have yet to see a netbook with a remotely comparable screen. Second, the USB disk and CD add almost nothing to either weight or bulk, while any netbook would occupy more space and mass, especially if it has a decent display. Third, the USB disk and CD are rather cheaper than even a budget netbook, and far cheaper than any netbook with an adequate display (or a tablet, as another pundit opined).

BTW, I already have a personal laptop which also has a 17" 1920x1200 screen (actually slightly nicer than the work laptop's). However, I choose not to carry it around when I travel on business, since it has mass and bulk far greater than the USB drive and CD, and for my purposes would provide no additional functionality. Note that I carry several other work-related items along with the laptop, so airplane carry-on mass and space are not to be wasted.

Re:My solution

[hokeyru]

Even better, if the laptop supports it, buy a second hard drive tray and hard drive, and swap between them for business and personal use.

Re:My solution

[ILongForDarkness]

But your personal laptop does provide additional functionality namely not having to screw around with your works equipment to try to do something with it you shouldn't be in the first place. I can almost guarantee you that your corporate IT policy doesn't allow personal use of their equipment. So keeping your job is a nice additional function IMHO.

Another option ... might be ... talk to your work. Tell them hey I'm traveling and have nothing to entertain myself with when I'm not working. Can I use the laptop for this? If not can I install whatever it is I need for work on my personal laptop and use it instead?

I've gotten burned before when using a work computer for my personal use. I didn't have a working computer at home and had a corporate laptop so I was using for all my personal use. Well it got corrupted and IT spent a good day or so browsing through it looking for viruses. Which meant that they were looking at all my internet caches, downloaded files etc. So they came down on me pretty hard and pretty much blamed me for it crashing (maybe maybe not) but regardless resulted in a awkward conversation with my manager as I was 25 at the time and lets just say some things that a 25 year old might use the internet for to entertain themselves is not something you want all your coworkers to know about.

So the wipe it and restore it solution might not work. If it is corrupted enough and you can't get it working your company's IT will end up playing with it and if it is a slow day in the office they'll take their time and browse through it looking for a way of blaming it on a site you went to that you shouldn't have or whatever.

Re:My solution

[Anonymous Coward]

My company does not allow ANY equipment to be connected or mounted (USB or SD cards/drives), to any of the laptops/desktops. Further more, when traveling and you connect at the hotel, you must log into work via VPN before you can do anything. Not doing so is a firing offense - and folks have been fired over this - yes, senior management too.

Smart phones are also not allowed to connect to the internet and have been locked out.

Are your assignments for the quarter delivered via video tape cassettes that self-destruct after being viewed?

You're either in a pretty sensitive line of work or the guy who set IT policy must have at the time been going through a pretty fucked-up divorce.

Re:My solution

[Runaway1956]

It need not be a "slow day at the office". If the boss says, "Find out why it crashed and burned", the techie is going to find out, or at least point to the porn and tell the boss, "I'm quite sure that's the vector, I just can't find the virus or trojan that came as a payload." And, the boss (whether he's technically literate or not) probably just accepts that you, the user, got a virus while looking at porn.

Re:My solution

[QuantumRiff]

Lenovo sells a Hard drive carrier that fits in the CDRom bay of ThinkPads. Works great.. Especially since my drive was EXT4, and Windows 7 can't read it.. (so the corporate monitoring software never even recognized another partition on there, let alone drives. I just left it in all the time. My co-workers would just swap theirs in, and Reboot..

Re:My solution

[ILongForDarkness]

Speaking of internet porn and going on a tangent: why is porn notorious as a virus vector? Is getting paid to film/participate in orgies really so bad that you have to do illegal things on the side to keep the lights on?

Re:My solution

[AliasMarlowe]

But your personal laptop does provide additional functionality namely not having to screw around with your works equipment to try to do something with it you shouldn't be in the first place. I can almost guarantee you that your corporate IT policy doesn't allow personal use of their equipment. So keeping your job is a nice additional function IMHO.

Actually, you're wrong here. We are allowed to use our work laptops for personal browsing etc. by corporate policy We are not allowed to circumvent any of the protections which defend the integrity of the information on the hard disk. By not booting from that disk, and not even mounting any of its partitions, I am in compliance with this policy. This has been verified with the IT department.

Another option ... might be ... talk to your work. Tell them hey I'm traveling and have nothing to entertain myself with when I'm not working. Can I use the laptop for this? If not can I install whatever it is I need for work on my personal laptop and use it instead?

You're joking, aren't you? Work is done exclusively on things which are property of the company; laptops are leased. The amount of lock-down needed would mean they'd reformat my Linux laptop and install Windows and a heap of corporate spyware, anti-virus, policy enforcement, and so forth before it could access the VPN. Oh, and I'd have to donate it to the company. Even smartphones are only allowed to connect to the VPN if they are locked-down company smartphones.

I've gotten burned before when using a work computer for my personal use. I didn't have a working computer at home and had a corporate laptop so I was using for all my personal use. Well it got corrupted and IT spent a good day or so browsing through it looking for viruses. Which meant that they were looking at all my internet caches, downloaded files etc. So they came down on me pretty hard and pretty much blamed me for it crashing (maybe maybe not) but regardless resulted in a awkward conversation with my manager as I was 25 at the time and lets just say some things that a 25 year old might use the internet for to entertain themselves is not something you want all your coworkers to know about.

You've been burned, and you burned your employer. Both occurred through your own negligence. My solution avoids any possibility of such ever happening. Oh, I'm not 25, and I'm not at the bottom of the hierarchy.

Re:My solution

[Runaway1956]

It's simple, really. Of all the computers that I have ever had to clean, I looked through the logs, and 80% of the time or more, found that one or more users had been to porn sites. I followed the links that they used, and usually found some sort of malware trying to install itself. "To view this content you must install blah-blah codec. Do you wish to continue?" Other viruses were more of the drive-by type, in that they don't ask at all. There is a catch to free porn, as often as not.

Porn isn't the only vector, of course, but that is the first thing I look for when someone brings me a sick machine, and it's almost always there.

Windows is so very "helpful", in that it maintains very specific logs about your internet browsing! Which, is reason number two that I don't run Windows myself. ;^)

Re:My solution

[ILongForDarkness]

I worked for an anti-spam company. It was the same way with web-based spam (people hacking or creating Yahoo, gmail etc accounts to spam with), porn was the method often used. Those captchas that some free sites throw up (maybe even the paid ones I wouldn't know) they sometimes come from a bot that is creating email accounts. The site makes money by creating a whole lot of email accounts automatically rather than having to pay someone to sit around solving captchas, then bundles them together and sells them to spammers. There is also a lot of cheap labour stuff going on (for some reason I think it is mostly Thailand) where people sit around solving captchas for 1c for 10 or something like that.

Nice company that they let you use it for personal use. I've only had that once but then again by then I was the server/network admin so they might just have figured that I wouldn't get caught even if they told me not to.

Re:My solution

[Courageous]

Flash the bios. Don't tell anyone. Plead ignorance. ;-P

Re:My solution

[tlhIngan]

Speaking of internet porn and going on a tangent: why is porn notorious as a virus vector? Is getting paid to film/participate in orgies really so bad that you have to do illegal things on the side to keep the lights on?

Just demand, really. And no, it doesn't have to be the providers doing it.

What happens is simple - malware authors look through say, the popular torrents and grab the filenames fro mthem. Then they make a plausible-looking file of the same that's around the right size but has something like "This file requires additional software to play. Please visit hxxp://malware-r-us.com/codecpack to download".

And yes, people will install it.

It seems people wanting porn are particularly vulnerable to the Dancing Pigs issue. They'll even disable firewalls for you if you ask nicely.

Re:My solution

[fuzzywig]

Off the top of my head, I can't think of any way that I could tell that someone had booted one of our laptops into a LiveCD, even if I was watching before hand.

If you're not even mounting the HDD then the only record will be in the BIOS power logs as far as I know.

Although some of my users would probably manage to get the CD stuck in the drive or something. Sometimes I think they break things just for the attention.

Re:My solution

[ILongForDarkness]

Yep users would find a way like clicking on the install now button on the desktop or whatever :-) But in most cases your right live CD is the way to go asssuming he has enough storage capacity for content on the thumb drive he mentioned. All depends on the video quality and amount you watch I guess, Most of my 720p rips are about 1GB per 40 min, if you are away for a week with ~6 hours a night to burn you might need a pretty serious thumbdrive.

Short answer and long answer

[element-o.p.]

The short answer is, "You are working for the wrong employer." You say you work at a company that will install tracking software on your laptop and won't give you admin access. Therefore, you can't disable the tracking software. Furthermore, you say that you are addicted to the Internet. Working for a company that is likely to fire you for doing something that you don't have the self-discipline to avoid doing doesn't sound like a good plan to me.

The long, more realistic, answer is, "Read your corporate compliance policy. It should outline what is acceptable in your organization and what is not." A lot of companies consider laptop use, especially while traveling, to be more like telephone use. It is issued to you for business purposes, but let's face it: most (all?) of us will use it for some personal activities as well. So long as you aren't browsing NSFW sites on the clock, installing malware, etc., most IT departments really don't give a rip what you do. They have more important things to do -- and not nearly enough time in which to do them -- than to spy on your web surfing activity. More likely, the tracking software is to find out what you did that hosed your computer in the event that you were browsing sketchy web sites and infected it with something. However, different companies have different policies. /. can't help you find out what your company's policy is -- you'll have to do that yourself.

Use a Virtual Machine!!

[Anonymous Coward]

Then delete it when you're done :)

Pimps!

Swap the hard drive instead of the computer

[Anonymous Coward]

Having done this for years with many jobs at companies I don't trust whose computers are mismanaged to the point of blue-screening no a daily basis (IT routinely installs incorrect drivers on the machines they issue).

I have simply purchased a hard drive and identical chasis for the laptop (you can find sleds/caddies for most anything on eBay for less than $10) I have which I can easily swap depending on the situation. Most of the time, I just keep my custom drive in but in the situation when I resign or have to give the machine back, I can swap the drive in a matter of seconds.

This gives me the peace of mind that they aren't tracking everything I do (which I doubt they do anyway) which is also helped by the fact that all web browsing I do is done via SSH (including making certain that DNS requests go through the proxy as well). I've seen companies fire people for reading nytimes on their machine.

This method isn't for everyone. Realistically, the people who are sophisticated enough to get this working right are also most likely the same folks who don't represent a risk to the network. My custom install/drive is far more secure than the one they gave me so I know I'm not a security risk as most of the issued machines are loaded with spyware since they have most people use ancient versions of IE. Further the drives they give don't use FDE which is silly given the amount of confidential content many folks deal with whereas mine is FDE w/truecrypt.

In the unlikely event you are ever "caught" you could always claim that you swap drives to play games and left your personal drive in.

Ever since an employer truly wronged me, I decided I'm not going to stay late since my laptop is misconfigured and pleading with IT to fix it yields no traction ("only one blue screen per day? that's one of the better ones, don't complain").

I know this may be an unpopular view here, but I've found the certain benefit (no monitoring of what you do, much faster computer, FDE for peace of mind) far exceeds the very unlikely downside of getting in trouble. Besides if I didn't do this, much of my benefit as an employee would be gone as I'm known as being very efficient in that when I encounter situations with software where I can't access the back-end, I can quickly write screen scripts to automate processes for myself and others. If I had to use IT's install, I would not be allowed to really install that software or it would have to go through some goofy approval process and probably get denied.

Re:No, there's no need

[Auroch]

Maybe, maybe not. There may be key-loggers installed which still grab your keystrokes. /quote? ... which is why you boot from your usb key? Also, your sig : "We paid for the internet one dialup account at a time." is completely wrong. Much of the internet infrastructure was paid for through government subsidies and grants, EVEN in the USA, but especially so every where outside the usa. As for developing the internet itself, that was subsidized through military and education spending... by the government.

Buy your own laptop

[Registered Coward v2]

Get a cheap one that does what you want and use it for non-work stuff. If your employees is using tracking software, trying to bypass it is likely to end badly. With your own, you don't have to worry about what you do ith it. Sucks to carry 2 machines but it would be the option I'd chose.

Re:No, there's no need

[Narcocide]

I think he means a hardware-based solution. I've seen them sold as usb keys or sortof innocuous passthrough connectors for an external keyboard. I've never heard of them being covertly installed inside a laptop like his post seems to be implying but that doesn't mean it doesn't ever happen.

Buy your own laptop hard drive

[Anonymous Coward]

I travel extensively for my job, as do most of the people in my company. My employer actually issues us two hard drive, one just for work which is locked down (can't install anything, etc) and one for use for when we're in the hotel and want to surf, etc. It can't be that expensive to buy a laptop hard drive that will fit in your hardware and you won't have to worry about putting your companies info at risk, getting tracked, imaging etc.

Bad Idea

[Anonymous Coward]

Those all sound like a bad idea. Not only is doing most of that likely to be against company policy and could cost you your new job but it might also be illegal. If the machine is encrypted because of HIPPA compliance or other similar regulations you are getting into real dangerous territory. You don't want to become personally responsible for a breach because you intentionally reconfigured your laptop and left confidential information on an unencrypted/unprotected machine.

Besides, if the IT department is halfway descent you probably couldn't do what you are talking about anyway. Since you aren't going to be an admin I think it's safe to assume the bios will be password protected. They are probably using windows 7 bitlocker with the TPM. In that configuration you wouldn't be able too boot of a usb thumb drive or a live cd. Even if you did and you cloned the hd to something else and formatted it you wouldn't be able to boot the machine because the TPM -> Bitlocker chain would be broken and would require a recovery key you wouldn't have access to. This setup is pretty resilient to tampering even when you have physical access to the hardware.

If your new company really is that bad that they say you can't use your laptop for anything personal, even when you are traveling, your solution is to use something else. Smart Phone, tablet, netbook. Heck even the hotel provided business center computers. Personally, I just started at a new job and our IT department is much more reasonable and realistic but maybe that is because we have lots of people who travel 90% of the time. We are admins on the box. We can install almost anything that isn't harmful but don't expect IT to support it if it isn't business related. Personal browsing is allowed as long as we remember the hr rules about appropriate content.

Screwdriver and start modding!

[Anonymous Coward]

Ha, nothing is better than modding the employers hardware a bit, just replace the harddisk with one of your own. Only use the official hd if you need something of the systems guys. Locked down laptops limit your productivity, so with your own 'modded' laptop you'll be that little bit more productive than your colleagues. Extra bonus, this extra freedom will stimulate your creative flow. And lets face it, in this society, as long as you are productive nobody in management will ask questions :-)

Re:Buy your own

[enderwig]

It is not unreasonable, just inconvenient. The work laptop is for work. That is why they issued one to the OP. Personal stuff should be done on your personal stuff.

If you value your job

[RKBA]

If you value your job, bring your own laptop or tablet computer for personal browsing.

Two Words:

[davide marney]

Kindle Fire

Sunday

[Anonymous Coward]

./'s angriest day.

Re:Buy your own

[EdZ]

Yet when someone starts using a company/government laptop for personal web browsing and installing personal software, and this results in release of confidential data, people are in uproar as to how this could be allowed to happen. It was allowed to happen because dipshit here decided "fuck the Data Protection rules, I gotta play farmville!".
The work device is for work, the personal device is for personal stuff. And never the twain shall meet

Stupid question.

[jopet]

Ask your employer or do whatever you want.
Next.

To explain it for you

[EEDAm]

Since you asked the question in the first place, you obviously don't understand the issue. The laptop is not yours. Lets get that straight in your brain again: the laptop is *not* yours. It is a device given to you *only* for the purpose of doing your employed work. Consider it on lease only for work purposes. There will be a list of permitted activities and applications for work purposes and, perhaps, a limited number of personal use scenarios permitted. Separate, there will be a large number of activities / applications which will be specifically prohibited. What you are proposing doing is using *someone elses* property to do something which you will have signed a contract (your contract of employment) not to do. To do so would therefore make you in breach of contract and to do so knowingly means you are essentially dishonest. So it's not your right, nor is it your shit to do what you like with and you will have expressly signed a contract for money (your wages) not to do it. See? If you do see but you still think you should be entitled to do what you like with someone else's property against their permission when you've signed a contract saying you won't do it, then, yes, you absolutely deserve to be fired.

Re:To explain it for you

[Anonymous Coward]

Honest Services Fraud is actually a felony punishable by several years in federal prison. Just sayin'

You can also

[viperidaenz]

Get yourself a new job when your employer finds out what you're doing to their property

Re:No, there's no need

[centuren]

I can make an image of the drive, then wipe the machine, and restore it back to its former state if I ever have to return it.

Is your new job worth it? Not saying you'll automatically lose your job over that, but I can't imagine it'll go over well. Especially as you'd be using your (non-work prepared) laptop for doing work and might inadvertantly put them at risk (the kind of risk they hope to eliminate by issuing you the laptop in the first place).

The simple solution is get yourself a USB / livecd type distro. Don't touch the hard drive.. and if it's encrypted, you shouldn't be putting your company at risk (assuming you don't use the same key for anything else). Personally I'd ask your IT guys if they are ok with this before doing it. Sometimes they can actually be reasonable about this kind of stuff.

The real solution here is to leave your work laptop alone completely and get your own laptop for personal use.

The parent correctly points out that you can use a live distro and avoid having to touch the company's hard drive.

Maybe, maybe not. There may be key-loggers installed which still grab your keystrokes.
Further, you can set up machines to prevent booting from anything other than the hard drive, then lock the bios.

Just to be clear, OP is saying he is "not the type of person who can't look at pornography" right? In this work-related scenario, if that's the case, get your own laptop, tablet, or smart phone.

If that's not the case and he is worried any personal use will get you in trouble, that's probably something he should clarify. I know plenty of unreasonable work places are around, but it is unreasonable to expect no personal use from a company laptop in constant possession of an employee (especially outside of work hours).

If neither is the primary case and you are expecting the laptop to be so locked out that you can't run anything but an office suite and the company-modded IE-engine software, then, as was pointed out, run a separate OS off a thumb drive. If the hardware is completely locked-down, back to the tablet/smartphone concept. Look up the policy, talk to the IT guys, but, essentially, DON'T do something that can mess up IT's carefully locked down security, and DON'T do things that are illegal or NSFW.

If the issue isn't "I want to look at pornography on my work laptop", why would the company care if he reads an ebook or watches a movie, if it's done responsibly (and somewhat out in the open, so all that's monitored is a lot of "unknown activity")? It kind of sounds like it's a porn thing, though. Maybe it's the inferred metaphorical air quotes.

Allowed personal use

[phorm]

Have you asked your employer about allowed personal use on said laptop?
Are they cool with use that doesn't touch the contents of the hard drive?
I have a 2.5" USB HDD in a USB-powered enclosure (Vantec=recommended). It's got a bootable Linux distro with a browser, utilities, and games etc for when I don't want to expose *my* data to possible viruses on relatives' machines.

Start looking for a new job

[Pop69]

It isn't going to be long before you get fired from this new one

Work Like a Contractor

[ancarett]

If your company does a lot of working with contractors or independent entities, chances are that they have policies in place to support people who aren't using institutional systems. Check and see if there's a contractor policy already in place that covers this and if any other employee has opted for this freedom.

After a couple of years of frustration with super-crappy work machines, I checked with my employer (a university). Was there anything for which I needed their hardware or software to access? The answer was no. I don't do financials, I access institutional data at only one step above the general public (Read-Only, limited access) or through portals that are already designed to work off-site.

So I cut the cord and don't use a work-provided machine for anything. It's occasionally annoying (as when my HD died and I had to deal with that on my own) but in so many other ways, intensely liberating. I watch colleagues wrestle with clunky "hardened" laptops or the large Powerbooks they get if they're not stuck with a low-spec desktop. I attend meetings with all of my documentation and data-crunching done on a netbook or ereader that's customized to my workflow. Plus, because I have consulting and contract work outside my full-time job (with employer's full knowledge and consent), my tech is even partially deductible at tax time.

If you can't use your own or can't afford to at this point, talk with IT about the acceptable policy for occasional private use and software add-ons they'd approve. At least you'll know you'll be in their good graces when you're on the road for them and would like to surf to /.

Re:Buy your own

[pla]

Buy your own laptop to fuck around with you cheap bastard. The laptop is the property of your employer and if you don't agree to the terms they set then don't work for them.

This is an entirely fair point of view.

To which I would respond, if my employer presented it as an argument, by leaving said laptop at the office 24/7/365. I might take it to (on-site) meetings so I could actually get some work done in the back of the room while the 3rd assistant VP of Buzzword Optimization drones on with a variety of incorrectly-used physics metaphors.

Companies provide people with laptops in the hope that those people will do "free" extra work for the company. In some cases, the use of a laptop for whatever-the-hell-I-want while stuck in a hotel room for four days between conference sessions makes up for that extra work they might occasionally get out of me. If I can't use it for anything but work, I view it as nothing but an albatross to lug around, feed, and check through security. And if it actively tracks me while on my own time - thankyouverymuchbutfuckrightoffnow, 'kay?

Re:No, there's no need

[Anonymous Coward]

If the issue isn't "I want to look at pornography on my work laptop", why would the company care if he reads an ebook or watches a movie

That's what I was thinking, too. If you are reading /. or watching a movie TV show on the laptop on your own hours, who really cares. Just don't read Catcher in the Rye on eBook, the FBI will flag you for sure!

Idiot.

[Anonymous Coward]

This guy is obviously going to get himself fired one way or the other. The fact that wiping your company laptop even crossed your mind makes me think that you're very young, and have yet to feel the sting of being fired for doing something stupid like this. Has it crossed your mind that they might find out that the machine has been wiped through timestamps / missing logs, and that they might not like this? Don't be an idiot, dude. Just buy your own damn laptop if you "can't not browse the internet" you junkie.

Re:Get a lawyer

[RDW]

Don't listen to advice about wasting money on a new laptop that you will only need for one time...Get a lawyer to look your employment terms, and if he saids OK for you to do whatever you want, then do whatever you want.

Now the OP just needs to find a lawyer who charges less than the price of a cheap laptop for giving any sort of legal opinion!

Get your own laptop

[Anonymous Coward]

I want to develop software. The company I work for does not develop software. I do not want them to have ANY rights to the software I develop. I may license it to them, but at my discretion. So I carry two laptops! Done!

Common sense

[slasho81]

Now that you have a job, you can afford your very own smartphone.

Two easy steps...

[Shoten]

1, read their acceptable use policy.

2, follow it.

Be humble

[jones_supa]

Can't you just play fair with the company you're in? You are in the same team and they pay you. Try to work it out with your superior if you have special needs. The hacks you listed are just lame.

Re:No, there's no need

[Anonymous Coward]

Keyloggers can be installed in the BIOS, though this is rare, it can be done.

But you already know the answer

[grumble_grumble]

From the way you ask the question I think you know the answer is "don't" but were hoping someone here would be able to convince you otherwise. When I was younger I'd say go for it - I would have just bought a separate hard drive and sled for the laptop and shut down/swap hard drive/boot up when I wanted to switch between work and play. The hdd sled is pretty 'easy-access' on most laptops and while it's a hassle to have to shutdown every time, it beats having to carry an entire other laptop and it covers more potential holes than the usb/livecd boot option. That said, with the stakes as they are today for protecting company data and networks, I would never do work or connect to their assets while running the other drive. And by the same logic of the stakes being what they are, even if you were scrupulous about that rule, if the company detects the change somehow, someway they may just can you for it to be on the safe side. This is a very common entry vector for hackers/malware. I admit it sucks to have to carry two laptops on travel. Tablets are convenient for carry size but there's times when they just don't cut it and you need to step up to the laptop level hardware. So generally I just carry a personal laptop or suck it up and limit my personal computing to what can be done on a tablet.

Make the employer agree to YOUR TERMS!

[Anonymous Coward]

Employers generally think they rule your world. For the hassle of having to lug around one of their laptops you should demand the freedom to use it in any reasonable way, such as web browsing. If the employer pitches a fit, tell them good riddance.

Employers think they rule the world. It's time the "human resources" set the terms!

I am a Director of IT.

DON'T!

[Anonymous Coward]

Buy your own damn laptop or iPad. That one is not only not your property, and it will not only be inspected upon return, but nowadays it is very probably festooned with monitoring utilities, including keyloggers, which work in real-time and report back to the mothership what you're doing and when. Some companies even install covert utilities which take a snapshot from the computer's camera every few minutes. I am not not not kidding.

There was once a time when I felt comfortable sending personal emails and cruising the web from my company-issued laptop, but those days are gone forever. The trend in corporate IT shifted to total surveillance over the past couple years. Laptops and iPads are cheap. Invest in a good one and don't look back. And never use your company machine for anything you wouldn't do with the most judgmental and accusatory IT manager at your elbow.

Oh, and maybe put a little piece of tape over that camera.

Two Laptops

[Anonymous Coward]

Just get your own laptop and use both. Yes, it's a hassle. I don't think *most* companies regularly monitor what every employee is doing on work computers so that they can hassle you about it, but I know firsthand that a company *will* take the opportunity to snoop for reasons to fire you if there is anything else they don't like about you.

I use my own equipment

[Anonymous Coward]

I bought my own systems and monitors and use them in the office so that I don't have to install the company's licenses tracking and monitoring software. I also bring in my own laptop and use my own equipment at home. Hardware is so cheap today that it's not that hard to afford your own equipment. I think of it as being similar to construction workers that carry their own tools in the back of their pickup trucks.

Re:Buy your own

[Oligonicella]

"We don't know what the terms or the job are."

Well, we can pretty much assume the GPS and other things are, they're on the device and he wants to circumvent. He wants to circumvent because he knows about them. He knows about them because he was told they were there or he purposefully went looking.

"... having to haul two laptops around may be unreasonable."

Please, they weigh what, three pounds and both can fit in the same carry and occupy an entire inch and a half more?

I am company IT

[rdebath]

I'm company IT, I own that laptop I can make it do anything I want, I can install a boot rom that means I own any OS that's installed on the machine.

The laptop is for company use only, it's camera will be used to photograph everyone who uses the machine.

If you attempt to wipe the disk it will start up it's 3G chip and send a photo of you to the police.

Every keystroke you make will be recorded and sent to HR for analysis.

All photos will be archived for later perusal.

All attached USB devices will be copied and archived.

All local networks will be monitored for illicit content.

But of course you can trust me, I only have your best interests at heart.

who owns the activities on the laptop...

[K3ba]

One thing to remember is that for most companies, any activities undertaken on company equipment that create intellectual property is owned outright by the company, and not the individual. So that book or game or widget that you might write will end up not being your own. Get yourself a netbook or tablet or whatever - there are just too many reasons why your post is just plain scary for the new employer.

Easy..

[maestroX]

Not your laptop, not your rules to make.

If you really want to do it . . .

[NicknamesAreStupid]

. . . then join Anonymous. The corporate world may not be for you.

Re:Buy your own

[Anonymous Coward]

Dear God, I think someone with common sense and integrity just posted.

One More Option

[Anonymous Coward]

I'm not sure if anyone mentioned this, but a lot of today's laptops have easily removable hard drives. Buy your own replacement drive and carry it with you. Swap the original drive in to do corporate work, use your drive when you're on your own time. In this way, you will have good performance without putting your employer's network at risk.

Is your paranoia justified?

[HapSlappy_2222]

In my experience, having a company laptop issued to you is much like having a company car issued to you. Take care of it, don't do anything you're not supposed to with it, and remember it's issued to you to make your job easier, so make sure it does. I can't think of a single thing that you should be doing on a company laptop that you'd need to encrypt or hide from your employer (remember, THEY own the hardware), so a lot of your question is moot.

Stuff like reading an e-book, browsing the web, or customizing it to your specification is probably fine, assuming it doesn't interfere with your actual work. Well, unless your company has specifically told you NOT to do these things, in which case you really should bring a second, personal, laptop (or kindle, or ipad, as others have said) with you. Doing anything you'd be embarrassed to have your boss find out about is simply not a good idea, though. Think of it like it's your work desktop, only portable, and adjust your usage accordingly.

I don't see why this question needs a more complicated answer than this. If you still have questions, ask your boss. None of us on Slashdot are policymakers for your company, and asking us to decide for them is silly.

vmPlayer

[Anonymous Coward]

use vmplayer, put a vm on it - run your stuff in that.. with no access back to the physical machine... plug in a different wireless adapter, configure with no network stack, then bind to the vm network - then it's isolated from the laptop os as well.

Re:No, there's no need

[Deorus]

Unless they act like viruses or the person using the laptop is running MS-DOS, there should be absolutely no reason for concern, because no modern operating system uses the BIOS to read input from a keyboard....

why ask slashdot?

[Anonymous Coward]

This sort of thing depends on company policy and would be a perfectly reasonable question to ask your supervisor/boss. Nobody here knows what your new employer's rules are :P unless you're just asking how best to break them. In which case sure system image. Whatever -- doesnt really matter what we say since we dont know your new it dept's procedures either.

Don't be so paranoid

[scamper_22]

I'm sure your laptop has monitoring software, but the question is... who is actually looking at the monitoring and do they care?

I have a laptop issued for work. At work I used my desktop, but when I need to remotely work, I used my work laptop.

If you're honest with yourself, chances are you won't get in trouble. Unless you work for a hyper security company. Are you putting in an honest days work at the office? Beyond that, they're giving you a laptop . Just like if they gave you a company car. Some amount of personal use is generally tolerated.

When I'm at home, I use my laptop quite liberally. Some small games, web browsing... are all good.

I don't do anything 'illegal' on it though.

I think you need to relax a little bit. By all means find out what monitoring policies your company has... but if its like 99% of companies, all the data goes into a giant pit no one looks at... until you give them a reason to look at it.

If you have to ask...

[trailerparkcassanova]

then use your own laptop or netbook.

I tweak with my employers laptop

[Anonymous Coward]

Wow does nobody have any cojones? This what I do with my corporate laptop. Well it is nice that the laptop has two hard drive bays. I copied the company drive to another. Hack the crap out of it. Decrypted the local admin password. Removed all the crappy security software, and crap I don't need. Left just the apps I need for work, then migrated slimmed down version a virtual machine I run in linux. So I run linux on my work laptop, and a couple work apps in a virtual machine. And if IT wants the laptop for a update or replacement I just put origial drive back. Added bonus, I swapped drives when I fly international and customs never asks about my whole drive encryption because they never bother to look at the second drive.

Re:Don't do it. Carry your own laptop.

[HapSlappy_2222]

Keep your work and personal life separate.

Truer words were never spoken. Well said.

Re:No, there's no need

[icebike]

A tiny tiny portion of the real early internet was funded by the govenrment. There has been no funding of infrastructure by government for the last 20 year.

Many companies turn off usb booting in the bios, and then lock the bios.

Why?

[Anonymous Coward]

At least do one fucking day of work at your new employers before you start asking the world for guidance in subverting their IT policies. Sweet Jerry Lewis, what else are you planning here? Already freeing up space in your kitchen cupboards for the cafeteria sugar sachets you'll be trousering? How all those toilet rolls you can smuggle out?

Do something wonderful. Call your hiring manager, explain that he's just hired a freeloader with no work ethic, but one who'll be helping him out by declining the position. Doing this will induce strange feelings in your body. This is a symptom of having experienced integrity for the first time in your life.

Teminal Services

[Anonymous Coward]

Here is what some have done at my company. We have a similar situation with my employer. The employer isn't unreasonable, but the machine is locked down to the point where it becomes a nuisance.

Buy your own laptop
Install the common work applications you need - Visio, Office, etc.
Leave your company laptop on your desk
Create share to synchronize data between company and your laptop
RDP into company laptop via company VPN to work on any apps exclusive to company

Works like a charm and you will usually end up carry something lighter than the company issues

Re:Teminal Services

[unixisc]

Why would I want to do work on a laptop that I paid for, instead of using the one given to me, or asking for a substitute instead? Just as it's a bad idea to do personal stuff on one's work computer, it's equally - not more, not less - bad to do work stuff on one's personal computer.

Re:Don't do it. Carry your own laptop.

[Nimey]

or if not a Macbook Air, then something else equally small and portable. I'm a big fan of my wife's two-year-old 11.6" Acer Aspire - it's nearly as small as a netbook but much faster with a better keyboard and display. It's possible to replace the hard drive with an SSD, too.

Re:No, there's no need

[unixisc]

I know plenty of unreasonable work places are around, but it is unreasonable to expect no personal use from a company laptop in constant possession of an employee (especially outside of work hours).

The only case I can think of where personal use of one's work laptop may be unavoidable is if the employee is travelling out of town on a business trip somewhere - he's not likely to take 2 laptops w/ him. In such a case, it may make sense for him to use IE's InPrivate Browsing or something similar. Or else, better idea - if he has his tablet or smartphone w/ him, use that. I'm assuming that it would be for afterhours entertainment (once all the meetings and dinners are over) and he's done checking his work stuff on the laptop.

Otherwise, get another laptop/tablet/smartphone for what you need to do. Laptop if a lot of typing will be involved, and tablet/smartphone if it won't. Whether it's porn or visiting otherwise blocked websites, do it on your own equipment - and on your own time.

Wow, lots of hate

[aztektum]

Yeah the person is going over board with talk of wiping his laptop and all that noise.

But what is with all the vitriol? He's a "cheap bastard". He has horrid working habits. His life is hollow and he should read a book? How any of that was deduced from one post on /. is beyond me.

My advice, as someone who has written AUP for companies: If your company policy is that ridiculous, you should question working there. Odds are it is not. My guess is if you get your work done they really won't give a rats arse. The laptop is their property, a worker is not. If they cannot accept you checking YouTube or /. while off the clock (including a quick break here and there), they're crazy.

But, should you seriously just want to avoid it: Make a bootable Linux USB drive and encrypt /home

Re:Wow, lots of hate

[IndustrialComplex]

But what is with all the vitriol? He's a "cheap bastard". He has horrid working habits. His life is hollow and he should read a book? How any of that was deduced from one post on /. is beyond me.

His solution is mindbogglingly obvious - use a personal laptop. The size of netbooks today means that all uses except gaming can be done via that without any real inconvenience. If he has one, then why the hell is he asking, if he doesn't then he is being a cheap bastard for trying to do something that really sounds unethical, or at best, very stupid.

His life sounds hollow because there is something that he mentions how he is one of those people who just can't NOT do something. Clearly he has some issue there and should work to address that. If what he couldn't NOT do was read a book, go for a walk, exercise, sight see, etc. this wouldn't be a problem.

His entire question reeks of ignorance, entitlement, compulsive behavior, and other unsavory qualities so deducing that he probably isn't 'all there' with being a respectable person.

Re:Wow, lots of hate

[Anonymous Coward]

Agree with everyone going over the top.

OP: Buy a small laptop hard drive. 100-300GB or so. You might even have a few friends with extra hard drives sitting around unused. Pull out the company's hard drive and put yours in as needed. Buy a static free bubble wrap to keep the drives in. Done.

Just find a better job.

[Anonymous Coward]

If your employer is overly paranoid, just find another one. Absolute majority of IT companies don't care about reasonable personal stuff on the laptop. Even companies like Intel, with "paranoid" being part of their motto, allow personal use of the laptops (yes, Intel). Of course nothing illegal, no p2p etc. No problem with slashdot and facebook.

Re:Buy your own

[danomac]

As others have suggested, a live CD/USB distro could be used as an alternative OS if the OP needs more, assuming the laptop can boot from either. He could even boot from a portable hard drive.

If they're going to the extents that they are to lock down and secure their network/devices, surely they won't allow booting from a CD or any external device... they'd be crazy. The BIOS is likely locked to boot only from an internal drive, and it's probable that tamper detection is in hardware. Not worth the risk...

Don't Do It

[greenlead]

Use your work laptop for work and your personal laptop for personal use. Don't ever make the mistake of mixing the two as it can only lead to bad things later on.

Re:No, there's no need

[buzter]

Keyloggers can be installed in the BIOS, though this is rare, it can be done.

Actually, it is not that rare. A company called Absolute is a pretty big player in the firmware level asset security control and recovery business. Every major vendor has models that embed their agent into the firmware of select machines. These agents persist through imaging/formatting. They allow tracking of IP address, geolocation on models with GPS, keylogging, remote bios lockdown, remote wiping, and more. You can see a list of models on their website at: http://www.absolute.com/partners/bios-compatibility

In short, I agree with the above posters. Play it safe and talk to your IT department. Ask them if you should buy your own laptop for non-work use or use a live cd.

Re:Buy your own

[couchslug]

"If you travel a lot with work, having to haul two laptops around may be unreasonable."

Nothing a Hardigg or similar case which can hold two laptops plus accessories can't solve. Get the sort with "pluckable" foam squares and make suitable holes, then put a section of foam between the lappies so they don't slap each other.

I'd rather have a case I can bang around a bit and lean against than a common laptop bag.

I usually just use my own HDD

[Anonymous Coward]

My usual workaround is just to remove the supplied HDD intact, stick it in a drawer, and install my own. (With a sticker saying "personal property of..")

That way, should the return of the machine be demanded, my data won't go with it.

There's one precaution you didn't think of...

[matunos]

...buy your own laptop.

The question is: why did he get a laptop?

[stajp]

Almost everybody here says: "It's company laptop, buy your own", but nobody asks why did the guy got a laptop? 1. You don't need a laptop if you're just going to work at your workplace. A desktop is much better solution (easy upgrade, multiple monitors etc). So either his boss(es) chose to give him a laptop for a reason and he's forced to use it, or he wanted it. 2a. The reason could be that he needs to travel a lot. In this case, how will they monitor his usage when he's not online? Even worse, how will they enforce security policies if he's constantly in non-secure areas? First time the laptop leaves the company, it should be considered unsecure. 2b. The reason could be that they want him to work from home. In that case, it's pretty easy solution - leave the computer at work 24/7/365 and use your private equipment at home. Don't use your work computer for anything beside work. On trips (look at 2a), don't bring a computer, let somebody else take it, or organize a computer on the destination. If your job is so important that you need to be on your "work" computer (or have it next to you) at any moment (please read: in your spare time), then you should have a privilege to use it as you wish, even if it's company computer. Another problem is this guy's health. Somebody mentioned that a laptop is 1.5 - 3 kilograms. I was issued a 3kg laptop + adapter which I carried in public transport (mostly standing in crowded trams and busses) during my commutes. After 6 months I requested a sub 2kg laptop because my back was killing me. It's easy if you're driving to work, but if you're bringing it around on a shoulder (why should you buy a backpack for company's computer), then that's a highway to hospital. So, the question is: why did the guy get a laptop? Was he forced, or did he want to get it. If he's forced, he can either refuse to use it outside his workplace, or, if the company is so paranoid, request a permission for every usage of laptop outside his work place (this will make PITA to IT guys :D). If he asked for it, then play by the rules you willingly acknowledged. Either way - buy your own equipment, and work@work, don't read slashdot during work hours.

Re:The question is: why did he get a laptop?

[DontScotty]

"1. You don't need a laptop if you're just going to work at your workplace"

Absolute statement = absolutely wrong.

Perhaps they are a company that uses unassigned seating in an office environment. Or, they have to go to the NOC in event of failure or issue. Or, they go onsite - and the company only wants to have one machine per employee.

Re:The question is: why did he get a laptop?

[tftp]

I was doing a contract in a large company some months ago. I was working at the company, in a cubicle. No travel was required. I was given a laptop. Why? Many reasons.

1. A laptop is a common denominator. Instead of sourcing several configurations you settle on one or two laptops, and make a volume deal - often a lease. Engineers and salesdroids all get laptops. These days a laptop is plenty fast for everyone.
2. Spare parts and OS images - the fewer configurations you support the fewer images you need to maintain.
3. Ease of deployment. It's a little device, you bring it into a cubicle and the guy is all good to go.
4. No monitor required. These aren't free, and they are yet another item to source and repair.
5. Fewer cables and power outlets are required.
6. Presentations. Even cubicle hermits need to present material at a meeting now and then.
7. Travel, however unlikely. A normally sedentiary engineer can be sent on an emergency call from an Important Customer. I have seen it happening now and then.
8. Work from home. Even if telecommuting is not your main mode of work, there are days when you can't come to the office (a child is sick, etc.) You grab the laptop and become as productive as possible under the circumstances. This also includes emergency work that Must Be Done Yesterday.
9. Low power consumption when running; excellent power management; one little fan instead of several large ones.
10. Easy access to expansion ports (no need to crawl under the table.)

I'm sure there are other reasons, but these are very obvious ones.

I'm typing this on a personal 17" notebook that I have for about 4 years now. It's normally sitting on my desk at home, but on several occasions I took it with me, and that was essential. I'm not just "browsing the web" on it, I'm doing my own work on it.

Re:The question is: why did he get a laptop?

[unixisc]

Excellent reasons. Aside from #7 and #8, there is less reason to use desktops these days if a laptop will satisfy everyone's needs, and the one size fits most does make it a lot easier for IT to stage and deploy. Incidentally, even w/ laptops, one can use multiple monitors - something that's really handy when the 2nd monitor is an overhead projector in a meeting room (the ppt slides can run on the projector while the presenter can see his notes on the laptop and elaborate for the staff). Also, w/ the use of wi-fi in every room, employees can continue working during meetings (although some bosses discourage that).

And on my home laptop, not only do I have my own personal files, but I also have my bank account passwords saved in my browser, so that I don't need to type that separately when I need to make online payments. I wouldn't dream of executing such transactions on my work PC. Having my own laptop also means that when I go on vacations, I can quickly get my favorite pictures or videos on to my laptop, and share it w/ others quickly and easily.

Portable Apps

[kenwd0elq]

Load Portable Apps on your flash drive, and then load Firefox (or Chrome) on that. It'll keep all of your browsing history and temp files on your flash drive.

Re:No, there's no need

[Bill, Shooter of Bul]

While, I agree you should play safe, I have to also call BS on the ability of the BIOS to keylog a linux distro that isn't preprogrammed to allow it.

Take a look at the system requirements:

http://www.absolute.com/products/endpoint-security/computrace

Notice it doesn't support any distro of linux. I imagine you'd be quite safe using a live cd of any OS not on that list.

Re:No, there's no need

[Anonymous Coward]

Today you're going to learn about something new (to you). It's called SMM, or system management mode. Go look it up. It might also interest you that the Intel CPU isn't the only processor in your computer: http://www.youtube.com/watch?v=tmZ4yXuDSNc

Executive summary: There is a software level below the OS even without virtualization.

your unimployment insurrance should be topped up

[holophrastic]

I would never allow you to manipulate the laptop that I give to my employees like that. It's a work laptop. You want to play games, you can get your laptop, and travel with two. It's not a huge deal. Certainly I'm not going to bust you for reading an ebook or surfing the web a little. But you're forgetting why I gave you the laptop in the first place.

By doing so, it's my responsibility to keep it running well. if it fails, you don't need to do your work. But every time you install something, go to some random web page, or just use up more ram that I planned for you to use, you risk making the laptop a little more unstable. Then if it breaks, it's your fault but my problem because you aren't getting your work done.

I do put tracking software onto my employees machines. It's nothing scary, just timetracker, logs a spreadsheet of active window titles. They can see it, they can look at it, and yeah they can manipulate without my knowing. It's supposed to replace their hand-writing a log of their activities. It's a way for me to know how much time is spend doing what, so I can improve their work. It's not about beating them down. They're welcome to remove the six hours of solitaire from the logs.

So for all of the effort that you plan to put in, imaging and whatnot, why wouldn't you just get a $600 machine of your own, and not worry about anything.

Re:Buy your own

[unixisc]

Companies provide people with laptops in the hope that those people will do "free" extra work for the company. In some cases, the use of a laptop for whatever-the-hell-I-want while stuck in a hotel room for four days between conference sessions makes up for that extra work they might occasionally get out of me.

The convenience works both ways. On one hand, sometimes during a busy period, like say a Sales Conference coming up where the employees have to put the finishing touches on their presentations, having the laptop instead of a desktop saves the employee from having to stay @ the office up to 8pm until it's done. Otoh, it sometimes gives the employee the opportunity to work from home, connected to the corporate VPN, in case there happens to be an emergency - like the kid is sick or some such.

And even for employees who lock their laptops within their desk drawers instead of taking it home (there were times I used to do that) - laptops are still more useful than desktops. You are called to a meeting where you are either going to be referring to your e-mails or other files, or if you're driving it, use it to show your presentation. And in the event that it's a worthless meeting that you were just forced to attend, you can be productive during that time on your e-mail or other stuff (although I've seen some bosses crack down on that and demand that the laptops be closed during such meetings).

There have been times when I've had to lend a laptop to a colleague, and even give him the password in the event that it was screen locked. So I'd give it a differnent password from the ones I personally use, so that my sharing it doesn't give any insights into any of my other passwords. Given all this, the last thing I'd want to do w/ my laptops is put personal info there - even if IT were to encourage me to do it. There is something to be said for separating the worlds, as George Costanza of Seinfeld would put it.

bootable usb disk with os ?

[snerge]

use your favourite linux distro to boot from a usb hard disk where you have your video and personal stuff, a little slower but you don't have to wipe anything !

USB3 Disk + Linux

[flyingfsck]

I simply use an encrypted 1TB USB3 disk and Linux, with a SSH socks proxy for browsing. Yes, I am paranoid.

I would carry an extra bag

[Anonymous Coward]

I would carry an extra bag: and it would be my notebook. If I have to carry their thing, then fine, I will carry their thing. What I do on my stuff is mine. They can't snoop, and don't have any business in my stuff (and likewise, my stuff isn't in their business). I worked for a place that was always worried about people taking software home (there were always lots of system install disks laying around because they had 5000+ site licenses every year). They were very Pro-microsoft, but I am a Linux guy, and didn't care about their install disks (and no, I don't care about their stuff, and I was never even tempted). I had to install a crapload of MS operating systems on old machines because my normal job (mostly taking care of advanced unix servers) didn't occupy enough of my time. Unix doesn't break nearly enough. I also had to shutdown/restart machines monthly, since M$ operating systems are flaky. The unix machines they replaced needed to be cycled about every 3500 days (9 years 7 months 3 days) although we had some that went past 10,000 days without problems (and continuous heavy loads for that whole time).

Re:I would carry an extra bag

[unixisc]

One question - at the office, why would one be needing their personal laptop? Yeah, i agree that they should keep both separate, but don't you have enough work to do? If there is something that has to be done during the day - and this should not be a frequent occurance - go home during the lunch break, do it on the personal laptop and then return, or continue working from home on your work laptop. If it's after hours, it's not needed @ the office.

Not a Good Idea

[Anonymous Coward]

My company, also unnamed, has policies and employment agreements against doing such things and even goes so far as to send out quarterly newsletters informing the employees that individuals have been sacked for violating said policies. It just isn't worth it. Find out what is and isn't allowed on the laptop. My company does understand that people will browse the web and has no issue with that as long and the content and sites are safe. They have laid policy that personal email can't be checked (makes sense with viruses) and that we cannot install non-licensed software (theft, if you think about it). So really it is a matter of security in the end.

Just dont

[nurb432]

Really.. its not your machine, don't screw with it.

Perfect!

[Anonymous Coward]

What you propose is exactly what the employer wants (or should want, if they aren't stupid). You use your own devices for entertainment. If you aren't in immediate need of that laptop, then keeping it locked up is perfect.

And then when you DO travel, take the laptop with you if only to use as your remote terminal to work. On the plane, you can use your phone and/or whatever other toys you want to bring for your entertainment. But keep your personal nonsense OFF the company computer.

All of this goes for the article submitter, as well.

Buy a hard drive and swap them in and out

[Anonymous Coward]

I carry a second hard drive and swap out the work one with my personal one and vice versa. It's a no-brainer, small, lightweight solution that has zero impact on the company's hard drive, security, etc. Carry it around in a decent protective case.

Re:Don't do it. Carry your own laptop.

[PNutts]

If that were your drive, we could have your personal information sitting on a shelf for years, waiting for someone to access it. While this didn't happen to me, a friend of mine was asked to peruse the hard drive of a terminated employee, and what she found led to criminal charges being filed against the ex employee. Not saying you would do anything illegal, but never put yourself in a situation where someone else has unlimited and unrestricted access to your personal data.

Very true. (And to me) more importantly if the laptop has HIPAA on it and the temporary images don't follow HIPAA rules you are personally liable. You, OP, will pay the fines out of your pocket. And that may prove difficult without a job.

Re:Buy your own

[Kjella]

Try working at a consultancy house, then at times I ended up with three. Their laptop, the client's laptop and my laptop. Still, unless it's the difference between carry-on and checked in luggage I don't see it as a big deal as corporate travel generally meant taking a taxi anyway and the few meters I walk it's on wheels. If you feel a spare notebook is too much to haul around then drop it and spend you time in the hotel's exercise room. Seriously.

You've got to be kidding

[brausch]

I'm starting a new job soon ... That being said, I am not the kind of person who can just 'not browse the internet.'

Dude, the idea isn't to get around the security. It is their laptop. Don't mess with it. Booting a USB drive and using that seems fine, but don't mess with their original installation. If you don't like their rules, find a different new job.

Don't assume, ask permission first. You might be surprised.

If you want to do something totally not approved, get your own laptop.

Re:No, there's no need

[Anonymous Coward]

Unless you count subsidies to the telco industry

I can see this point has yet to be made

[eclectro]

Let me clear up the ambiguos advice that preceded this post. Get YOUR OWN machine!

Re:No, there's no need

[buzter]

Well, to be fair in this specific case, Absolute doesn't collect more than basic hardware and state information until you report it as stolen. And, yes, there are limitations to the BIOS implementation. It's really just a persistence module to reinstall the agent software on Windows and Mac OS. However, the inability for it to properly function and call in can be cause for alarm on the part of the employer.

Ask. Then listen.

[tverbeek]

The first, most obvious thing to do is to ask your IT department, your boss, or whomever is responsible for communicating policy to you, what you're allowed to do with it. If they say "No personal use at all," then don't use it for anything personal. Full stop. Get a smart phone or tablet. If they say "limited personal use is OK, but you're responsible for the integrity of the machine", then don't do anything stupid with it, which includes anything NSFW or something you wouldn't want your boss to know about. Ask them if the computer has spying software installed. If they're that serious about wanting you to never check your personal e-mail on it, then they'll want you to know that, and will probably acknowledge that they're using it. Granted there are some people who deliberately give their employees enough rope to hang themselves with [waves to former employer], but most are more interested in getting you to follow policy in the first place, not firing you for violating it after the fact.

The other thing to do is honor whatever constraints they've put on the machine. If they've made you a non-power-user, then don't try to install software on it, even if you know how. If they've disabled the USB ports or booting from external devices, then don't try to get into the BIOS and turn them on. Basically, anything you do to try to outsmart the techs, even if you succeed at it – especially if you succeed – will just piss them off, and they'll throw the full force of the company's official policy at you out of spite.

same here, what I do is

[Anonymous Coward]

same here, big company, encrypted drive, big-bro seeing all in the background. Simple solution : on friday night, I pop out the hard drive, put in my privately owned HD with the OS of my choice. can do EVERYTHING bad I can imagine, without any trace on monday morning. re-imaging is a pain. simply pull-out / push-in HD.

Look out for Numero Uno

[JonnyO]

Rather than worry about the company, worry about yourself: do you really want the company to see your data? The computer assigned to you is their property and they have the right to reclaim that property at any time and for any reason, and they are not required to give you time to "get your affairs in order" ahead of time.

Re:No, there's no need

[Anonymous Coward]

Those are the system requirements of the management and tracking software, genius. If you read further and not just linked the first thing you saw you will see that the agent software is embedded in the firmware "and even if the hard drive is completely reformatted or replaced" the agent is active.

You'd make a good crook though, they tend to be dumb and overconfident.

used laptops are ~$150

[Anonymous Coward]

Considering how cheap good enough hardware is today, why risk messing with your employer's hardware?

Go to a pawn shop, and get a used laptop for basic stuff. I have seen laptops sufficient for non-super powered web browsing for under ~$150. A new Kindle Fire tablet can be had for under $200.

take you own netbook?

[drolli]

or get an Amazon EC account. Then you vnc or rdesktop there (or onto the netbook if the screen is too small).

What you consider is probably criminal, puts your company into danger of violating recording rules, and useless in case they are really paranoid.

wtf

[Anonymous Coward]

I know that I am going to sound like a broken record, but buy another laptop take it with you while traveling. Or better, but an iPad or other tablet - you can probably do 99.9% of what you need to on that (checking email, reading books, watching a movie).

Step One....

[Hasai]

....Try reading the corporate SOP.
Step Two: When in doubt, ask.
Step Three: If the SOP isn't something you can abide by, find another job. Dishonesty WILL ruin your career.

Re:Step One....

[Anonymous Coward]

no, because the "SOP" will inevitably say, "no", which is neither reasonable or workable.

Re:No, there's no need

[buzter]

The system requirements are actually for the agent software. The firmware embedding is a persistence module that "self-heals" the agent software. The references to it surviving through reformatting and hard-drive replacement is the fact that the BIOS will re-install the agent on the new OS / Hard Drive. Black Hat 2009 had some research presented on the shortcomings of this technique, which is summarized on coresecurity: http://blog.coresecurity.com/2009/08/11/the-bios-embedded-anti-theft-persistant-agent-that-couldnt-response-handling-the-ostrich-defense/

That being said, preventing the agent from calling in when you know it should be calling in would be cause enough for an employer to be suspicious.

sure

[Tom]

Are there any other precautions I could or should take?

Yes. Check your employers rules on private use.

If they allow it - forget about private mode and encryption, if I control the hardware, you can't hide from me. Don't treat the company IT like an enemy, unless you want to be treated likewise in return. Storing your personal data on an USB stick is a good decision, however. Not for security reasons, but because it makes the seperation between work and private simpler.

If they don't allow it - get an iPad for the road.

The one thing IT departments, and especially the IT security guys, can't stand and will come down on like a ton of bricks if they ever get the chance are the "power users" - the people who know enough to screw things up and not enough to resist doing it.

If your machine is locked down tightly, there are reasons for it. They might be bullshit reasons, in which case there are appropriate ways to challenge them and get things changed. Playing Johnny Hacker isn't one of them.

Just swap the hard drive.

[Anonymous Coward]

Just swap out the hard drive, easy 'nuff to drag along another 500G 2.5" drive. Hopefully your laptop makes accessing the drive easy. I do this with my Thinkpad, but more for WindowsLinux transitions...since it's my laptop.

Not just don't WANT to...

[raehl]

...but can't.

There are several countries where going through customs with TWO laptops will ding you for import fees on the 2nd laptop.

Re:Not just don't WANT to...

[unixisc]

Fine. Put one of them in the check-in, and another in the carry-on luggage.

Re:Not just don't WANT to...

[Anonymous Coward]

Put one of them in the check-in, and another in the carry-on luggage.

No good. You'll be carrying both through customs anyway. A much better way to go about it is to ensure that the one that import fees are imposed on is the work machine, and make the company pay that. If it is even true, that you will have to pay such fees. i have traveled to several countries with two laptops, and such an issue has never come up. And I have also not heard of such an issue from any of the other people, I know, who have been travelling to even more countries.

However it certainly is occasionally said, that if you are travelling by plane, you are not allowed to bring a computer in your checked in luggage.

Re:Not just don't WANT to...

[Anonymous Coward]

Where? Not trolling, but I travel all over the world (mainly EU, but India, US and others) and have never had this problem or even had it raised when searched.

I always take my Macbook Pro .. I can read ebooks and surf on the work laptop (and it's a better spec), even watch movies but installing WoW is probably a step too far :-)

Lock down

[Tiger_Storms]

I love how everyone says boot usb or cd, but if your IT department was smart enough they would have disabled the boot other devices made the HDD the first and only boot option and then locked you out of the bios so you couldn't change it. If you really much do personal thing on the computer ask the company what you can and can not do with the laptop. If they say you can't do anything, buy your self another hard drive install your OS of choice and move on. Don't mess with their partitions and/or anything that's on the hard drive that's already there because most encryption software will log that kind of thing or prevent you from using the hard drive at all. I've got my work computer locked down, but it's video card is also really nice so I did this to my laptop. can't boot up CD's or USB sticks on it so another hard drive was my only options short of running a shell on top of my OS that it starts off with.

Is it really that tempting?

[utkonos]

Laptops are not that expensive. If you're interested in doing something personal on a laptop go buy one and take it with you. Don't use company property for anything personal. If you have trouble with this, then you probably have problems with ethics in other areas of your work as well. Where do you draw the line?

Nope. You're an idiot.

[Anonymous Coward]

Why are you playing games like this? If you are doing something that you don't want them to know about then put up your own 2 cents and use your own equipment.

But better yet, if you are doing something that you don't want people to know about than you probably should man up and stop doing it in the first play.

VM for work

[rwa2]

Well, I was sort of a quasi-IT engineer, and good friends with the real IT folks, so that's probably the only reason this flew. But my best setup was running some 64-bit Linux distro on the bare metal, and installing the stock IT WinXP Pro build with the ancient IE6 we needed for mandatory training in a VM, with all of their stock full disk encryption and everything.

Also had a separate WinXP Server x64 install for a few games. But never porn. Even booting from LiveCDs, I'd never use work equipment for porn, if only for the pure terror from the inevitable nightmares that you'd get from imagining your strange donkey porn popping up onto your laptop during staff mtg presentations. Just don't go there! :P

Re: RDP, not Dual Boot / VM

[davecb]

A former customer demanded everyone use Windows laptops, and had an insecure locked-down configuration that accidentally prohibited the use of Windows ssh. I chained it to a desk inside the firewall, and used an rdp session to access it when traveling. My (personal) travel machine contained no work files, not even email, just a copy of rdesktop and a putatively secure VPN for contacting work.

I don't like modifying the work machine to support my environment, I'd rather have an environment and ssh or rdp into any legacy systems. Rdp supports mounting disks and virtualizing devices, so it's not hard to export the required parts of my environment to the crippled Windows box.

--dave

What about VirtualBox?

[Anonymous Coward]

Just install VirtualBox, create a virtual machine and from there run all your needed programs. For added security do not connect your virtual machine directly to your company's network, but to an outside VPN. And you basically have two machines, one fully sand-boxed virtual machine and your basic work laptop.

You must want to be fired.

[DaveV1.0]

If you are so hard up to use the internet, etc. either buy a tablet or a small cheap laptop.

Re:Buy your own

[Anonymous Coward]

Unreasonable?

I've done travel for work. Often it involves me bringing along a work laptop, and my 12"eeepc. You probably only need to bring one mouse, one network cable (or ask the hotel desk, they often have extras if wifi isn't an option). The eeepc is the size of a small textbook, and the power adapter is the size of a snickers bar.

If you travel so much that adding a netbook is too much for you, then you need to reorganize your carryon or hit the gym.

And when I say I've done travel, I've been in the desert, under HMMWVs, through customs (where my coworker's fruit smelling shampoo set off the sniffer beagle), given 1 days notice to travel to the Mexican border for a month.

What I'm saying is that if having a computer is just that important to you that you would consider the effort to image wipe and replace the entire disk drive, a netbook is a pretty freaking simple option. And as a bonus, the 1215n eeePC can run WoW if that's the real 'can't live without it' reason. If it's porn, well, it can handle that too.

(heh, the captcha was 'misused')

Backup image won't work

[alispguru]

If your IT regime has any sort of remote update system, your backup image will gradually get outdated as IT pushes patches onto the standard one. It will be seriously out-of-date if you ever restore it before returning the machine.

Virtual Machine

[Anonymous Coward]

Install VirtualBox and create virtual machine. You can nuke the disk image before returning the laptop.

Re:No, there's no need

[splatter]

Informative really? Of all you readers I'm the only one that's heard of the evil maid attack?

http://en.wikipedia.org/wiki/Evil_Maid_attack#bootkit

There are bios level key loggers, so keep thinking your keyfob or live cd can't be logged but I'm afraid your wrong.

no thanks

[Anonymous Coward]

If I find an oppressive scenario where I can't use the laptop to my discression, you can keep the system, I don't want anything to do with it. A fairly functional laptop is cheap ($400) and anyone viewing them as a privledge or some godsend from their employer are being well duped. If it's required for work, then that's the only time I'll touch the system, you can forget any voluntary work. I'd rather carry two systems than deal with tyranny, plus it's great excercise. Any additional time through security can be billed to your employer due to their own policies.

Re:no thanks

[iamacat]

Believe me or not, but there are people for whom $400 or dragging two laptops in airport in addition to all other travel gear is not a trivial matter. An $10 Ubuntu USB drive is a decent compromise, and any employer who objects has a serious problem. Most will be happy with people strictly separating work and non-work use.

Re:no thanks

[anyGould]

Believe me or not, but there are people for whom $400 or dragging two laptops in airport in addition to all other travel gear is not a trivial matter. An $10 Ubuntu USB drive is a decent compromise, and any employer who objects has a serious problem. Most will be happy with people strictly separating work and non-work use.

The problem is that Joe Average Employee is very unlikely to successfully understand the "strict" part.

Also worth keeping in mind that since it's the employer's machine, they're under no obligation to compromise at all. They're giving you a machine to use for work purposes. They are in no way required to accommodate your personal usage. Anything they let you do should be viewed as a perk.

Besides, it may be they have very good reasons for a strict "no play" policy - which might be as simple as "a past employee got caught doing something $TERRIBLY_NAUGHTY and we're locked down as a CYA measure to prevent more lawsuits", or as complicated as "our contract with company XYZ requires it".

Re:No, there's no need

[Anonymous Coward]

Activities generate logs.

Sometimes it isn't the activity which can be suspicious, but the absence of any activity when activity is expected to be found.

Not that this is an argument for or against alternative ways of using company hardware during non-business hours, simply a warning that a vacuum can be far more obvious than a bad smell.

Re:Buy your own

[Anonymous Coward]

There are two kinds of laptops - ones that contain sensitive information, and ones that don't. If it's that sensitive, you shouldn't be browsing the web on it at all, even for work purposes, even to check in for your return flight on a business trip. If it's just a regular laptop, reasonable personal use is usually OK, just as it's usually OK to call your kids from your company cellphone whilst on a business trip.

There are reasons they don't want you to do that

[EmagGeek]

There are good reasons that your corporate use policy most likely prohibits you using their laptop for your own personal use. Here are some of them:

1) Protection from liability. If you use the corporate laptop to do something illegal, it exposes them to liability for providing the means by which the crime was committed.

2) Protection from you: If you use the corporate laptop to do something personal, and you get the machine infected and the company's security is breached, it may very well expose company-sensitive data, and you will be responsible.

There are many more.

Just do yourself a favor and when you're at work, work. Get your own equipment for your own personal activities. They have no place on your company's laptop.

don't play games

[roc97007]

I have re-imaged my laptop issued by the company, granted myself admin rights and stripped off some of the cruft with which company laptops come equipped and installed non-standard software, but I work in IT, and I have access to all the tools and images and am in a better policy position than it sounds like you are. Were I not deep in IT and secure in my position, I would not try it. You are issued a laptop to do a particular job, and that's what it's for. If you just can't make yourself not surf naughty teens websites, get yourself a tablet of your very own and use that.

One possible geeky solution would be to create a virtual instance on your laptop and use that to watch naughty nurses. But even that might not be safe depending on whether there's traffic analysis software on the laptop or just hooks into the browser.

What it comes down to is this: There's a recession on, buddy. Be happy you're employed. Don't screw around with company property.

You're fired.

[mindcandy]

Okay .. we can play that game. But you have to get lucky *every time* .. I only have to catch you doing it once.
The corporate policy is there for a reason .. if you don't like it, go work somewhere else.
We are not "lucky" to have an employee like you.

--IT Security Director

Yes....

[Lumpy]

Stop being a cheap or lazy bastard and buy yourself a personal laptop.

What is it with you guys? it is not worth it in any way to use the company laptop for personal use.

UEFI + TPM

[mindcandy]

A company that distributes "secure" laptops but fails to lock the BIOS and boot order (and make use of the on-board TPM to secure the physical hard disk) either doesn't care or isn't trying.

Is it really their "right"?

[Qa32]

How is this any different from doing personal things/errands on company time? I mean most of us (including me) telecommute to work and I use my office time to do personal work (gym, errands, cooking, etc) while also giving up my personal time (weekends, evenings, etc) for company work as it comes up or becomes necessary. So by that same token, does company property really have a right to dictate what you can do with it? You are giving back to the company in terms of work done, productivity, reports, etc. As long as you deliver what's expected, why does it matter how its done as long the its not compromised?

Re:Is it really their "right"?

[ISurfTooMuch]

First of all, have you asked if you are permitted to do these things while you're on the clock? Maybe your job is structured so that you can, but not everyone's job is. But, at any rate, while I don't think a company that allows you to telecommute is going to care if you go in the kitchen and make a sandwich, going to the gym is really pushing it, don't you think?

But, at any rate, using a company laptop to browse the occasional personal Web site is a damn far cry from intentionally altering it to prevent the company from knowing what you've been doing. That's like the difference between using the company car to stop at the store to grab some milk as opposed to using it to take a weekend vacation and then rolling back the odometer so no one will know. I know someone who does use her company car for taking personal trips, and the company pays for the gas, but the difference is that she has been told that she can do these things. It's one of her job perks, and she and her boss are on the same page about it. That's a far cry from what this guy wants to do.

VMware Player

[Sounder40]

They're not (usually) going to sniff your internet traffic... They'll more likely look at browser history and file contents, and usually in the "normal" places for the usual file extensions. Running an alternate operating system renders the issue moot.

1) Download and install VMware Player
2) Download and install the Linux distro of your choice, with a small disk so it doesn't waste too much space.
3) Enjoy all the surfing you want.

Yeah, you said it was probably locked down, I know. But maybe this is something you can ask about? This is what I do, but I usually carry my own personal laptop.

Alternative 1:
1) Download your favorite distro's "live" CD
2) Boot it up and have a good time.

You should be able to do that at least, right? You can save files/configurations to a stick.

Alternative 2:
1) Download your favorite distro
2) Write it to a stick with LiLi USB Creator (Windows) or one if the million such apps on Linux, such as usb_creator.
3) Boot that up and rock on.

Get your own hard drive.

[Anonymous Coward]

Get your own hard drive. They are super cheap and super easy to change out on most machines. Especially if the drive in encrypted, if you expose some company info by changing the system it could be your job. Make a complete other install and tweak it out how you want it for travel and personal use. Keep your work life on one disk and your personal life on another, just don't show up at work or a meeting with the wrong disk!

Re:No, there's no need

[hemo_jr]

If you are that paranoid, you can pull the hard drive out of the laptop before you boot off a usb key/flash drive. Or buy your own internal drive and switch it for when you want to use the laptop for personal use.

virtualbox easy to manage.

[Anonymous Coward]

Download VirtualBox or any other VM software. Install your own OS there and programs. When you leave the company you could just simply move that image to another computer or just erase it if so you desire.

Re:Buy your own

[netsavior]

I have an HP Elitebook for work, I travel a fair bit, so I bought a netbook that has the SAME power adaptor, which saves most of the annoyingness of having 2 laptops. The netbook even fits in my company issued laptop bag along with the company laptop. I don't even browse for work related stuff on my work laptop. The browser is so locked down (and stuck in an older patch of IE) that it is annoying to find answers to API problems on forums and whatnot.

You're fired!

[The Real Dr. Video]

If you were working for me (I'm a business owner and virtual CIO for other businesses) and I saw this post or discovered your intent YOU WOULD BE FIRED! I'd just shout NEXT out the nearest door and start the next eligible candidate tomorrow. I'd be glad to have your type of employee gone from my business. It's no different than the policy for a company car or any other imprtant business asset. I own it. You don't. If you're going to spend your time violating my policies instead of doing your job and making me money you are going to have a hard time staying employed anywhere (especially once the word gets out about you among your local HR people).

spare hdd?

[queBurro]

Buy a spare hdd if you're married to windows otherwise boot to Linux on a USB stick. Consider portableapps for stuff when at work

Intermittent connection

[tepples]

if they're considering issuing a company laptop, that the work probably involves connecting to the company network to do stuff anyway.

Connected continuously or connected intermittently? E-mail can be downloaded, read and answered offline if it doesn't refer to something specifically online, and then sent at the next coffee shop. A computer program can be checked out, developed and tested locally offline, and checked in and tested on the farm later.

Dual Boot..

[bjwest]

Perhaps this is something that should be considered for all company issued laptops. Have them set up from the git-go to dual boot. The company OS can be on an encrypted partition with a separate partition set up for the employees personal OS. Install Windows on there, but allow the employee to change that if they wish.

Problem solved. Companies data is behind company encryption safely away from any malware and/or viruses that may infect employees partition.

Re:Buy your own

[Anonymous Coward]

There's an item that is easily portable, that you can watch films on, play games on, browse the web and read ebooks on.

It's called a smart-phone.

I have a personal phone and a work phone. My personal phone is perfect for keeping me entertained while travelling, and no trouble to carry.

because

[Blaskowicz]

because that's what the IT department installed on servers?

but it's great anyway. local access to company and user data, beats syncing heavy files over the same network, even IT can like it better. regarding X though, it's awesome for beaming text editors and such but with its chatty protocol, RDP and similar can beat it on other things.

Work-issued Laptop is for Work

[Anonymous Coward]

See 18 U.S.C. Â 1346. Then see the penalties and prison term you could be sentenced to.

Then, make your decision.

Re:Work-issued Laptop is for Work

[pigphish]

you are totally talking out of your arse. This has nothing to do with the discussion.

Re:Work-issued Laptop is for Work

[Anonymous Coward]

It absolutely does. The employer has a right to honest services on the part of the employee. If the employee engages in personal activity on company time, he has committed the crime of honest services fraud, which is a federal felony.

Whenever you are being paid by an employer to do a job, it is your duty to perform that job and only that job. If you distract yourself with personal tasks, yet still take your paycheck, you are a criminal. You have stolen money from your employer, and deprived them of their right to honest service.

It's really quite simple, and it applies here.

Just browse porn on the company laptop.

[Blaskowicz]

this is what I haven't understood yet in all of this discussion. half the posts are about bringing a redundant inferior computer with its AC adaptor and whatever.

why shouldn't you visit porn sites on the company laptop? a locked down computer *should* allow you to visit any website. it's not like security depends on it, or are we again in the IE5 and XP SP0 era? porn is NOT illegal except for some copyright infringements concerns you have no control over. likewise, are your downloads filtered by content type so you can only download .doc and .pdf from your corporate mail? I don't think so. this is USER data, an honest admin has no reason to spy on your home directory and report you for storing media files.

use the web : you could have a media server at home with a web front end that lets you access or stream the content. or have a remote desktop running at home or even in a datacenter, accessed through a web based client. you could play flash games and that may be better than crappy cell phone games. read e-books in your web browser. don't ever try to run any user installable crap like google chrome or portable .exe for firefox and other software, this is breaking the limits of course.

Re:Just browse porn on the company laptop.

[pigphish]

IT admins are in their ivory towers reading everyones private emails. When they are not they are annoying and not doing their job. As such most of the comments are dont do it so they can have something to do during the day (like read your personal emails). The expectation that someone will not check a personal email for 5 minutes a day at work is silly. No one lives in a silo while working. Except for IT guys of course. One aside, Euro zone privacy laws which are more progressive understand this practicality and enforce this reality. I personally think the portable apps solution on a drive is the most practical. What I have not heard mentioned is using an encrypted proxy service like tor or ipredator. This will make sure the IT guys aren't reading about your dinner plans if you are using the office network.

Re:Just browse porn on the company laptop.

[ISurfTooMuch]

I'd love to see where you work, because I've never encountered an IT department like yours. Most IT people are so overworked that they don't give two shits about what someone is doing online, with one big exception. They will most certainly care if you do something that causes problems that they then have to fix, especially if you were explicitly told not to do it. They may also care if they've been explicitly told to block certain activities by management, and you try to get around those blocks, but, again, you're doing something that's creating problems for them. If you think that they're the only people who can be dicks, then go fuck with accounting, HR, or legal, and you'll get the same reaction.

Re:Just browse porn on the company laptop.

[unixisc]

Most of the posts are about getting an inferior computer (it's certainly not redundant, since one he'd get to keep after he leaves the company, while the other he doesn't) b'cos of the assumption that the employee in question doesn't want to pay anywhere near the cost of that laptop while getting his own. It's assumed that if the employee in question has a comparable or superior laptop, that's what he'd be using, and he wouldn't be asking such a question in the first place.

Also, a company computer means that IT can use any website filtering service, which could block any number of websites, including /. If one can't visit one's preferred website due to this, one is out of luck. What are you going to do - tell IT that the web filtering service you are using is blocking my porn? Using one's own computer to watch that neatly sidesteps that issue, and enables him to do it in his own time and own box.

Re:Just browse porn on the company laptop.

[Anonymous Coward]

My experience with IT departments has generally been at large organizations. I believe in smaller places the unhelpful nosy tech support person would have a harder time getting away with bad behavior. That being said I've found bad behaviors come to my attention to often. Including: badly thought it policies that hinder work productivity (e.g. zip banned as attachment) , unwillingness to give that little extra to do ones job better (too many long stories here), and abusing the elevates access (e.g. accessing an esi source without a good business reason). I realize this is not everyone but the job description seems to attract bad apples in every larger organization I've been in.

Can you just swap the hard drive?

[twistofsin]

Is the hard drive bay sealed? Unless it's one of them irritating machines that requires you to separate the case to remove the hard drive just buy another one, pop it in there and load it with the OS of your choice and then swap them as needed.

Mixing up laptops

[QuincyDurant]

'I am not the kind of person who can just 'not browse the internet.'

Who is? The problem that the poster may be pointing to is that it's not hard to forget which laptop is which and jumping on the Internet to check personal email or whatever. If your company has given you a Windows laptop, use a Mac or better still a Linux machine as your personal laptop. The operational differences should be enough to remind you which one you're using.

If you've accidentally stumbled onto xhamster on the company machine and anybody notices, just open your eyes wide and act dumb. Screwing around with hard disk or anything else makes it look like you've been on an Al Qaeda chatboard or something; don't be an idiot.

Read the company policy

[klubar]

You might first check with the company policy on use of company-owned equipment. It may be acceptable for you to watch a netfilix movie, read an ebook, do some shopping or check personal email via a website like gmail. The company policies may actually be reasonable. On the other hand, if the work you are doing requires the highest level of security , then no you shouldn't use the computer for anything else. Check first. If the answer is no, then respect it or get another job.

If you are not allowed to use the computer for any non-work related stuff, buy a lightweight laptop or tablet for travel. It's not that hard.

If discovered, any attempts to circumvent the company security (successfully or not) are grounds for termination. I'd say you should not even usie a USB key with a distro unless explicitly approved. It's your employer's (or the client's) call. Copying and restoring the disk is just completely out -- what happens if someone else notices it while you're on your trip, or something bad happens to the laptop and the admins can't remotely control it?

Ask, and if the answer is no, buy your own device to travel with.

New Job Title

[Flere Imsaho]

We have a job title for arrogant users like you, former employee

carry two hard drives

[p51d007]

If you can get the hard drive out, just carry one personal drive, and the work drive. If that isn't possible, just fix up a bootable thumb drive with Ubuntu or something similar.

My approach

[Abroun]

...our company's laptops are very locked down, all internet request go through proxies, and they bar access to personal email sites, social networking etc (I work in a highly regulated industry). So I carry an external hard drive and just boot from that into Linux - the internal drive is encrypted and the two OSs never know the other exists. Works great.

Re:Buy your own

[Anonymous Coward]

Oh for fucks sake. What is it with you people? If you don't want to do additional work on your own time than don't. Don't use this concept lead you to doing something against company policy.

But what the fuck do you care? It's not your job nor your company. I just hope I never have to work with a fucktard like you.

Title says it all.

[Analog-X64]

"Using Company Laptop For Personal Use" Title tells you everything that is wrong with this question. "Company Laptop" - You dont own it... dont mess with it. "Personal Use" - Nope its not intended for personal use, its a tool given to you, so you can do your job. You wanna play games and surf the net? Buy a Tablet they go from $200-$800 depending on what you want. I would be really pissed off if a user did this. You think imaging the laptop etc.. is a perfect plan, but its not worth it, if things go wrong.

Re:No, there's no need

[fast turtle]

There is nothing to prevent the OEM from installing a 4+GB flash drive on the Mobo as part of this program. Does the app need to be larger then that? Don't think so if it's working at the hardware level.

buy a fucking iPad

[Anonymous Coward]

Yes I know it's redundant. But it needs to be reiterated. Again and again.

It used to be very difficult to deal with this situation. Carrying a second laptop was a lot of effort. The laptop was heavy, it required a case, it required a charger.

Not any more. An iPad weighs about 1.5 pounds, has a very nice form factor, and is quite usable for Internet access for an entire day without needing chargers etc.

buy a fucking iPad

rules of usage

[slick7]

1. Look at the news.
2. Look at your horoscope.
3. Look at the weather.
4. Stay off of social media.
5. Don't write anything or watch anything your mother would see.

The only secure computer is your own computer, barring any viruses.

Re:Buy your own

[sunking2]

As is having to pack two types of clothes on business trips, one for work, and then leisure. Yet people do it.

Buy your own laptop stupid.

[Anonymous Coward]

Seriously. What are you thinking? Also, many states have serious legal issues with ownership of personal things down on corporate equipment. You don't seem to smart. Is this a help desk job?

And well deserved.

[Anonymous Coward]

"My company is issuing me a laptop. I want to do stuff on it that I assume they don't want me to do. Here are some ways I've considered to subvert their policies--are there other ways to subvert their policies I haven't considered?"

No dialogue with the employer. No consideration on the reasons behind the policies. Heck, he doesn't even have the machine yet to see if it really is locked as hard as he thinks it will be. Yet he's ALREADY planning how to use his COMPANY-OWNED laptop in ways he assumes the company will explicitly prohibit and try to prevent.

The problem isn't that he's trying to find a "safe" way to use his company laptop to do non-work activities. If my company didn't allow non-work on their machines, I'd have quit long ago. I understand that impulse. The problem is he intends to subvert their policies and lie to them about it (at least by omission, more likely by signing an acceptable use policy he has no intention of honoring) as a FIRST OPTION, without even TRYING to ask about what the policies are or their reasons.

I'd fire OP in a heartbeat. If he's this tone-deaf and this low-integrity on this policy, I shudder to think how he'll react to any other policies he'll find personally inconvenient.
* My company has a proxy that blocks certain content I want to watch in the office. How can I set up a tunnel to outside the firewall so I can do what I want?
* My company allows me to expense business meals. How can I make it so taking my girlfriend out for a nice dinner qualifies?
* My company travel agency has policies that won't let me select flights that are more than $X more than the cheapest flight available. How can I set my query so the current cheapest flight doesn't show, and the flight I want becomes OK to select?

Here's exactly what to do

[ISurfTooMuch]

I'm going to tell you exactly what you need to do, and it's extremely simple.

1. Reimage that bad boy to your heart's content and install whatever you want.
2. Reply to this post with your position and company name. That way, anyone reading this thread will be able to watch your company's job site to see when your job comes open after they can you.

If you think I'm kidding, go ahead and put your plan into action. You think you'll have time to return your laptop in pristine condition, but what's your plan when your boss stops by your house on a weekend because his laptop died two hours before he's scheduled to fly out for a meeting, and, since he went by the office and didn't see yours in your office, he knew you must have it at home? How are you going to stall him, and, even if you can reimage it while you pretend to take a very long dump, how are you going to explain that it doesn't have that mission-critical application that IT pushed out last month and asked everyone to install when they were prompted to? And what will you do if the laptop gets lost and IT can't contact it to do a remote wipe? If that happens, you'd better pray the thing isn't found and returned, because it likely won't come directly back to you, and IT is going to be pissed when they see what you did to it. And these things do get returned on occasion. My department just had one that was returned after going missing 14 YEARS ago.

Is saving a few hundred bucks by not buying a netbook or tablet worth possibly losing your job?

Dude, just ASK!

[Lime Green Bowler]

First off, if you like your new job, ask your new employer what you can do with their equipment. You won't get Admin from me either- that's policy. But if a user (you) asks me for software for playing movies, eBooks, other multimedia bullshit, and is willing to work with me and the policies he/she has to operate under, and understands there are policies *I* have to operate under, I'll do what I can to accommodate your needs. You catch more flies with honey, as the saying goes. All you gotta do is just ask and not assume that IT are all BOFHs.

If you don't like your new job, want to play "wannabe" guru, then go ahead an screw with the laptop, and your paycheck. I'll make sure that when I find things you've fricked with, that you go on the A-list for audit scans. A for Accelerated. I'll also make sure your laptop is fully compliant with policies, and take the extra precautions you mentioned re: locking down settings. And it will all be documented. I'm not being an a-hole, but if you don't give a shirt about company policies and want to 'take matters in your own hands', then I don't trust you, and will do what I have to do to ensure my job isn't compromised by your crazy-train inept attitude.

Re:Buy your own

[stephanruby]

This guy hasn't thought this through. This is not a battle that can be won.

Even if he were able to bypass his corporate VPN, bypass any proxy, erase/encrypt everything he did, and re-image everything, he still wouldn't be able to prevent a key logger from recording and emailing the corporate office a regular log of his activities, nor would he be able to prevent the tracking software from taking random screenshots of his favorite porn sites and sending those off as well.

And yes, he could backup and wipe his system clean as soon as he was given the laptop, and install Ubuntu or something, but I'm not sure how he would handle those secret hidden partitions that are often left there by the manufacturer, nor would he able to explain to his employer why his laptop has suddenly stopped accepting software updates, or remoting requests from IT. And yes, he could boot his laptop from a usb disk, or from a DVD, which is less risky, but that too has risks if any of the tracking is done at the hardware-level, which is done by some of the tracking products out there (so we all know this kind of tracking exists as well, and is commercially available).

Simple solution

[LynnwoodRooster]

I have the same situation - a company-issued laptop. I carry it - and I carry a personal laptop as well. No big worries carrying two laptops with me, but then again - I'm not a 98 pound weakling who complains about carrying 12 pounds of laptop through an airport...

Simple

[Anonymous Coward]

If you are a programmer, Linux is your thing anyway. Image the drive, then download linux. If you have to, just partition to dual-boot... otherwise, just go whole hog and wipe it with Linux. You'll be happy you did... I ended up being 10x more productive than anyone in my department just due to moving away from Microsoft and on to scripting/automating things on Linux. With that level of productivity eventually comes power -- power enough that you can stop hiding your install and do what you want with your "tool set."

I worked three or four years this way until I got into management where, darn it, everything is latest fashion of power-point, Excel (with macros), Lync (Office Communicator) and crap like that. I really wish I could work in another environment, but the most convenient thing right now for me is to load Cygwin on Windows. If I figure out how to keep up with Microsoft crap, I'll hop back to Linux as my desktop in a second.

So, again, while you are not a management guy, just do Linux.

You've got to be kidding me.

[Anonymous Coward]

You are the worst kind of employee for any IT department. Why don't you have your own computer? Why do you insist on using something the company provided you for personal entertainment? Buy your own laptop/desktop/tablet/phone to use for that.

If the company gave you a car would you use it to go to the movies, grocery shopping, or on vacation? Would you reset the odometer (if you could) when you returned it to them? This isn't an analogy, it's a serious question and I bet I know your answer.

Re:No, there's no need

[Macgrrl]

The examples of personal activities listed by the original poster could possibly be done on a tablet like an iPad. The only variable would possibly be the type of games he likes to play, but if he's a serious gamer he will have a specifically specced rig at home already, otherwise there are plenty of causal tablet games available to play while on the road.

I'm currently playing through Lego Harry Potter on the iPad. I have hundreds of books (mostly sci fi or crime/mystery) loaded in iBooks and have web/mail via 3G. I wish I'd had this kind of convenience when I was travelling for work a few years back. I used to take 2 laptops on the road and play WoW on my personal laptop from hotel rooms to spend time with my other half from the other side of the country.

You just aren't the kind of person...

[Anonymous Coward]

" I am not the kind of person who can just 'not browse the internet.' " - really? I mean seriously?
Yeah, I understand. I am not the kind of person who can just 'not rape little girls' either.

Seriously, just don't do it, it's that simple. If you have such a strong desire to play, then get a personal laptop and bring it too. I know two laptops is heavier and all, but it can be a MacBook Air, or even an iPad or whatever floats your boat. Then you can play all you want all day long without worrying about screwing around with your company PC. They won't monitor you, and you won't mess with their image or risk compromising their security.

As a second-best option, you could have a USB-based linux boot partition that doesn't read/write the real HDD in any way - but you would have to reboot every time to use it anyway.

Re:Buy your own

[Anonymous Coward]

But what the fuck do you care? It's not your job nor your company. I just hope I never have to work with a fucktard like you.

Hey, I'm not a Jew, what do I care about where they ship them off to? I just hope I never have to live next to a Citizen like you!

Just fix it.

[tombeard]

I always just run opcrack (assuming it's win, it always is), give myself admin rights, and fix anything I find "wrong" with the setup. I assume I can do anything that I can do, if they didn't want it done they would have made it not do-able. I have never been challenged or questioned. Sometimes IT changes my rights back to less then admin and I have to open it back up, but no big. If they can keep me out they are welcome too, if not I will set it up how I like. I don't get malware and i don't DL anything dangerous, and with 30+ years experience I figure I probably know more about net safety then they do anyway. And if not, they should have done a better job of securing the machine.

Past experience posting this philosophy tells me the IT security guys will jump all over my bad. As always, fuck them. If you can't keep me out don't complain about what I change. If you knew what I needed for a usable system I wouldn't have to go to the minor effort needed to set it up properly.

Don't count on USB - they can and do disable it.

[xenoc_1]

Plenty of companies, including those I've worked for whose names you would recognize, install software that prevents any writing or even reading from USB drives, CD/DVD/Blu-Ray, any external ports. Only devices whose fingerprint matches the list of approved devices, sometimes even by a specific serial number, are allowed to talk to the USB port. This can be managed remotely, and they can send updates over the open internet even if you haven't VPN'd into the company network.

I had a personally-owned Sprint USB datastick work fine from my hotel in my company laptop one night just fine. Didn't connect to the VPN, watched a couple of TV shows streaming on Hulu. Left it on overnight connected to the public internet. In the morning laptop would not recognize the USB datastick at all. Sprint hadn't done anything. PC was fine. Later I had reason to contact corporate Information Security on another matter. They told me, "oh by the way, we disallowed your unauthorized USB device."

Later I was able to get my manager to approve my getting a mobile broadband card. Sprint. But the one supplied by the company was whitelisted. My personal one was not.

Note that my use of the laptop on off hours, and occasionally for non-work use, was itself not a violation of this company's policy, which did allow "incidental personal use that does not take away from work productivity." But plugging in any device not authorized by them was not allowed, was logged, and could be remotely disabled.

Missing a big something

[Mr. Foogle]

Are there any other precautions I could or should take?"

Yeah. Buy yourself a laptop and use _that_ to watch pr0n.

Sorry: "read an ebook".

Less than a grand for a laptop. Worth the hassle, imho.

ffs

[Anonymous Coward]

discuss usage policy with employer.

what I do

[Anonymous Coward]

I work for a VAR (which shall remain nameless), and what I've done is simple: I bought a second SATA drive so I could load whatever I want. Then, I carry both drives. When I'm not "on-the-clock", I swap in the second drive and can do whatever I want without fear of treading on my employer's interests.

Neigh-sayers might argue that this is a step too far, I say its perfect -- their interests are preserved, I benefit from the use of their laptop, and no one gets hurt.

Simply boot off a linux distro from USB

[argontechnologies]

Download ubuntu, boot off the CD and make yourself a bootable usb drive that run ubuntu. When using it for personal use, boot off your usb drive.

Bring an extra drive

[Anonymous Coward]

1) Buy an new hard drive for the lap top
2) Remove the "Work" hard drive, Insert your "Play" hard drive
3) Build your own OS. Install your own apps
4) Swap the drives to your heart's content

USB stick

[Anonymous Coward]

I am browsing Slashdot right now from a work laptop, with a 32Gb USB 3 stick plugged in, from which I'm running Linux Mint Works great. My typical SOP is to hibernate Windows, reboot Linux when I want to do personal work, and restart Windows when I'm done. All of my personal files installed on the stick, all of the work files on the hard drive, and never the two shall meet.

Don't.

[Dunega]

End of discussion.

buy your own laptop for personal use

[Anonymous Coward]

Get yourself a personal laptop. Travel with both when both are absolutely essential.

In some cases, just travel with your personal laptop is probably sufficient and remotely log into your work laptop (remote desktop connection) left at work or at home. (That is what I do and I have never had problems for all my business travel)

Buy your own laptop

[Hovsep]

I've always insisted on owning my laptop and always will. My employer recently offered to buy me a laptop and I declined for several reasons:

1. I don't want to worry about having to get my data off with short notice. Things are great now, but management changes and I could walk in to a layoff one morning, or I could get another job offer, or just decide to walk if things go bad. Regardless, it's my laptop and I leave it with.

2. I don't want to want to be faulted for using company resources for personal use. If I choose to use my laptop for company business (barring policy restrictions on such a thing), it cannot be held against me.

The above is worth investing $500 to $1,000 of my own money every two to three years.

Use a VM

[Anonymous Coward]

Does the laptop have USB 3.0? If so use some free virtualization software (I like VirtualBox) and keep the VM hard disk file on external storage. I haven't had much luck running a VM off of USB 2.0 storage, but 3.0 should provide enough throughput for satisfactory performance. Depending on your job, use of virtualization software might not even raise any suspicions. I use multiple VMs to create an entire testing development on my one machine.

Re:No, there's no need

[CohibaVancouver]

That being said, preventing the agent from calling in when you know it should be calling in would be cause enough for an employer to be suspicious.

Bingo.

In fact, that very scenario results in alerts from the Absolute management console that causes IT to seek out the laptop to figure out what the problem might be - It's one of the key indicators that the device is in a 'suspicous' state.

Buy a separate device for personal use

[bdwoolman]

You can afford to do this because you have a job. No need to be defiant just because you can. Live Linux USBs and Live optical disks can sometimes (very rarely) interact badly with the host system. I once made a DVD drive invisible to the installed system after using the drive to run a live CD. I got it back, after a bit of work, but there was no sweat because it was my computer. These days there are netbooks, tablets, smartphones, media players etc etc. All have a small form factor, which makes them easy enough take along with you in addition to the work-supplied computer. And most can be had for a couple of hundred bucks.

Dude, I can hear the HR officer explaining your pink slip. "It's not about the equipment. Really. It's about the position of trust you so defiantly cast aside. You broke your commitment to abide by company policy. Remember the form you signed when you were issued the machine? If we can't trust you here at Assadyne then we can't work with you."

Re:Buy a separate device for personal use

[Anrego]

Dude, I can hear the HR officer explaining your pink slip. "It's not about the equipment. Really. It's about the position of trust you so defiantly cast aside. You broke your commitment to abide by company policy. Remember the form you signed when you were issued the machine? If we can't trust you here at Assadyne then we can't work with you."

Wow, I got the chills just reading that! I can even picture what the desk would look like!

But yeah, that’s why as I said, I would ask IT before doing something like that. They might be ok with it (if the understand that as the hard drive is encrypted and nothing is being altered there is little risk) or they might not (lack of understanding, restricted by policy, other reason you might not be aware of, etc..). I definitely wouldn't just do it however!

And I definitely wouldn’t do anything like the original submitter was suggesting. A good job (or even a crummy one these days) isn’t worth the cost of maybe one paycheck for your own gear and the slight inconvenience of having to carry it when traveling.

Re:Don't do it. Carry your own laptop.

[ajlisows]

Our parent company is located in Japan and is much larger than ours. They have some solution in place that basically tracks everything done with the laptop (I have not been able to check it out, I just can't reasonably navigate a computer that is in Japanese). They can't get into the BIOS and the computer won't boot off a USB stick so they don't have any options they like. I'm guessing the GP's laptop will be like that as well. Even their high level executives carry around a personal laptop when they travel. They are usually both in the 12-13" so it isn't a terrible hardship. That is a nice size as it is still small enough to be less than 3 pounds while still getting an i5/lots of RAM instead of an Atom/little RAM of a true netbook. Most try to buy similar models or a universal power supply to have some redundancy there. Why take bizarre chances if the answer is a few hundred bucks and 3 extra pounds in your bag? I would be very concerned if one of the guys at my company started talking about how they do some batshit crazy thing like imaging the drive.

I guess another possibility is you could ask IT about their policy on personal browsing. See if you can hit your favorite sites while traveling. Maybe they would be kind enough to install your Ebook reader software. Obviously, if by "can't not browse the internet" you mean "Like to get my porn on" you shouldn't even think this way.

Not yours to muck about with.

[Anonymous Coward]

It's not your machine, so stop mucking around with it. You will almost certainly impose liability on your company by performing illegal acts on their hardware, something our company takes VERY seriously (and rightly so), an offence worthy of instant termination.

If you want to do all that stuff you mention, go get yourself an Android tablet or your OWN laptop.

What's the problem?

[Anonymous Coward]

1 - you startup the laptop from a usb key. Put ubuntu or something like that on it and you can browse and read e-books without problems. You'll only use the hardware, not the software. Don't use your company's network, that would be a stupid thing to do
2 - use your smartphone instead. Ubuntu can use your phone to connect to the internet, that's another option
3 - find a job at a company that isn't this paranoid and controling

iPad

[terminal.dk]

The iPad is the solution to your prayers.
Lightweight, Soon to be Quad-core, unix, and apps for many things.
Or if you don't care for apps, security and patches, get a cheaper Android.

What the fuck is wrong with porn?

[Anonymous Coward]

Illegal stuff I understand but why the fuck porn? I watch it and you watch it, it's perfectly normal. Sure there is illegal porn but that case I already covered. I never expected such purist non-sense from the /. crowd...

Re:No, there's no need

[Anonymous Coward]

Most Chinese made laptops (such as Lenovo) have keyloggers builtin on the motherboard.

Re:Buy your own

[steelfood]

And if it actively tracks me while on my own time - thankyouverymuchbutfuckrightoffnow, 'kay?

So your advice is instead of some technological solution or a second machine be it tablet or laptop, to instead have the OP resign. I'm sure you'd be the first one to resign if your company's machine use policy suddenly turns draconian.

Stuff like that is easy to say. Come back when it's your turn to put your neck on the line.

Unless you're advocating for the OP to actively subvert the company's machine should such a situation happen. In which case, you'd be in for a rude awakening when you get that termination notice and subsequent breach of contract (et al ) lawsuit.

Don't like having to work under company policies? Work for yourself. That's what everybody who's not interested in the corporate culture does. You lose the job security and stability, but you get your freedom in return. If that's not for you either, then you better hope you're real lucky.

Use your own laptop

[BestNicksRTaken]

Or at least buy a second drive to put in the CD-ROM bay (assuming you have BIOS access). But really it is taking the piss using a work laptop for watching pr0n.

Swap the hard drive

[Anonymous Coward]

Laptop hard drives are cheap, and held in with just one or two easily accessible screws.

Remove the company hard drive, pop in your new drive. Format / install the OS, then install your games / movies / music / porn. Just don't forget to swap back to the official hard drive before you head into the office.

Get your own Hard drive

[Anonymous Coward]

Get a hard drive of your own, and keep the company HD separate. That way your not harming their data in any way or compromising their security.
Technically a boot-able usb (HD or flash) or CD would work as well.

Re: RDP, not Dual Boot / VM

[unixisc]

One thing I did @ work was to save all my files on Network drives/Sharepoint drives @ work, and have them shadowed on my laptop. Everyday, when I would power down, it would save the current state of my working files, so that I could pick up where I left of, were I to work from home or travel. At home, if I were working (usually I wasn't), I'd reconnect to the company VPN, particularly if I needed to check any e-mail updates before continuing w/ my work, or else, I'd just continue working on it offline. Same for if I was travelling.

That way, in the event of my laptop being stolen (which thankfully never happened) or damaged (which did happen once - the power outlet became so loose that they had to replace the whole thing), all my work would still be there on company resources and once I got a new laptop, I could simply pick up where I left off. Similarly, the work involved for IT to clean and restage the old laptop, assuming that they re-used it, would presumably be minimal.

boot externally

[khipu]

Why don't you just boot Ubuntu from an external USB stick?

Alternatively, just use a smartphone or tablet for personal stuff.

Re:Buy your own

[pla]

So your advice is instead of some technological solution or a second machine be it tablet or laptop, to instead have the OP resign.

Actually, I just meant I would more-or-less politely decline to take advantage of the "opportunity" to do work on my own time with company-provided hardware. If that means resigning... I work to live, I don't live to work. If my employer has a problem with that, you can already consider me a short-timer with that company.


I'm sure you'd be the first one to resign if your company's machine use policy suddenly turns draconian.

Nope, but I will stand at the front of the line to demand an on-file exemption from stupid rules. From a past employer's joke-of-a-noncompete (that tried to regulate the totally un-work-related behavior of my relatives), to a current prohibition against salaried employees working on the side (gee, you want me to take an effective 30% pay cut, plan to make up for it?), I don't bother sneaking around when it comes to major policies I dislike. Now, for minor nuisances (like the corporate firewall classifying O'Reilly Media as porn), sure, I'll just circumvent it rather than raise a fuss. But for "terms of employment" level of issues, never, ever accept anything you don't plan to put up with for the long haul, because those terms won't get better over time.


Don't like having to work under company policies? Work for yourself. That's what everybody who's not interested in the corporate culture does. You lose the job security and stability, but you get your freedom in return. If that's not for you either, then you better hope you're real lucky.

I would point out that I live in a "right to work" state - So my employers can get rid of me at the drop of a hat anyway, without cause or warning. Although that tends to give companies a lot more leeway in abusing their staff, it also means that two-inch thick employee handbook doesn't mean squat, when "I don't like the weather today, pack your things and GTFO" carries as much weight as getting caught for the 3th time drunk in a placarded company vehicle.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Sorry - Company issued laptop is worthless package

[Anonymous Coward]

Many companies used to say 'and we give you a laptop' as part of the package valued at $2000 per year .

Gently say - I will use my own and take the cash instead, as I really have no flexibility on a crippled device with such limited usability.
It confirms what other posters say - lock up under desk and use your own, because you can't stay with the curve any other way.

Oddly enough company execs are the first to use iphones and 'apps' to do as they please, except the corporate image that is locked down. One rule for them, rules for others.

Are you serious?

[khellendros1984]

Just bring your own laptop along. Modifying an employer's machine isn't smart. Let me reiterate something: It's a computer that's not yours. You don't have permission from the owner to modify it. Period.

VM?

[Anonymous Coward]

Install "Oracle VM VirtualBox" or something similar, create a new VM and use it for all your personal stuff.

What I did

[jago25_98]

  I had the exact same problem.
Here's the ideas and why I did or did not go for them:

1) At first I carried round my own personal laptop. This is the best way, but it was adding ~20% extra weight to practically everything I own as a semi-permanent traveller.

2) I thought about asking the IT dept for a permission to do X or Y. I considered this and then decided firmly against it. What exactly am I going to ask? Having to ask to install everything would definitely be unworkable.

3) Then I thought about asking IT for permission to install a separate O/S for personal use. I felt this would single me out for special attention ( a case for anonymouse communication methinks) & they'd probably have to say no for fear of plugging that unauthorised software into the company network.

4) So when my personal laptop broke I bought a much bigger hard drive and imaged to this. If I need to return the laptop or use the company network I just plug the old hard drive back in. This has reduced what I need to carry around with me by a large factor, but I'd prefer to be able to buy my own ultra light and use that for work rather than having to lug this around. I originally had linux for personal work and Windows for work but I've found this was too ambitious - have a separate partition imaged from the original hard drive.

  A few things to add:

- a coworker once pointed out that if he asked to use 'my' laptop then really I have to let them do so, since it is not my laptop - be prepared, have everything well organised and passworded
- it's a shame I don't trust the IT dept to talk openly and honest about it, no? A good casestudy for anonymous communication as a workaround
- Be realistic. The OP admits he's internet addicted like the rest of us, be honest with yourself - are you really going to be able to resist the temptation to read Slashdot on the laptop? There's no way you're going to be able to resist not breaking IT policy. Remember what the policy is there for. Care for your company network. Remember that any device getting plugged into the network is a risk not just for them, but for you. That's a line to take responsibility at. If the company has sensitive data on there, see to protect that data from random software
- Failure to manage people in these cases is the greatest failure of IT departments. Giving someone a laptop and then expecting them to do what you say without any interest into human nature can be logical (not what my job's worth, not what I'm paid for) but actually complacent. In a perfect world people would go to work, follow the rules... sleep at work and carry on working, forever. In reality we have a confusing mismash of work and private life. Because of this YOU HAVE TO DRAW THE LINE CLEARLY. Draw a line at company data. Offer users a safe conduit for personal stuff - better to legalise and control than prohibition and black market

  My brother is sysadmin and he takes a very simple "You're not allowed to do it, so don't do it" attitude.
  I'm sure if enough people were sacked globally, the fear could enforce enough control for this to be feasible. But thankfully the world isn't like that. People aren't robots running on electric. People are people.
  You have to treat people like people. Sorry, no choice. You have to have compassion to understand what it's like to be in someone else's position. Educate and support. Show clearly how a closed source program steals company secrets and give them the means to protect against this.

All too often I hear an attitude from sysadmin and I think to myself "If you were at the coalface I know you'd do exactly the same". It's all to easy to sit in an ivory tower. And from a users point of view you've also got to realise the IT depts point of view too.

Re:What I did

[Anonymous Coward]

- a coworker once pointed out that if he asked to use 'my' laptop then really I have to let them do so, since it is not my laptop - be prepared, have everything well organised and passworded

That's rubbish. Unless the okay comes directly from your boss, that laptop may be the company's but it was given to you and if they want you to let a coworker use it, that has to come through the regular chain of command, not from the coworker. You might let them use it simply to be nice, but their argument holds no weight.

.... Why not just use your own personal laptop

[nhat11]

if you want to do something? I mean really, why waste the time especially since it's not your laptop?

Re:No, there's no need

[Auroch]

A tiny tiny portion of the real early internet was funded by the govenrment. There has been no funding of infrastructure by government for the last 20 year.

Many companies turn off usb booting in the bios, and then lock the bios.

Come out of the bubble. Life is better in the real world, where facts aren't made up and truth is based on objective reality!

Linux LiveCD / USB stick

[DrSkwid]

then it never gets to the host OS.

Or run an emulator like Qemu, boot it in snapshot mode and nothing will get written unless you want it to.

alternate boot device?

[Anonymous Coward]

Why not just boot from a portable OS on a USB drive or buy a compatible HDD and swap it out during personal use. If the laptop has an ESATA / USB 3.0 port(s) you shouldn't take much of a performance hit. Options abound... boot from cd, edit boot.ini (if you know what you're doing) to be able to multi-boot, use a remote desktop via a proxy service.

Hopefully they don't use full-disc encryption, but even if so you still have options.

Re:No, there's no need

[blueg3]

And are there actually SMM keyloggers that are loaded via the BIOS available, or did you just hear about SMM hacks from Rutkowska and assume that there must be?

Buy your own laptop or tablet pc

[assertation]

Hi Sam;

I mean no personal disrespect to you, but I find it out that any person in 2012, let alone an IT person or a Slash Dot reader would be asking such a question.

Your company laptop is for company use.

Yes, they will likely examine it.

If you want to surf the web while traveling why not buy yourself your own smart phone, tablet pc or laptop.

Happy Monday

Ask Slashdot Trolls?

[jpstanle]

Is this really a fucking serious question? I have to wonder whether a submitted trolled the editors, or the editors are trolling the users.

I am not the kind of person who can just 'not browse the internet.' If I ever have to travel with this laptop, I may want to read an ebook or watch a movie or maybe even play a game.

Seriously, you simply cannot browse the internet? Will you go into diabetic shock without it? Your employer won't let you read an e-book or watch a movie waiting in the airport? If your work machine is so locked down or corporate use policies so strict that you can't use it for any personal use while traveling, why don't you BUY YOUR OWN FUCKING LAPTOP AND TAKE THAT WITH YOU TWO? Or are you too frail to carry an extra 5 lbs of laptop?

Seriously, WTF Slashdot? I figured everything would go to shit when Malda left, but I didn't think it would happen this fast.

Too much entitlement, too little common sense...

[Anonymous Coward]

Ok OP - you might want to ask your IT Dept what limits are reasonable for use. You might also want to consult the company handbook - chances are they have an acceptable use policy.

Maybe you are new to the corporate world - but policies and procedures are there for a reason. Acceptable use policies protect the company (and fire your sorry ass) when you decide to browse pr0n, download viruses, do your bittorrenting, etc from work. Those kinds of things make the company LIABLE because it is their machine, do you get that? Also, sysadmins frigging hate losing a weekend cleaning a virus out of the corporate systems because a dipshit like you decides he wants to take his corporate machine to places it shouldn't be going. On top of that, there are a lot of regulations (like SOX in the US or the "CSOX" version of SOX here in Canada) that define what IT should be doing for security, etc. We don't just lock people down because we hate people, we do it because we are required to be LAW. We also do it because the average user (which you aren't, I would say) is pretty dumb and can easily hurt themselves and others when given unfettered access (aka "local admin") on a machine - creating a lot of work and pain for IT people that is easily avoided. I hate auditors, I hate some of their picky requirements - but they are there to protect my employer and probably save me time and effort that can be focused on more productive things.

You sir, are trying to circumvent protections put in place for a large number of perfectly good, common sense, reasons for purely selfish reasons.

I would fire you ON THE SPOT if you modified a corporate laptop like that - and you would deserve it.

GROW UP.

Re:No, there's no need

[splatter]

True, or never use it in a machine that belongs to yourself or is predictable that you will use. I just wanted Bluecobra to realize that it is not as safe as they think.

Simple answer

[nine-times]

The simplest/shortest answer to this question is: Befriend your IT support people and find out what they'll let you get away with. There's no need to be too secretive about it. If they don't want you to use your laptop for the personal usage you'd like, find out if they object to using a LiveCD/LiveUSB. They may even be willing to hook you up with something. As an IT person, I've even bent the rules here and there for people who were nice enough to ask politely.

If they absolutely do not want to permit your intended usage under any circumstances, then don't try to subvert their security. Too many IT disasters happen when people try to subvert IT policies, even innocently. Sometimes there are important business or technical implications of those policies that you don't know about.

Re:No, there's no need

[gl4ss]

frankly, their sw seems like it would depend on OS side code quite a bit!

not just a little bit mind you. but so much that a fresh os install of any operating systems _on_ the list would render

this pdf explains the non-os side functions. http://www.absolute.com/shared/datasheets/ct-intel-ds-e.pdf . disable and poison pill. not dabbadabbadoo much(and for even that to work the computer has to connect to 'net).

IT nut jobs

[Anonymous Coward]

Tom is just an example of those idiotic IT types.

I have been using my private MacBook Pro at my company as my work computer for years.

Perhaps it never occurred to you that *I* am more valuable to the company than you? Who would be dismissed, you or I?

Re:IT nut jobs

[Tom]

Perhaps it never occurred to you that *I* am more valuable to the company than you? Who would be dismissed, you or I?

My value to the company is of no consequence in this scenario. The value listed in the risk analysis next to "prevent unauthorized access to the corporate network" is. And in any but the most trivial corporations, that value is several orders of magnitude higher than your value.

companies dont track you at home

[Anonymous Coward]

they typically only track you when you are on the network. most companies really dont care if you use your laptop for personal use as long as you dont break it or require support with your personal software. Avoid the X rated sites on it or anything like that. For the most part they don't care. Why would they? They just don't want you breaking it or doing anything they consider embarrassing.

i am having trouble with my PC and plan to install turbo tax on my work laptop. no one is going to care. I run minecraft on here too at home. Most companies let technical staff have admin privileges because we are consider competent enough not to break anything. On the other hand, they usually don't provide alot of support if we do. In the past, I have seen IT guys tell programmers 'we can re-image your hard drive or you can fix it'. Cause the programmer installed some things that caused problems.

Tax issues

[phorm]

Some businesses do allow this in Canada, though often it's "limited" personal use.
The caveat though: it's a taxable benefit. In fact, just having a company vehicle and going to/from work is taxable (unless you don't have a fixed work site)

Why bother reimaging

[Anonymous Coward]

Just buy yourself a 2nd hard drive and swap it out.

Don't mess with that laptop fool!

[Anonymous Coward]

Your company spends a lot of money on it's laptops to ensure that workers can do their job - messing with that is messing with your employment. You might be able to do these things once you've earned enough attaboys to get away with it, however, If you need to have a secondary computer because you do things on it that you don't want work knowing about, then you should have a second device - pure and simple. Your employer may cipher the hard disk, so replacing it with a different one might be possible - but in reality, that's not true. The BIOS will likely have recovery software built in - my company does that, and we're not that big, and if they're actually encrypting the laptops, then you might not even be able to use the USB ports the way you'd like and the BIOS may even be locked out as far as preventing you from booting from anything other than the hard disk. Your best bet is to carry an iPad or something else that's small enough to like, but not heavy baggage.

Get one out of the turn-in pile

[Anonymous Coward]

When I worked for...uh, the military...I got one of the "old" (3 years) laptops that wouldn't run Vista plus their security/spying apps and anti-everything, and slapped Mint on it. I needed it for a remote location (et cetera....) and it would never touch the wire. When I left they just put it back in the turn-in pile to be wiped, separated from its power supply and extra battery and disk drive so it would be near worthless, and sold in a lot of 50. Your tax dollars at play.

7x24.... Do they own you.

[Anonymous Coward]

If you travel and they audit and monitor you 7x24 they need to pay 7x24.

Do not futz with their machine except for work. A tablet or other portable
that you own is your best solution. A USB key is handy because a well
managed company machine can still be hacked. if the company locks the BIOS
With a password and encrypts the system you may also need legal advice.
Border agents want access but it is NOT YOUR LAPTOP so you may be catch-21
caught between a rock and a hard place. If you unlock it you will have violated
company policy and risk termination. Yet, failure to unlock and you risk denial to
enter or return. You may be compelled to open your kimono but not your company
kimono.

USB Drive

[g0bshiTe]

Run "your" copy of Windows from a bootable usb drive, unhook the drive it's the companies, hook it up it's your safe haven. Your data is safe and the company data is safe.

get your own equipment

[pr0fessor]

I know there are people out there who feel they are entitled to use company provided equipment any way they want and are ready to circumvent safeguards put in place to protect that equipment in any way they can. Don't do it get your own equipment, if the company is security conscious like were I work then it is likely you will be caught, terminated, no unemployment, and no references. (Not all companies are like that, but I have seen it to many times to count. I've even seen some get prison time, because what they were doing wasn't legal company equipment or not.)

keyloggers

[doginthewoods]

my daughter was issues a laptop that had a key logger on it. She got called on the carpet by management demanding to know what she was typing in code... turns out her cat was sleeping on the qwerty board....

Company owned != You own

[a1z26b2y25]

With you newly found cash inflow, buy your own. Keep them seperate. Do not use the company owned machine for anything but company use. Having property damage, corporate secret exposure, and fired for being a jerk, does not look good on the resume.

It depends on the terms..

[Anonymous Coward]

of your company car usage agreement. I work for a large multi-national corporation that allows me to use the company car just like a personal car outside work hours, even to the extent of taking it on vacation if I want. In return, I pay them a very reasonable monthly fee as rental for the car. The fee is not optional. If you have a company car, it's automatically deducted. I'm very happy with this arrangement.

Don't bother

[talexb]

Buy your own laptop or tablet and use that. It doesn't sound like it's worth it to go to all that trouble just to play some games or watch a movie.

Buy a 2nd hard drive

[HycoWhit]

If buying your own laptop isn't feasible--i.e. your traveling all the time, or some such. Why not get a 2nd hard drive and simply swap your work and personal hard drives. So use your work drive during the day, when you get back to your hotel--swap out the drive for your personal drive and watch some porn before going to sleep. Just remember to swap the drives again in the morning... (or you could do it after the porn--just wash your hands 1st!)

Re:No, there's no need

[LordVader717]

It might not be unavoidable but why should anyone care? Maybe the screen's bigger or the processor faster maybe they don't have a laptop of their own or just don't want to deal with the stupid inconvenience of having two laptops on the ready. Whatever the reason, if there's no harm done then what's the problem?

IT idiots

[Anonymous Coward]

Too all of the IT nerds who clearly don't actually think about what they do and the filth they are pushing down on people. People don't want to carry around two laptops. If the company provides one, guess what, its going to be used for personal activity. Employees are not slaves of the company. If the "company" wants to declare what information will be collected and how it will be collected that is one thing. But if you THINK for a second that as a technically competent user I am going to allow some IT group to push down a horribly configured machine bloated with IT malware that sucks resources and makes work as big as a pain as possible. You are dreaming. To answer the posters question. Just wipe out the IT malware and re-install the OS from scratch. Give yourself admin rights and approach life with the attitude that you are responsible and can take care of your own SHIT. Then when you return the machine just take the hard drive out and say it broke. If they question you about it. Just ignore them. Stupid IT facks.

How about getting clarification...

[Anonymous Coward]

You will have to check your company's policy on personal use. Generally, a good number of companies do not mind limited personal use provided that it is not detrimental to your productivity and/or you're not visiting certain sites (e.g, no gambling, no porn, no warez...etc). It is always better to clarify what you're allowed to do and follow that. As a member of an IT department, I can tell you right now that messing with the software or hardware without explicit instructions to do so by IT or Help Desk staff is probably going to land you in a ton of hot water when (not if) it is found out.

Re:Buy your own

[Anonymous Coward]

"If you travel a lot with work, having to haul two laptops around may be unreasonable."

"When I was his age, I worked in a slaughterhouse. It was a good experience. I learned how to use a hammer.”
- Red Foreman

Yeah ......... unreasonable

Blindingly easy answer to this -- do what you like

[Exit_On_Right]

Then run the most powerful magnets you can find over the hard drive when you turn it back in. Most IT staff are lazy about this sort of thing. If you report it not working, and you turn it in unable to boot to the OS, they'll just wipe it and put the company standard image back on. No one will be the wiser.

Problem solved.

2nd Harddrive

[Anonymous Coward]

Buy a second hard drive and a small screwdriver...

Re:No, there's no need

[Goth Biker Babe]

I've even had three laptops before. My work laptop, my client's laptop (I'm a consultant), and my laptop. Thank the pastery tentacled one for wheeled cases!

property

[Anonymous Coward]

Clue for you, caps-lock property loving fwad: EMPLOYEES ARE NOT PROPERTY EITHER!

Re:property

[the_B0fh]

Apparently Anonymous Cowards have a significant gap in understanding - where did I say employees are property?

dual boot seems easier

[Anonymous Coward]

ubuntu would be good

losers

[Anonymous Coward]

I hope none of the security poseurs in this discussion are posting from work. What a bunch of dick wads.

Do not mix work and private life

[Anonymous Coward]

I would suggest, you should not mix private and work-bussiness - except the employer explicitly allows it.

With my last employer, I always traveled with my work-laptop and my private one/or my iPad. Although I had admin-rights on my work laptop, I did not want to mix private video watching/gaming/reading with my work laptop. Too much risk of viruses, *very interested* admins who make their fun on looking into the device what you did, ...

No Free Lunch

[Anonymous Coward]

Many have commented on "this is company property" and you shouldn't install your own crap but users do it all the time. Many organization do not completely enforce the "don't put crap on company computers" but how many actually enforce the policy. For that matter, how many organization actually have a policy and have the employee sign off on the policy when they are given the laptop? Lack of proper education of the users is the bigger issue.

I look at it this way, I am paid a salary and should be able to afford to purchase my own stuff to do what I want. Why risk it? Of course, if you are looking to get fired, go ahead and do what you want on company property. When they are looking for a reason to get rid of you, perfect reason.

Buy an iPad

[Vrtigo1]

Problem solved.