NASA To Encrypt All of Its Laptops

They waited this long because? by Liquidretro · 2012-11-15 03:55 · Score: 3, Interesting

They waited this long because? First?

Re:They waited this long because? by baoru · 2012-11-15 03:56 · Score: 5, Funny

Obviously it took them this long because it's not rocket science.
Re:They waited this long because? by jonnyj · 2012-11-15 04:03 · Score: 4, Informative

In the UK, the Information Commissioner has for many years routinely fined any company that loses an unencrypted laptop - even, in one famous case, where the laptop was stolen in a burglary at an employee's own home. It's unheard of for any large organisation over here to _not_ have encryption on all portable devices. I'm gobsmacked that NASA has been so slack.
Re:They waited this long because? by Anonymous Coward · 2012-11-15 04:03 · Score: 1

No kidding. From the summary:

I wonder how it will be before other large organisations start following suit as a sensible precaution?
Oh, 8 or 9 years ago when California passed the law requiring disclosure. That's when it became cheaper for most large organizations to encrypt rather than deal with the fall out.
Re:They waited this long because? by robot256 · 2012-11-15 04:05 · Score: 1

They finished encrypting all the laptops at my center earlier this year. I was also amazed to learn that headquarters is behind the curve.
Re:They waited this long because? by JosKarith · 2012-11-15 04:26 · Score: 2

I work for a financial services company and any portable device is encrypted as a matter of course. That's just a basic security measure, and I'm amazed NASA have waited so long.

--
'Don't worry' said the trees when they saw the axe coming, 'The handle is one of us.'
Re:They waited this long because? by Rootbear · 2012-11-15 04:29 · Score: 5, Interesting

This is not a new policy. The implementation of full disk encryption has been underway for some time. We are doing laptops first, then desktops. The current fire drill is because a laptop with PII was stolen at NASA HQ and it was one that had not yet had full disk encryption installed.
NASA IT staff are as overworked and under appreciated as anywhere. If NASA had wanted full disk encryption done sooner, they could have added the resources to make it happen. And that would have taken resources from missions, like Curiosity and the James Webb telescope. It's all about priorities.
Re:They waited this long because? by Culture20 · 2012-11-15 04:43 · Score: 5, Insightful

Resources == salaries. Do you pay two IT guys or an engineer/scientist?
Re:They waited this long because? by NumenMaster · 2012-11-15 04:57 · Score: 4, Insightful

Funny enough right? How is it not STANDARD practice? I work for a really small state agency and that's the FIRST thing we do after imaging our laptops. It's been our policy for years. I'm so awestruck at the news.

--
Where's my sock? There it is...
Re:They waited this long because? by oneandoneis2 · 2012-11-15 05:25 · Score: 2, Interesting

Because the typical end user is stupid and forgets their password.
On a normal laptop, this means a bit of inconvenience.
On an encrypted laptop, this means a loss of all data.
You have to have solutions for this problem in place before you can roll it out.

--
So.. it has come to this
Re:They waited this long because? by jeffmeden · 2012-11-15 05:26 · Score: 1

Because management is under the impression that anyone on Earth can figure out how to get to the moon; I mean that was so 40 years ago amiright? Why encrypt it when Nasa can't copyright anything anyway?
Re:They waited this long because? by Patch86 · 2012-11-15 05:32 · Score: 1

Came here to express the same surprise.

I wonder how it will be before other large organisations start following suit as a sensible precaution?
My company has been doing full hard-disk encryption since before I joined, and so does every one of our partners who I've asked (and we usually do; if you're going to have a sniff of any of our customer data, you need to take at least a basic interest in keeping it safe). Do many major organisations not encrypt at least MOST things these days?
Re:They waited this long because? by geekoid · 2012-11-15 05:50 · Score: 4, Insightful

They have a finite pool of money. Putting something in IT takes money from the finite pool.
The poster is correct, ti's about priorities.
Since that vast majority of information NASA has is useless to anyone not in a space agency, it seems this was a good priority of limited funds.

--
The Kruger Dunning explains most post on /. http://en.wikipedia.org/wiki/Dunning%E2%80%93Kruger_effect
Re:They waited this long because? by mrchaotica · 2012-11-15 05:54 · Score: 3, Funny

That's amazing! I have the same combination on my luggage!
(Don't blame me; somebody had to say it!)

--
"[Regarding the 'cloud,'] ownership was what made America different than Russia." -- Woz
Re:They waited this long because? by spagthorpe · 2012-11-15 05:57 · Score: 1

Meanwhile, the Chinese thank NASA for taking their time in implementing this.

--
WWJD -- What Would Jimi Do?
(Smash amp, burn guitar, take home the groupies)
Re:They waited this long because? by QuantumRiff · 2012-11-15 06:09 · Score: 2

They thought they had it, but realized they were not converting the units correctly. One group was using MebiBytes, and the other was using MegaBytes..

--

What are we going to do tonight Brain?
Re:They waited this long because? by Anonymous Coward · 2012-11-15 06:12 · Score: 2, Insightful

Because encrypting data is like putting it in a black hole, from which it might never return. If you lose your password, THAT'S IT! GONE!
For a technically competant user base, like (i'd like to assume) NASA employees probably are, go for it!
But for people who struggle with Microsoft Word and basic e-mail? Well... uh... let's just say an organization might want to perform an analysis of how many times their employees call in for password resets. There will likely be a strong correlation between data loss and password resets.
Sure, the data might not fall into the wrong hands anymore, but with statistics for every lost laptop, add ON TOP OF THAT data that's effectively destroyed by users getting locked out of their own encryption. That could ALSO be very costly in terms of lost man-hours, and possibly an unnecessary risk depending on how much sesnsitive data you REALLY deal with.
Re:They waited this long because? by ae1294 · 2012-11-15 06:13 · Score: 3, Informative

Because the typical end user is stupid and forgets their password.
On a normal laptop, this means a bit of inconvenience.
On an encrypted laptop, this means a loss of all data.
You have to have solutions for this problem in place before you can roll it out.
No it doesn't. You add a second admin key to all the laptops.. It's not rocket science..
Re:They waited this long because? by mk1004 · 2012-11-15 06:24 · Score: 2

Because the typical end user is stupid and forgets their password.
On a normal laptop, this means a bit of inconvenience.
On an encrypted laptop, this means a loss of all data.
You have to have solutions for this problem in place before you can roll it out.
No, a real IT department will have an admin account so that they can get into the machine and reset the lost password. That technique is not rocket science either.
I suspect that most people don't encrypt their home computers because 1) They don't know that they should do it. 2) They don't know how to do it. 3) They probably wouldn't set up a back up admin account for a forgotten password. 4) Consumer versions of XP and Vista don't have encryption built-in. Not sure about Win 7 and 8.

--
I can mend the break of day, heal a broken heart, and provide temporary relief to nymphomaniacs.
Re:They waited this long because? by luis_a_espinal · 2012-11-15 06:38 · Score: 5, Insightful

This is not a new policy. The implementation of full disk encryption has been underway for some time. We are doing laptops first, then desktops. The current fire drill is because a laptop with PII was stolen at NASA HQ and it was one that had not yet had full disk encryption installed.
NASA IT staff are as overworked and under appreciated as anywhere. If NASA had wanted full disk encryption done sooner, they could have added the resources to make it happen. And that would have taken resources from missions, like Curiosity and the James Webb telescope. It's all about priorities.
But therein lies the problem. It should not be underway for some time. It should have been in place as an iron-fist de-factor rule a long time ago.
I sympathize with you and the other IT folks. Underfunded and under appreciated IT and dev folks alike. It is shitty, and I know what it's like (been there, don't that.) But, to not have laptops encrypted? To furnish unencrypted laptops? There is some serious break-ups there man. Why? Because, however overworked your team might be, I have a hard time believing that IT will furnish an un-imaged laptop, as-is from the vendor/supplier, to the user. I'm sure IT images the laptops, so it stands to reason that the imaging will include encryption.
If the laptops are being furnished as-is from the vendors, that's a fuck-up.
If the laptops do get imaged, but do not get encryption, that's also a fuck-up.
Any government agency has some type of security and information assurance program and guidelines. And in them, encryption of laptops must be there somewhere. If that is the case, then it is a IT fuck-up. If it is not, then it is a IA fuck-up.
I'm not necessarily blaming you or any specific IT person, but this is a serious crap-o-lah that goes against what is pretty much standard practice with any agency or defense contractor (I work for one), or even for commercial companies. It's simply crazy.
Re:They waited this long because? by FuegoFuerte · 2012-11-15 07:06 · Score: 2

The most common utility for full-disk encryption on workstations in enterprise/government is probably going to be bitlocker, since it's already included free with the OS most of them use. Bitlocker in the enterprise already has the "lost/forgotten password" issue solved quite nicely, in that on a domain-joined machine it backs it up to AD and a sufficiently-privileged helpdesk or admin person can recover things for a hapless forgetful user.
Some might argue that this is slightly less secure, but the average workstation/laptop thief isn't going to have access to an organization's AD infrastructure, and anyone who does have that access doesn't need to steal physical hardware to obtain sensitive data.
Re:They waited this long because? by Concerned+Onlooker · 2012-11-15 07:40 · Score: 1

Mebi. Mebi not.

--
http://www.rootstrikers.org/
Re:They waited this long because? by Darinbob · 2012-11-15 07:41 · Score: 1

You make backups. A second password helps too, but first step is to make sure that data can be recovered.
Re:They waited this long because? by Darinbob · 2012-11-15 08:03 · Score: 4, Insightful

Well, many want to. There are some issues though that cause inertia. Not just issues with forgetting passwords.
- Older systems that may need upgrading before being able to have encryption, or they're able to encrypt files but not whole partitions, or they don't even run IT approved operating systems. Having some machines that don't fit into a global policy can often often slow down an IT policy to a crawl, especially when the management refuses to make an exception.
- Reliability. Sometimes this encryption is not very stable. Seriously. Our whole department stopped cold on encryption when many of the macbooks started dying and had to be replaced within a month of being encrypted (ie, second IT passwords don't help), with about a week of downtime before the user is back up and running full speed again. Put things on hold until Lion was released (which was it's own freigh train full of breakage, though at least the encryption worked).
- Performance. Maybe the average user doesn't care, or the exec with an expensive computer. But encryption really can slow things down tremendously. Compile times, email searches, etc, can all take a very noticeable hit, sometimes more than twice as long. Do this on an older computer or a production system and it really hurts.
- Scheduling and availability. Not everyone is able to come in and see IT at a moment's notice. Sales people may not even live in the same state or country, and they purchase and install their own computers. IT has a tendency to want to do encryptions or upgrades at exactly the same time as a major product release.
Re:They waited this long because? by colinrichardday · 2012-11-15 08:20 · Score: 1

If it isn't rocket science, then how would NASA understand it?
Re:They waited this long because? by cpm99352 · 2012-11-15 08:21 · Score: 1

Ditto. I consult for a health care company and use one of their laptops. Full disk encryption using PGP. It works quite well - integrated with Windows Active Directory. Yeah, it slows things down, but no HIPAA worries.
Re:They waited this long because? by cbhacking · 2012-11-15 08:53 · Score: 1

Win7 has BitLocker in Enterprise and Ultimate, and Encrypting File System in Pro (same as Vista, if you s/Pro/Business/).
Win8 has BitLocker and EFS in both Pro and Enterprise (there is no Ultimate).
Windows RT has BitLocker but not EFS.

--
There's no place I could be, since I've found Serenity...
Re:They waited this long because? by DriedClexler · 2012-11-15 09:29 · Score: 1

I just hope they extend this culture of carefulness to the rest of their operations.
Next up: double -- perhaps *triple* -- checking launch calculations. Or expressing quantities with units so that others don't wrongly guess inches versus meters.
Yes, NASA must remain the innovator in this area.

--
Information theory is life. The rest is just the KL divergence.
Re:They waited this long because? by rtfa-troll · 2012-11-15 09:31 · Score: 1

The user has one, your IT staff has another, and then a third works as a sort of one-time password for resetting the user's password. I don't know if any encryption schemes work like this currently, but here's how I'd picture it working.
I don't want to endorse any particular proprietary solutions, however almost all of the commercially available Windows solutions have this implemented and it's also possible to implement this on Linux using the standard built in dm-crypt. There is no excuse for not doing it.
N.B. 1) In the procedure above step 2 must use two factor authentication and you want to consider whether the user may be acting under duress. Normally a user should be required to actually physically come to the office to have their decryption password changed.
N.B. 2) It's worth making this procedure more difficult and painful than a reinstall in order to teach users about the benefits of keeping backups.

--
=~ s,(.*),<sarcasm>$1</sarcasm>,g if any_point_you_wish();
Re:They waited this long because? by painandgreed · 2012-11-15 10:07 · Score: 2

No it doesn't. You add a second admin key to all the laptops.. It's not rocket science..
No, the second key you add is the user's.
Re:They waited this long because? by luis_a_espinal · 2012-11-16 00:54 · Score: 1

The problem here currently is with contractors at NASA. Lockheed Martin controls ALL of the enterprise equipment at Goddard and NASA HQ. If Lockheed doesnt care, or rather, the contract requirement isnt written with encryption as a requirement, then you can bet your sweet ass that it's gonna either take the moving of a mountain or an awesomely expensive contract mod to get it done.
NASA doesn't own their own IT. Their vendor doesnt give a shit.
So there we have it, a double IA-fuck up, by NASA and LM (and if some of the information being handled has some type of security classification, explicit contract or not, their mutual fuck-ups are even greater, borderlining in federal offenses.)
Re:They waited this long because? by luis_a_espinal · 2012-11-16 00:58 · Score: 1

What if, for example, they let staff purchase their own laptops and support them themselves?
No excuse. Every company I've worked for has a policy regarding privately own laptops connecting to an internal network. For a group like NASA to either not have one such policy, or having an ineffectual one, or having an effective one but without enforcement, it is a fuck-up no matter how you cut it.
This is NASA we are talking about, not some small shop or a plain-vanilla lab at a university. If a doctor's private practice has rules concerning who connects to their networks, you can bet your IT ass than NASA can or should have. It's a fuck-up no matter how we cut it.
Re:They waited this long because? by luis_a_espinal · 2012-11-16 01:00 · Score: 1

I work in IT and understanding that you work in computing for a defense contractor that specializes in computing, I think your view might be a little bit skewed. I have worked in IT for 5 years and I'm only this year completing my cycle for 200 computers. I upgrade 40 machines a year, so without increasing my budget, I would have at this point 80 computers with Windows XP due to be upgraded next year and the year after and 20 more machines due to be upgraded before the end of the year. Virtually half of my systems at this point aren't even feasible candidates for default encryption. So, if our policy were to encrypt systems where encryption was available in the OS I would still only have 50% coverage. Now I'm sure NASA has better resources and is generally a better environment than what I've got to deal with, but I don't think it's at all surprising to think they might have an XP or few Vista machines floating around without encryption.
But herein lies the problem. It is not about having a few systems floating around. It is the fact that, apparently, they had no coherent encryption policy/program in place (and now they have to rush in to make sure to lock things down.)
Re:They waited this long because? by Trep · 2012-11-16 06:15 · Score: 1

This can be easily remedied with a two key system, where the IT department maintains a key/password pair in addition to the user. I'm pretty sure PGP, for example, supports this.
Re:They waited this long because? by RockDoctor · 2012-11-16 12:58 · Score: 1

N.B. 1) In the procedure above step 2 must use two factor authentication and you want to consider whether the user may be acting under duress. Normally a user should be required to actually physically come to the office to have their decryption password changed.

That would probably be ideal, but we both know that the one circumstance we can't predict is an unpredictable circumstance. Then again ... it's "personal" data that's at stake, which is most likely to be personnel or payroll data. So fuck it - if the system can't handle losing track of some data for a few hours ... then it's overly sensitive for bean-counters to be trusted with. So, people who do science work will have systems that they can bodge and fondle as appropriate in the timescale available (laptop fried ; pull hard drive and drop into another machine ; boot from USB and continue ?) while bean-countery stuff can wait until you get beck to the office.
Which also deals with point (2) of yours : bring it into IT and explain just what you did. Expect the Spanish Inquisition to be waiting for your tattered remains after the Nerdish Inquisition have had their fun.

--
Birds are not dinosaur descendants;birds are dinosaurs, for all useful meanings of "birds", "are" and "dinosaurs"

i don't understand... by wbr1 · 2012-11-15 03:56 · Score: 2, Insightful

Why is this not done already? Between truecrypt and (ack) bitlocker,it s relatively easy. Add in a robust backup system, which any organization should have already, and it is cheap and fairly easy to implement.

--
Silence is a state of mime.

Re:i don't understand... by Nos. · 2012-11-15 04:07 · Score: 3, Informative

Because there's no enterprise management behind Truecrypt, which pretty much eliminates it. I haven't looked at BitLocker for a while, but I seem to recall it had its share of issues as well. I've used Safeboot, and its not terrible.
Regardless, its not as simple as saying, "here, install this".
Re:i don't understand... by Synerg1y · 2012-11-15 04:18 · Score: 2

Yep, you've got to have a documented practice to keep track of the recovery keys encryption programs generate. Also, my two cents is they were probably recommending encrypting the laptops, so anybody who wasn't a complete newb with computers did so, everybody else ignored it. Also, it's kind of hard to lose a laptop, I understand burglary is out of your control, but leaving it at a coffee shop is a testament to the lack of attention of the individual user.
Re:i don't understand... by TechyImmigrant · 2012-11-15 04:24 · Score: 4, Insightful

>Yep, you've got to have a documented practice to keep track of the recovery keys encryption programs generate.
No. I work in a big corp. If I die, my FDE password dies with me and the data is gone. Real data is held on servers and managed. A PC is just an access device.

--
I should use this sig to advertise my book ISBN-13 : 978-1501515132.
Re:i don't understand... by jader3rd · 2012-11-15 04:35 · Score: 1

No. I work in a big corp. If I die, my FDE password dies with me and the data is gone. Real data is held on servers and managed. A PC is just an access device.
I suspect that most corporations don't want their IP to die along with, or be held ransomed by, their employees.
Re:i don't understand... by cigawoot · 2012-11-15 04:35 · Score: 1

My company uses Check Point FDE. Its good software, provides an easy way for the helpdesk to provide either a one time login or a password reset if needed in order to allow and end user into the system. OTLs and Password Resets can be audited, if needed.
Re:i don't understand... by UnresolvedExternal · 2012-11-15 04:45 · Score: 2

I think you are missing the ACs point - the important data on the laptop should be in sync with the servers. All of the other stuff is probably crud anyway.
Or at least it should be....
Re:i don't understand... by AMuse · 2012-11-15 04:52 · Score: 1

Wow, do you bring the servers with you when you go do field tests of your robot in the desert? Or on the plane when you're doing hurricane fly-through ops?
Wait, you don't have those kinds of complexities in your corp? Interesting.
I wonder if NASA is a really complicated and nuanced sort of place and how that might provide challenges for these sorts of seemingly trivial things.
Re:i don't understand... by Enderandrew · 2012-11-15 05:03 · Score: 1

All my data is on servers as well, not on my laptop, though my laptop is encrypted. And so long as I can get a cell phone signal, I can convert that to wifi and VPN in to the data. I can even do that with free tools.
This is so complicated that NASA can't figure it out with a budget of billions and brilliant engineers?

--
http://blindscribblings.com - Tasty pop-culture in conceptual fashion.
Re:i don't understand... by UnresolvedExternal · 2012-11-15 05:34 · Score: 1

Antecedent
Re:i don't understand... by thoth · 2012-11-15 05:44 · Score: 1

I realize people want to shit themselves in excitement railing on the incompetent government, but seriously, how many corporations fully encrypt ALL notebooks/laptops? Because private corps never lose data, right? Plus with this loss, it is only going to be NASA employee PII (not that that is better, but a lot more contained), not say a credit card or store breach where YOUR data might be lost.
Besides, implementing encryption involves handling passwords, keys, protecting the data-at-rest in the first place (servers/mainframes where it is better protected), securing access points like desktops and mobile devices (which it sounds like they are in the middle of doing).
Re:i don't understand... by geekoid · 2012-11-15 05:55 · Score: 1

Yeah, there is a ton if good signals in a hurricane.
Or in the middle of no where.
And sometime the data is extremely large, making cell based network pretty useless.
Yes all the engineers or IT engineers and experts.
Protip: 'Engineer' covers MANY disciplines. I wouldn't want the engineer that works on robots building a bridge and visa versa.
The issue isn't NASA, it's your lack of experiences and over inflated ego.

--
The Kruger Dunning explains most post on /. http://en.wikipedia.org/wiki/Dunning%E2%80%93Kruger_effect
Re:i don't understand... by Enderandrew · 2012-11-15 06:47 · Score: 1

NASA engineers need employee data on an unencrypted laptop in the middle of a hurricane? In what scenario? And even in hurricane-affected areas, cell phone signals usually work. One of the laptops that was lost was carrying personnel data which should NEVER be on a laptop, especially an unencrypted laptop in any scenario. We're not talking about field data here.
LTE networks are faster than home broadband in many cases. And you're not transferring all the data across the network to your laptop, which is precisely what you don't want to do. The data needs to reside solely on the server. The laptop and VPN just needs to carry a low-bandwidth remote session. Cell phone networks are more than capable of that.
Your ignorance and insecurity is not the same as me having an ego.
It isn't that this is difficult or impossible for them to do, which is precisely why now that they'd made the decision they'll have it rolled out in a few months. The problem really here was apathy and poor security policies.

--
http://blindscribblings.com - Tasty pop-culture in conceptual fashion.
Re:i don't understand... by jader3rd · 2012-11-15 06:53 · Score: 1

the important data on the laptop should be in sync with the servers.
I agree, that's the way it should be. But it's probably not that way in the majority of deployments. Even with good IT policies in place, enough IW's are going to try and do their own thing, resulting in the laptop having some additional valuable data.
Re:i don't understand... by ryanov · 2012-11-15 07:14 · Score: 1

Why must it be one, exactly?
We use Credant here for Mac and Windows (and I hear it's DREADFUL -- awfully slow and other issues). I use the standard means in Ubuntu for Linux. I understand that that second one is probably not particularly manageable centrally, but certainly there is something else.
Re:i don't understand... by Brian+Feldman · 2012-11-15 07:45 · Score: 1

I suspect that most corporations use revision control and implement backups.

--
Brian Fundakowski Feldman
Re:i don't understand... by deroby · 2012-11-15 07:52 · Score: 2

I was actually wondering about that. I have Win7 Pro, an i5 and TPM but can't quite believe it would be '100% transparent' ?!?
I do quite a bit of development on my machine. If anyone would "find" it, at worst they'd have access to my mail, documents, photos and a big bunch of code that is unlikely to be useful for anyone but me or my colleagues who have the same access to the repositories anyway.
None of that is going to be interesting to 99.999% of the population.
The ONLY thing that might be annoying is that they might be able to reverse engineer my passwords from the cache in FireFox etc.
I do quite bit of development in SQL and a bit in c#. The latter probably will not notice the presence of BitLocker working in the background, but I can't imagine the RDBMS not to suffer from it given the heavy dependence on I/O and throughput ?!? I might consider setting up a specific partition for the db's to get around that but I hate splitting disks into partitions if not strictly needed ... (I always end up with the need to store a 12Gb file and 7Gb free on one partition and 9Gb on the other)
Anyway, I HAVE considered running BitLocker but instead I actually had to remove it completely when I moved from my HDD to an SSD.
=> Doing an image copy from one disk to another (using RedoBackup, Ghost, ...) simply refused to boot until I removed the BitLocker partition entirely and then did the move. (BitLocker was not active, but it had this 'hidden' partition).
This makes me wary to try it again doubly so!
Given the way SSD's die I run an image backup of the disk every weekend. I now expect that restoring the image to a new disk will probably cause the same situation where the restored image (of gibberish) will refuse to boot. Heck, is RedoBackup even able to handle encrypted partitions ? Worse, let's assume that not just the disk is 'lost' but the entire machine; will I be able to restore the image on another machine ? (Even if it were the same model and specs?).
From my point of view the choice comes down to :
* do not encrypt the disk and have easy backups, a fair shot at recovering the latest information in case the FS goes mad, full performance
* do encrypt and know my not-very-important-data can't fall in 'the wrong hands' but backing up is suddenly more challenging, restoring might be even more so, in case the FS goes mad it's unlikely any forensic tools will be able to read anything useful and meanwhile the extra layers probably causes some degradation in performance.

--
If there is one thing to be learned on slashdot, it has to be sarcasm.
Re:i don't understand... by Minwee · 2012-11-15 08:08 · Score: 2

Do I have to?
Would you like to start backpedalling now, or should I just make up some extra caveats about enterprise management and vendor support contracts for you?
Re:i don't understand... by Zed+Pobre · 2012-11-15 08:59 · Score: 1

Just FYI, all maintainability issues aside, TrueCrypt doesn't have FIPS 140.2 compliance, which immediately disqualifies it as a mandatory NASA soltuion. See: http://www.truecrypt.org/docs/?s=compliance-with-standards
Re:i don't understand... by TechyImmigrant · 2012-11-15 09:17 · Score: 1

There is danger in the period between generating content on the PC and committing the data to SVN (or git depending on the project). I'm not dead yet, and when I am, I will not care about the missing 1 day of work.

--
I should use this sig to advertise my book ISBN-13 : 978-1501515132.
Re:i don't understand... by dnahelicase · 2012-11-15 09:21 · Score: 1

Even with good IT policies in place, enough IW's are going to try and do their own thing, resulting in the laptop having some additional valuable data.
Good data? Additional data for sure, but probably only good data to the person who is using the laptop. I have this problem with people saving things to their local drives. I refuse to backup those personal folders. If they put it on the server it's backed up and managed correctly, but even if it hurts the business if their local data is lost, it's a good teaching tool to get people to save data where it should go. Local information is no good to the organization that cannot access it.
Re:i don't understand... by bware · 2012-11-16 04:12 · Score: 1

the important data on the laptop should be in sync with the servers. All of the other stuff is probably crud anyway.
I have many GB of data on my laptop (important to me, and no one else). The IT contractor charges a very expensive rate to store a GB of data, which comes out of project funds. So you can either do research, or pay IT real money to sync your data with the server (which is unreliable anyway. And we can't use cloud services due to ITAR issues). Which do you think the project implicitly encourages?
Everyone acts like FDE is some magic bullet. FDE only comes into action when you shut your laptop down, or log out. Which I have not done in months. What's the point of having a laptop if you can't open the lid and start working - if you have to reconstruct your work environment every time you put it sleep? At least that's how PGP FDE works, encrypt upon shutdown or logout. FDE would not have made this laptop loss less of an issue. FDE is a distraction from the the real problem here.
The real problem is that some HR idiot thought that it was ok to download a PII database onto their laptop and take it home. FDE won't fix idiocy.
Re:i don't understand... by TechyImmigrant · 2012-11-17 06:16 · Score: 1

Marge in Marketing gets Sharepoint. Engineers get linux, vnc, git and real management and tools.
If you haven't tried it, it is hard to understand how awful sharepoint is, but it is a way of getting the uneducated to put their ms office files somewhere other than their laptop.

--
I should use this sig to advertise my book ISBN-13 : 978-1501515132.

truecrypt by X0563511 · 2012-11-15 03:56 · Score: 1, Insightful

For the lazy it does the job well. No need spend budget on it.

--
For large sets, this will be our guide even unto death, for the LORD will work for each type of data it is applied to...

Re:truecrypt by Nkwe · 2012-11-15 04:04 · Score: 2

For the lazy it does the job well. No need spend budget on it.
There is a reason to spend budget if you are an enterprise or have a need for centralized key recovery. While you don't want to leak data if your laptop falls in the wrong hands, you also don't want to lose data if your employee forgets their decryption key (either by accident or as a malicious action.)
Re:truecrypt by Krneki · 2012-11-15 04:12 · Score: 2

Easy to understand for someone with experience, totally impossible concept to grasp for people who never had this problem with larger networks.

--
Love many, trust a few, do harm to none.
Re:truecrypt by X0563511 · 2012-11-15 04:19 · Score: 1

True enough, but such things cost money. Something 'simple' like Truecrypt isn't a perfect fit but you can deploy it (at risk, as you state) without having to fork over cash.
I only state this because we should all be aware of the budget nightmare NASA has been living lately.

--
For large sets, this will be our guide even unto death, for the LORD will work for each type of data it is applied to...
Re:truecrypt by lister+king+of+smeg · 2012-11-15 04:28 · Score: 1

easy fix make them save the encryption key to a text file on a key server at NASA when they forget simply ask the IT guy to go get they key. this computer should have NO network connection and all of the input ports (not counting the 1 for the keyboard) filled filled with epoxy. it should have its drive encrypted with several people who know they decryption key so there is no one person that can forget it and screw everyone.

--
---Saying gnome 3 is better than windows 8 not so much a compliment as it is damning with light praise.
Re:truecrypt by Anonymous Coward · 2012-11-15 05:23 · Score: 1

Even better, from the TrueCrypt FAQ:
We use TrueCrypt in a corporate/enterprise environment. Is there a way for an administrator to reset a volume password or pre-boot authentication password when a user forgets it (or loses a keyfile)?
Yes. Note that there is no "backdoor" implemented in TrueCrypt. However, there is a way to "reset" volume passwords/keyfiles and pre-boot authentication passwords. After you create a volume, back up its header to a file (select Tools -> Backup Volume Header) before you allow a non-admin user to use the volume. Note that the volume header (which is encrypted with a header key derived from a password/keyfile) contains the master key with which the volume is encrypted. Then ask the user to choose a password, and set it for him/her (Volumes -> Change Volume Password); or generate a user keyfile for him/her. Then you can allow the user to use the volume and to change the password/keyfiles without your assistance/permission. In case he/she forgets his/her password or loses his/her keyfile, you can "reset" the volume password/keyfiles to your original admin password/keyfiles by restoring the volume header from the backup file (Tools -> Restore Volume Header).
Similarly, you can reset a pre-boot authentication password. To create a backup of the master key data (that will be stored on a TrueCrypt Rescue Disk and encrypted with your administrator password), select 'System' > 'Create Rescue Disk'. To set a user pre-boot authentication password, select 'System' > 'Change Password'. To restore your administrator password, boot the TrueCrypt Rescue Disk, select 'Repair Options' > 'Restore key data' and enter your administrator password.
Note: It is not required to burn each TrueCrypt Rescue Disk ISO image to a CD/DVD. You can maintain a central repository of ISO images for all workstations (rather than a repository of CDs/DVDs). For more information see the section Command Line Usage (option /noisocheck).
Re:truecrypt by Nkwe · 2012-11-15 05:28 · Score: 1

easy fix make them save the encryption key to a text file on a key server at NASA when they forget simply ask the IT guy to go get they key. this computer should have NO network connection and all of the input ports (not counting the 1 for the keyboard) filled filled with epoxy. it should have its drive encrypted with several people who know they decryption key so there is no one person that can forget it and screw everyone.
Easy fix for a small deployment, but if you are talking about enterprise level deployments (tens of thousands of desktops) you would have to have several "IT guys" whose job is maintaining this database - both keeping it up to date and retrieving lost keys on a 24/7 basis. It is very hard to "make" tens of thousands of employees do anything, so unless your key escrow system is automated, it won't be reliable at that scale. Sure you could develop programs or scripts to manage all of this, but doing so has a cost and at enterprise scale you are going to want something that is tested and supported by a vendor.

Note that most enterprises running at this scale would be on a Microsoft Windows based infrastructure with Active Directory. These enterprises have already paid for BitLocker - it is included in your enterprise agreement with Microsoft. It amazes me how many companies who have already paid for disk level encryption (with managed key escrow) aren't using it.
Re:truecrypt by geekoid · 2012-11-15 05:57 · Score: 1

Becasue they don't pay people to set it up? run it? maintain it?
Clue: Software is almost ALWAYS the cheapest part of a solution. Manpower is expensive. SO, yeah that software is free, and that's cute and all but that is a minor part of the cost.

--
The Kruger Dunning explains most post on /. http://en.wikipedia.org/wiki/Dunning%E2%80%93Kruger_effect

Now they also need to learn good backup habbits by Anonymous Coward · 2012-11-15 03:57 · Score: 1

I worked for a major technology vendor. A few years back they mandated full disk encryption on all laptops (Good idea right) Problem was they went with some company i never heard of and the stuff would randomly corrupt and all data would be lost. Certain people (executives) lost a lot of data because the only copy were on the laptops. This was all sorts of fun for the IT group.

Space age? by Defenestrar · 2012-11-15 03:57 · Score: 2

I'm quite close to a different national lab type of federal facility and all of their laptops have been encrypted for at least a few years now. The stuff here isn't any more sensitive than the stuff there - it's just under an actual cabinet position. Bureaucracy may sometimes be a headache - but enforcing common sense policies is one of it's strong suits. Besides - is NASA really benefiting in it's efficiency from it's "bureaucratic freedom"?

Re:Space age? by Defenestrar · 2012-11-15 03:59 · Score: 2

I feel so ashamed - the apostrophe protection society is going to hunt me down.
Re:Space age? by geekoid · 2012-11-15 05:59 · Score: 1

You may have made Geoffroy Tory turn over in his grave`

--
The Kruger Dunning explains most post on /. http://en.wikipedia.org/wiki/Dunning%E2%80%93Kruger_effect
Re:Space age? by colinrichardday · 2012-11-15 08:36 · Score: 2

Actually, the use of "it's" as a possessive is constitutional, as it literally occurs in the (US) Constitution.

Good job someone just invented encryption... by M4n · 2012-11-15 03:59 · Score: 1

They must have been waiting years for something like this.

--
In space no-one can hear your vuvuzela.

A bit of a misconception. by sunking2 · 2012-11-15 04:00 · Score: 4, Interesting

NASA is a huge bureaucracy that is behind the curve in this aspect. The sad part is that they apparently have more laptops to lose with HR type information on them than they do ITAR. Which pretty much sums up NASA right now.

Herp Derp... why wait so long?! by erroneus · 2012-11-15 04:00 · Score: 4, Informative

You know? Endpoint encryption is trivial. There are so many products that do it effectively and easily. Why is this being done so late? Where I work, we do that to EVERY computer a user touches, not just laptops. If it isn't locked behind a server room door, it's locked to a desk and the HDD encrypted. Even the receptionist machine is encrypted.

What the hell are these people even thinking?

Sure... data recovery is more expensive or more impossible. I get that. But you know? It's kind of worth it. Also, if it's important data that lives ONLY on the endpoint machine? Well, that's another thing they are doing wrong.

Re:Herp Derp... why wait so long?! by somersault · 2012-11-15 04:23 · Score: 1

data recovery is more expensive or more impossible. I get that. But you know? It's kind of worth it.
That depends on what the data is and how valuable it is to competitors, etc. If you get so paranoid that you are literally chaining PCs to desks and encrypting them, do you also disable or physically incapacitate USB ports, make sure that nobody is sending out files via email, FTP, etc, etc? Or are you doing this more to protect from opportunist thieves?

--
which is totally what she said
Re:Herp Derp... why wait so long?! by tlhIngan · 2012-11-15 05:22 · Score: 1

Well, IT has to deploy it - and there are VERY strange interactions that can happen.
One common one was after being issued new laptops, about half of them started getting "Delayed write failure" errors on Windows and subsequently, corrupted files. No one ever figured it out - a combination of BIOS updates, Windows upgrades (from XP to 7), etc., seemed to have minimized the problems.
Other ones included very odd daily BSODs as well - they just started happening and was linked to the FDE conflicting with the antivirus software.
Of course, I suppose the issue is the company was paranoid enough to use FDE, computer management/deployment, and computer monitoring suite at the same time (monitors which files get transferred externally, etc. Basically legit spyware).
I suppose the problem is partly Windows - after installing all that stuff, the whole system gets rather fragile...
Re:Herp Derp... why wait so long?! by Beorytis · 2012-11-15 06:14 · Score: 1

At my 6,000-person employer, all laptops have required endpoint encryption for several years now. The reason it became necessary? To comply with federal regulations for contractors. We couldn't work on NASA (or FEMA or EPA) projects without it.
Re:Herp Derp... why wait so long?! by garyebickford · 2012-11-15 11:59 · Score: 1

I visited a Chevron facility back in 1998. At that time they had their own custom version of Windows (did they have source?). Putting your own data or program on the machine would get you fired. The IT staff could, and would, push a new version of the OS overnight whenever they felt the need, writing over everything on the machine, including all your work if you hadn't pushed it up to the file server. Their desktops had no floppy, no CD, and this was before USB. Opening the case would get you fired. The guy I was visiting, an oilfield engineer but a former sysadmin at another company, had a network problem a few weeks before. If he were allowed, he could have opened the box up, fixed the problem and been back at work in 1/2 hour. As it was it took two weeks before the networking guy finally made it over to fix it, so the engineer was dead in the water for two weeks.

--
It's easier to be a result of the past, but more fun to be a cause of the future! http://www.spacefinancegroup.com/

*face palm* by Picardo85 · 2012-11-15 04:00 · Score: 2

Jesus, the small company I worked for (400 employees or so) had all but the desktop machines encrypted many years ago. I can't remember what they used before the built in windows encryption, but at least they had something there.

It's insane to hear that large companies don't have their machines encrypted though it's a mouseclick away for their IT-dept while prepping the computer for deployment.

*face palm*

Re:*face palm* by VortexCortex · 2012-11-15 05:01 · Score: 2

Jesus, the small company I worked for (400 employees or so)
[...]

It's insane to hear that large companies don't

Scale. Hindsight. Legacy Systems. Easier said than done.
Sometimes you want to do the "right thing"(tm) but need some sort of cluster fsck to show those higher ups that the cost v benefit analysis preventing you from doing so is wrong. Notice it was personal info, not science & engineering stuff. Which would be more effective to lose if you want an org-wide policy approval? Just sayin' maybe their "IT-dept" is actually working as intended.
Re:*face palm* by geekoid · 2012-11-15 06:05 · Score: 1

great, now do it for 10,000 people, not all of whom are using the same OS version, across the world. Plan the maintenance for that. the history, roll out time. and so on.
400 people, how...quaint

--
The Kruger Dunning explains most post on /. http://en.wikipedia.org/wiki/Dunning%E2%80%93Kruger_effect
Re:*face palm* by strikethree · 2012-11-15 06:31 · Score: 1

If it makes you feel any better, many corps and agencies do indeed have full disk encryption already. It takes time for this kind of thing to filter through to everywhere. As you grow older, you will see time differently and begin to understand why some are ready and others are not yet ready. It has been less than a decade that this has even been a realistic goal.

--
"Someone needs to talk to the tree of liberty about its ghoulish drinking problem." by ohnocitizen

Encryption mandatory by __aardcx5948 · 2012-11-15 04:00 · Score: 1

Wait, NASA doesn't encrypt its laptops? Why not?

Just use Bitlocker, it's enforced by GPO where I work. Or if on another system, truecrypt or just CryptFS.

Why is this an issue?

Re:Encryption mandatory by ulzeraj · 2012-11-15 04:16 · Score: 1

I know that a lot of people working on NASA doesn't use Windows.
Re:Encryption mandatory by tukang · 2012-11-15 04:28 · Score: 1

Wait, NASA doesn't encrypt its laptops?
What's even more shocking is that they steal laptops
Re:Encryption mandatory by painandgreed · 2012-11-15 10:21 · Score: 1

Why is this an issue?
My guesses are:
Older users and laptops that weren't encrypted and the user doesn't want to mess with it.
Departments and users that buy their own equipment with their own budgets and never go through an IT department.
Personal laptops (bought and owned by users) used for work.
Department and users that buy the wrong laptops (no TPM) when their IT practices require it.
Combine all of the above and there are probably lots of laptops the IT department doesn't even know about unless it's lost with work data on it.

A months time? by HideyoshiJP · 2012-11-15 04:01 · Score: 1

That seems like a project that will take longer than a month. Full disk encryption on a large scale is a PITA.

Re:A months time? by Synerg1y · 2012-11-15 04:24 · Score: 2

That's why it's a lot better to be pro-active about it and handle it pre-deploy. A month to play catch up isn't actually all that bad. Then again I think it'll probably take them longer anyways.

good idea by mrflash818 · 2012-11-15 04:01 · Score: 1

I work for A Very Large Health Plan, and it is policy that all work laptops use encrypted harddrives and USB drives.

The laptops that are issued out to us workers already come encrypted, and also with the software that only allows writing to USB drives if you allow the software to encrypt the USB drive.

So far, seems to work, but does make a new laptop seem to be modest at boot/read/write times.

--
Uh, Linux geek since 1999.

Re:good idea by MachineShedFred · 2012-11-15 04:22 · Score: 1

I work for A Very Large Retailer, and we've had all our laptops encrypted for years, as a Safe Harbor requirement, and a requirement of auditing by the payment card industry.
Good to know that government is catching up to where business has been half a decade ago.

--
Slashdot still doesnâ(TM)t support Unicode after it was added to the HTML standard in 1997.

[shrug] by Thumper_SVX · 2012-11-15 04:01 · Score: 5, Interesting

You know, we've been doing this for four years where I work. And yes, I know everyone here is going to espouse Truecrypt as the one true solution, but the simple fact is NASA is run as a corporation... as such they'll probably go for a solution that's vendor supported. The fact that they're NASA will probably mean they'll get a pretty decent price on the software too.

Now, the downside of full-disk encryption (which many lazy corporations do instead of home directory only) is that it does increase the load on your system, slow it down and make recovery if/when it breaks a royal pain. Our helpdesk has an almost constant stream of laptops coming and going through their hands that they have to decrypt and re-encrypt because something got out of sync. Time consuming, and leads to downtime for the users. I've often suggested home folder only encryption... but the higher ups want it all encrypted... right up to the point that their laptop is down for two days because they've broken it.

By the way, another horrible side effect of whole disk encryption is that our experience says that it'll kill SSD's pretty rapidly. Our average SSD life is less than a year at this point because there doesn't seem to be a good full-disk encryption software that properly implements TRIM... so spinning disk or hybrid disk is the way to go.

Re:[shrug] by ltcdata · 2012-11-15 04:20 · Score: 2

You know, we've been doing this for four years where I work. And yes, I know everyone here is going to espouse Truecrypt as the one true solution, but the simple fact is NASA is run as a corporation... as such they'll probably go for a solution that's vendor supported. The fact that they're NASA will probably mean they'll get a pretty decent price on the software too. Now, the downside of full-disk encryption (which many lazy corporations do instead of home directory only) is that it does increase the load on your system, slow it down and make recovery if/when it breaks a royal pain. Our helpdesk has an almost constant stream of laptops coming and going through their hands that they have to decrypt and re-encrypt because something got out of sync. Time consuming, and leads to downtime for the users. I've often suggested home folder only encryption... but the higher ups want it all encrypted... right up to the point that their laptop is down for two days because they've broken it. By the way, another horrible side effect of whole disk encryption is that our experience says that it'll kill SSD's pretty rapidly. Our average SSD life is less than a year at this point because there doesn't seem to be a good full-disk encryption software that properly implements TRIM... so spinning disk or hybrid disk is the way to go.
I run a Lenovo X220 with hardware accelerated AES on a Core I5. The increased load is NON-EXISTENT. Also if you run a SSD with sandforce controller (which compresses data), the performance will be poor, and the wear very high. I run a samsung 830 SSD. Fastest ssd for encrypted disks (does not compress data on the fly). Also, i use DiskCryptor. It does have TRIM enabled for encrypted disks.
Re:[shrug] by Nimey · 2012-11-15 04:21 · Score: 2

It should only slow down old/cheap computers whose CPUs don't support the AES instructions, and TrueCrypt now supports TRIM... and AES instructions.
It'd be nice if someone would write a front-end for TrueCrypt that supports enterprise-type manageability.

--
Hail Eris, full of mischief...

E pluribus sanguinem
Re:[shrug] by MufasaZX · 2012-11-15 04:27 · Score: 1

I implemented Seagate hybrid drives and PGP Whole Disk Encryption on all my company's laptops a year or two ago and it works very well, and only once had a funky out-of-sync explosion that required a call to Symantec support to resolve. If you pull out a drive that has an OS issue and try to slap it into a USB dock, as long as the other computer also has PGP it'll just ask for the password and then away you go.

One minor thing that doesn't work is boot-sector based BIOS updates (Dell in particular), but getting around this with a bootable Windows98 USB key is easy enough.

Another problem with SSDs...some of them (SandForce) use compression to reduce the write cycles to the flash chips and boost performance, which is all well and good until your data is encrypted and totally uncompressable. It still works fine, but the stunning SSD performance from SF's controller comes down to more mortal levels. Hence we use the Seagate hybrid drives, they are cheap, large, and fast enough.
Re:[shrug] by IT.luddite · 2012-11-15 04:33 · Score: 2

So much for using mod points on this discussion... 3-4 years ago, I was the technical lead on a project to encrypt all laptops (mobile data, but not handhelds... *shrug*). The original project team had selected a solution (home directory only encryption) and then commenced to hit the skids. I was brought in to turn the project around. I found security weaknesses on the directory encryption (Hiram's boot cd could easily bypass it). We decided to test a whole disk solution, and went with it. For an environment that had 800+ laptops, ~25% being field crew devices (shared devices, assigned to a truck with crews then assigned to trucks on a daily basis), full deployment took 6 weeks and a dedicated team of 6 people. During the 6 weeks, we trained the IT Support staff on how to support systems w/ whole disk encryption including the decrypt process as well as continuing the roll out for new hardware deployments. Does it add to overhead on support and cause situations where data is "unrecoverable" when otherwise there would be a reasonable chance to recover? Yes. The business determined it was worth it due to the number of laptops lost/stolen. As a side note, not one user complained about additional system latency. Password sync was easily achieved via LDAP and the keys to the kingdom is held in an enterprise cert that can decrypt/access all devices. PGP WDE is the current solution. So far, so good. No linux support though.
Re:[shrug] by sribe · 2012-11-15 04:38 · Score: 4, Interesting

I've often suggested home folder only encryption... but the higher ups want it all encrypted...
And they're absolutely correct. A laptop gets stolen that contains information which you are legally obligated to keep confidential, and you are threatened with a lawsuit over the breach of confidentiality, do you prefer:
A) being able to say "the entire disk was encrypted"
B) having to argue that having the user's home folder encrypted was sufficient, and potentially having to prove that no confidential data was stored outside the home folder, but having to prove that without the actual disk in your possession as evidence
Re:[shrug] by geekoid · 2012-11-15 06:11 · Score: 1

I look forward in getting your keys and password out of your swap file.

--
The Kruger Dunning explains most post on /. http://en.wikipedia.org/wiki/Dunning%E2%80%93Kruger_effect
Re:[shrug] by RNLockwood · 2012-11-15 09:09 · Score: 1

I work for a US Federal Agency and our notebooks were all encrypted about two years ago. I know that some problems arose from that but in my major problem is that it takes 10 or, more often, 15 minutes from boot to have a usable machine! We will soon need to insert a "LinkPass" card in our machines to be able to use them (we have had the passes for a few years), we must wear the cards in the facility, and they will be used to unlock exterior doors, too. It's going to be difficult to remember to take the card out when one leaves the vicinity of the office/cubical.

--
Nate

Reasons by rossdee · 2012-11-15 04:07 · Score: 1

They are worried that Aliens might steal their technology
Somebody might find out they aleady stole alien technology
They are worried that the FBI might hack into their emails and find out who they are having affairs with
Sheldon Addison might wonder where the money he gave Newt went

Really...9/11 forced a lot of large Corps to by oxnyx · 2012-11-15 04:07 · Score: 1

The security laws in the US after 9/11 force alot of big corps to encrypt. As far as I tell it slow down boot time and forces IT to take 2 days to turn around anything as there is 12hrs to decrypt the hdd and then 12 to re-crypt.This month we got told to put stickers on all documents to state it security level...I'm really sure those stickers "CORP. INTERNAL ONLY" will really slow down those outsider eyes. Soon I'm sure we will have to us a secret de-coder ring to read the print out. Really have you guys read most internal documents? They are of little interest to the people who are PAID to read them.

--
Life is like untied shoe laces; it always tripping you up and getting in your way.

Re:Really...9/11 forced a lot of large Corps to by tatman · 2012-11-15 04:34 · Score: 1

I wonder how long it will be before the gov starts either regulating it. I mean a) requiring it b) requiring a gov back door. All in the name of fighting crime of course.

--
I've always said English was my second language. Had Romeo and Juliet been written in C, I might have understood it.

Really? by erp_consultant · 2012-11-15 04:07 · Score: 1

I'm surprised that this is not already standard procedure. If it were up to me I'd probably disable all the USB ports as well. If you've got the best firewall in the world it won't be worth a plug nickel if someone takes a flash drive with a virus on it and plugs it into a PC in the office. Now you're inside the firewall and it spreads like wildfire.

Good old fashioned IT management by Krneki · 2012-11-15 04:09 · Score: 1

A known problem since the first laptop was issued, but ignored until today.

Now that the shit hits the fan they want it done yesterday.

--
Love many, trust a few, do harm to none.

Re:Good old fashioned IT management by Pontiac · 2012-11-15 05:58 · Score: 1

More likely is that it's been a revolving budget request from IT for years and years but upper management keeps pushing it down the list to fund high visibility pet projects to pad their resumes with.
Only when the shit hits the fan to these low profile projects get funding and suddenly need to be done ASAP without any proper selection process.
The bid ends up not with the best product but in the hands of the sales drone the boos is cozy with.
The lesson here is.. If you have an important project that keeps getting kicked down the road be prepared.. Have your selection and proposed budget done and ready to roll so when the boss runs in asking for ideas you cover his ass you have something to hand them.

--
If you think it's expensive to hire a professional to do the job, wait until you hire an amateur. --Red Adair

This is amazing: Why didn't they do it 10+ years a by Terje+Mathisen · 2012-11-15 04:13 · Score: 4, Interesting

I was in charge of testing/verification of full disk crypto when my then-employer (Hydro) mandated it almost 20 years ago:

At that time 5 vendors made it through our pre-qualification tests, among these I was able to trivially break 3 of them (replace a conditional branch with its opposite), one took 20 minutes and only Utmaco's SafeGuard Easy had done a proper security design, where the user password was used as (part of) the seed for the key used to decrypt a copy of the master disk key.

I.e. the system _must_ be safe against attack from anyone, including the vendor!

I wrote a longer post about this the previous time the same issue came up on /.

Terje

--
"almost all programming can be viewed as an exercise in caching"

Re:Hammer to kill a swarm of flies by amiller2571 · 2012-11-15 04:15 · Score: 1

It is not stupid by any means, the system stores information all over the place. It would be to hard to try and encrypt each one by itself. It is far easier to just encrypt the whole thing. You would be surprised how little of a hit you take in performance. I used TrueCrypt for a good while and I never notices any slow down at all. Encryption like AES are extremely fast.

System encryption provides the highest level of security and privacy, because all files, including any temporary files that Windows and applications create on the system partition (typically, without your knowledge or consent), hibernation files, swap files, etc., are always permanently encrypted (even when power supply is suddenly interrupted). Windows also records large amounts of potentially sensitive data, such as the names and locations of files you open, applications you run, etc. All such log files and registry entries are always permanently encrypted too.

http://www.truecrypt.org/docs/

Why keep data on the laptops at all? by concealment · 2012-11-15 04:17 · Score: 2

At this point, why not have them VPN in to a central server, and keep all work materials there?

Between the trendy "cloud" and the availability of high-speed internet and most computers having encryption cycles to spare, our machines are now souped-up thin clients.

The idea that people need to take gigabytes or even megabytes (640k is ok though) of confidential data home with them on their laptops needs to be questioned. What are you doing with all of that? At home? On the subway?

Forget it: keep the data under control, and make the laptops worthless to foreign espionage.

My work laptop by Sparticus789 · 2012-11-15 04:19 · Score: 2

I work for the Federal Government and every laptop has to have FDE in order to leave the building. This policy has been in place for years. NASA is just behind the times of every other federal agency. Too busy playing with robots, I assume.

--
sudo make me a sandwich

AAARRRRGHHH by MrLint · 2012-11-15 04:19 · Score: 4, Insightful

NONONNONONONO

This is not how you deal with an incident like this. You have to reexamine your infrastructure and find out *why* that info was on an endpoint to begin with. This is teh same BS kneejerk reaction that makes for bad IT planning. Just go and wallpaper of it with a band-aid and look all betterer.

HULK SMASH!!!!

Re:AAARRRRGHHH by Beorytis · 2012-11-15 06:26 · Score: 1

Planning is great and rules are great, but you need to be ready for the inevitable cases when plans are not followed and rules are broken.
Re:AAARRRRGHHH by MrLint · 2012-11-15 09:12 · Score: 1

Sadly you are right, nature keeps giving us better idiots
Re:AAARRRRGHHH by FaxeTheCat · 2012-11-15 21:22 · Score: 1

You have to reexamine your infrastructure and find out *why* that info was on an endpoint to begin with.
And when you examine the infrastructure you may find (we do) that there is no LAN speed infrastructure everywhere (not to speak of the latency crossing a continent), and there are cases where there is no connectivity at all.

Keeping all data centrally is a good idea, but sometimes the real world will just not cooperate.

NASA doesn't own most of their computers by oneiros27 · 2012-11-15 04:23 · Score: 2

They're leased from HP as part of the NASA ACES contract :
http://www.nasa.gov/home/hqnews/2010/dec/HQ_C10-080_ACES.html

Prior to that, there was a contract with Lockheed Martin.

They have to put out a specification of what they want the machine configuration to look like, and then HP gives 'em a cost per month for it.

And the 'devices' lost aren't necessarily laptops ... it could be cell phones or tablets, which are also leased through ACES.

There *are* ways around this, but you have to do more paperwork, and then you can buy stuff off SEWP, and they're maintained by different groups of sysadmins (assigned to the mission, project or division).

And to make it more fun -- if you sign all of the paperwork to take a government furnished computer off site as a contractor, you're liable for the full original purchase price, no depreciation. (this might not be true for ACES) ... so I know a few people who brought their work-assigned laptops back and said they'd rather buy their own ... which means there's then *NO* control over them ... although they're not supposed to put SBU / ACI on it.

--
Build it, and they will come^Hplain.

NASA Transparency drirective by scorp1us · 2012-11-15 04:24 · Score: 2

I thought NASA was ordered to be completely open and no information was to be considered sensitive. This was ordered at its inception when it was created to provide the space program, in order to NOT be military in nature so that the Russians would not be worried. Sure they have shared information over the years but nothing NASA has done has been military in nature.

It seems to me then, that nothing NASA can have can be 'sensitive' in nature, and these encryption efforts run counter to t heir chartered openness.

--
Slashdot's rate-of-post filter: Preventing you from posting too many great ideas at once.

Re:NASA Transparency drirective by SecurityGuy · 2012-11-15 05:33 · Score: 4, Interesting

NASA has employees. Those employees have things like SSNs and disabilities and other such things that go in personnel files. It's one thing to say that all NASA's mission data should be completely open, and quite another to say that means everyone who works there should expect the public to be pawing through their data when that data would be afforded protection at any other employer.
Re:NASA Transparency drirective by pavon · 2012-11-15 05:45 · Score: 1

I thought NASA was ordered to be completely open and no information was to be considered sensitive.
While very little of NASA's work is classified, the vast majority of their technical work is covered by ITAR and export control laws, and has to be protected from dissemination outside of the US. Export control can be very over-reaching, and needs to have a major overhaul, however some of the restrictions are on things that could easily be militarized.
Re:NASA Transparency drirective by scorp1us · 2012-11-15 08:57 · Score: 1

Well when I got to meet the guy that invented Beowulf at NASA (at a computer security class at UMBC) he said they could not use firewalls to protect the network and Beowulf was created from the effort of finding breaches that could have been prevented with proper application of firewalls and encryption.

--
Slashdot's rate-of-post filter: Preventing you from posting too many great ideas at once.

Re:what about laptops on the ISS? by Tastecicles · 2012-11-15 04:25 · Score: 2

1. I don't think there will be much chance of a laptop being carelessly knocked off a window sash onboard the ISS any time soon.
2. If such a thing were to happen, solar radiation and cosmic rays on bare electronics would likely take care of any data.
3. If the laptop does survive that, it's unlikely to survive re-entry.
4. If it does survive re-entry, it'll likely still be travelling at several hundred miles per hour and be uncomfortably hot by the time it falls *through* the hands of some nefarious individual.

--
Operation Guillotine is in effect.

Way to be out front, NASA. by NikeHerc · 2012-11-15 04:27 · Score: 1

My employers in my last two jobs have given me a total of three encrypted laptops, the oldest going back to the middle of 2008. If you choose an appropriate h/w vendor, an encrypted disk won't slow down the typical laptop user.

Encryption didn't seem to affect the Dell laptop; not true for the ThinkPad, it was slower than Christmas.

--
Circle the wagons and fire inward. Entropy increases without bounds.

Why did it take so Long? by Formorian · 2012-11-15 04:30 · Score: 1

I work in Gov't, state level. EVERY SINGLE laptop is encrypted. You plug in a USB, before you can move data to it, it has to be encrypted (you can move data off to computer without encrypting). You burn CD it get's encrypted.

They just this year started encrypting desktops also.

What I don't understand is why is it not a Fed Gov't rule that every agency that has portable media (tablets/laptops/usb/etc) has to be encrypted? This should just be standard now. Esp after having 48 incidents in 3 years? WTF, after first incident they should have started working on a plan to encrypt stuff.

Re:Why did it take so Long? by denobug · 2012-11-15 06:09 · Score: 1

I work in Gov't, state level. EVERY SINGLE laptop is encrypted. You plug in a USB, before you can move data to it, it has to be encrypted (you can move data off to computer without encrypting). You burn CD it get's encrypted.
They just this year started encrypting desktops also.
What I don't understand is why is it not a Fed Gov't rule that every agency that has portable media (tablets/laptops/usb/etc) has to be encrypted? This should just be standard now. Esp after having 48 incidents in 3 years? WTF, after first incident they should have started working on a plan to encrypt stuff.
Because like so many trivial things in life, it gets political. Worse for federal government, since not only do they have to deal with office politics, they also have to deal with the OTHER politics when it comes to how to run an agency with the appropriate ideology, down to if it fits the ideological view of certain people whether to encrypt a stupid harddrive or not.

Surprised by thetoadwarrior · 2012-11-15 04:32 · Score: 1

My company has been doing this for ages. It just makes sense and I'm really surprised NASA does not do it already.

Re:Large Company in Defense Sector by lister+king+of+smeg · 2012-11-15 04:35 · Score: 1

Or could just go with someone other than Macrapy. Ubuntu I believe gives the option to encrypt the whole drive or just the home folder in the install wizard, and windows 7 enterprise has full disk encryption as a option if my memory serves me.

--
---Saying gnome 3 is better than windows 8 not so much a compliment as it is damning with light praise.

Yes, why the wait? by rickb928 · 2012-11-15 04:37 · Score: 1

We've been doing this at my work for a few years now. Any organization that is at all concerned with data loss should already be doing this to all user workstations, portable AND desktop. Anything less is bordering on malpractice.

--
deleting the extra space after periods so i can stay relevant, yeah.

Re:Large Company in Defense Sector by Ensign_Expendable · 2012-11-15 04:39 · Score: 1

Yep, they seem to be 90% Mac from what I see on the TV news. So I take it OS X's built-in FireVault won't do the trick. So what else is out there in the World of OS X security packages?

Re:what about laptops on the ISS? by somersault · 2012-11-15 04:39 · Score: 1

Why would they be forced to Windows? Any time I've installed a Linux distro recently, it's at least asked if I want to encrypt my home folder.

--
which is totally what she said

Re:Budget Cuts? by lister+king+of+smeg · 2012-11-15 04:39 · Score: 1

i thought that to

--
---Saying gnome 3 is better than windows 8 not so much a compliment as it is damning with light praise.

Re:When you have a billion hammers, flies ARE nail by NikeHerc · 2012-11-15 04:40 · Score: 1

... most crypto these days tends to be resistant to "known plaintext attacks".

256-bit AES is generally considered safe for geologic time, with geologic time possibly being reduced by orders of magnitude for the NSA. Any NSA /.ers care to comment?

--
Circle the wagons and fire inward. Entropy increases without bounds.

Horses and Barn Doors... by Mr.+Sanity · 2012-11-15 04:42 · Score: 4, Informative

Too bad they didn't do that before I had to recieve this email this week:

OFFICE OF THE DIRECTOR
November 14, 2012
TO: JPL Employees and Contractor Personnel
FROM: Charles Elachi
SUBJECT: NASA Laptop Security Breach
On Tuesday November 13, we were all notified that a NASA laptop and official NASA documents issued to a Headquarters employee were stolen. The laptop contained records of sensitive, personally identifiable information (PII) for a large number of NASA employees, contractors and others. NASA is assessing and investigating the incident and taking every possible action to mitigate therisk of harm and/or inconvenience to affected employees.
We at Caltech/JPL are extremely concerned about the potential implications of this incident to our employees and affiliates. We have been in contact with NASA Headquarters, and they advise us that they intend to mail letters beginning this week to affected or potentially affected individuals as they are identified. NASA has not provided us with thelist of individuals whowill be notified.
In the meantime, a good resource of protective measures is the Federal Trade Commission's website, Facts for Consumers, Identity Theft: What to Know, What to Do, at: http://www.ftc.gov/bcp/edu/pubs/consumer/idtheft/idt01.shtm. The State of California also has information at www.privacy.ca.gov. Click on "Consumer Information Sheets" on the left-hand column and you will find several Consumer Information Sheets that may be helpful.
We call your attention to this portion of NASA's message:
"NASA has contracted with a data breach specialist, ID Experts, who will be sending letters to affected individuals, informing them that their sensitive PII was stored on the stolen laptop and they could be impacted by the breach. This notification also will provide them information on how to protect their identity using the fully managed services of ID Experts at no cost to the individual. These services will include a call center and website, credit and identity monitoring, recovery services in cases of identity compromise, an insurance reimbursement policy, educational materials, and access to fraud resolution representatives. If you receive a notification letter in the mail, follow the directions to activate your services as soon as possible.
All employees should be aware of any phone calls, emails, and other communications from individuals claiming to be from NASA or other official sources that ask for personal information or verification of it. NASA and ID Experts will not be contacting employees to ask for or confirm personal information. If you receive such a communication, please do not provide any personal information."
We will issue further relevant information as we learn more. We are committed to assisting our employees who may be impacted by this incident. If you have questions, please feel free to contact JPL Human Resources at x4-7506.

Re:Horses and Barn Doors... by ScottMaxwell · 2012-11-15 05:48 · Score: 1

Yes, but don't worry: that massive amount of info they're collecting on you as part of HSPD-12[*] is perfectly safe.
[*] Where NASA said we all had to submit to unrestricted background investigations -- where they could gather any data they wanted on you, from any source, whether it be your doctor, your lawyer, your priest, your ISP, or whatever -- and then a secret, unappealable tribunal would decide if we could keep our jobs. I and others sued them over this, and lost. But don't worry, we can all see that NASA keeps careful track of sensitive information.

--

``Life results from the non-random survival of randomly varying replicators.'' -- Richard Dawkins

Re:Large Company in Defense Sector by Atrox+Canis · 2012-11-15 04:45 · Score: 1

That can be addressed via things like vpro.

--
Charter Member of The Committee Group For The Elimination And Eradication Of Repetitive Redundancy

About F****** Time by moonwatcher2001 · 2012-11-15 04:52 · Score: 1

Boeing did this 6 years ago.

Re:Budget Cuts? by richlv · 2012-11-15 05:00 · Score: 1

http://www.space.com/14531-nasa-mars-missions-budget-cuts-2013.html

--
Rich

Why doesn't NASA Just.... by AMuse · 2012-11-15 05:02 · Score: 1

An awful lot of people in this thread have quick and simple "just do this" solutions for NASA's data encryption challenges.

NASA isn't your standard corporate environment - there are serious challenges to any "Just do X" solution. They DO need to encrypt everything but its not a simple single-answer thing. They have to accommodate every scenario from "HR newbie with PII data in an office envrionment" to "Laptop collecting data on a C-130 as it flies through hurricanes" to "Laptops controlling robots in the desert during field tests sulating Martian environments".

In many of those cases a laptop with broken
encryption software means millions of wasted dollars if the experiment is a wash.

In other cases NOT having crypto means serious secrecy issues.

Anyway, there's no excuse for this loss but could we please stop pretending that NASA literally never considered DAR on mobile devices, and that simply doing {your favorite product} on everything would solve all the problems?

Thanks....

Re:Hammer to kill a swarm of flies by MightyMartian · 2012-11-15 05:35 · Score: 1

Chief reason is to encrypt the swap file. If the swap file is not encrypted, keys and data could be potentially retrieved.

--
The world's burning. Moped Jesus spotted on I50. Details at 11.

Re:Large Company in Defense Sector by MightyMartian · 2012-11-15 05:38 · Score: 1

That's the biggest suckage for us. We went to fully encrypted laptops and desktops this spring as a requirement of a government contract we won. Used Truecrypt, which is pretty painless, but it's pretty much killed remote work on our branch office machines. Now someone has to be there to fire it back up again.

Oh what I would give for Truecrypt to build in remote password entry like I can do with dmcrypt on *nix.

--
The world's burning. Moped Jesus spotted on I50. Details at 11.

Re:When you have a billion hammers, flies ARE nail by pixelpusher220 · 2012-11-15 05:42 · Score: 2

Any NSA /.ers care to comment?

Are you prepared to die? ;-)

--
People in cars cause accidents....accidents in cars cause people :-D

ehm what? by kelemvor4 · 2012-11-15 05:52 · Score: 1

I wonder how it will be before other large organizations start following suit as a sensible precaution?

I'm pretty sure that laptop encryption IS the standard at most big businesses these days. It is in the company that writes my paychecks, anyway. I think NASA was just behind the times on this issue.

Duh... by JDAustin · 2012-11-15 05:54 · Score: 1

I work for a large corp whose own screw ups with lost un-encrypted PC has been duly noted here on Slashdot. It is corporate policy to encrypt every hard drive that is not locked up. With Win7 and bitlocker its simple to get encryption for 80%+ of normal users.

Re:When you have a billion hammers, flies ARE nail by geekoid · 2012-11-15 06:01 · Score: 2

depends.
Do you define 'Geologic time' as the time it takes to beat a password out of someone? Or the time it takes to ask the corporation to turn the key over?

--
The Kruger Dunning explains most post on /. http://en.wikipedia.org/wiki/Dunning%E2%80%93Kruger_effect

Re:what about laptops on the ISS? by geekoid · 2012-11-15 06:03 · Score: 1

Do you now the send electronic signals to the Space Station? I know, amazing, right?
Did you know electronic signals can be used to get into a computer by a person who isn't even in the same room? I know,. shocking!

--
The Kruger Dunning explains most post on /. http://en.wikipedia.org/wiki/Dunning%E2%80%93Kruger_effect

Re:This is amazing: Why didn't they do it 10+ year by strikethree · 2012-11-15 06:36 · Score: 1

I was in charge of testing/verification of full disk crypto when my then-employer (Hydro) mandated it almost 20 years ago

Because 20 years ago, the resources that it took were extreme so an extreme need was required to even consider it. A bit less than a decade ago, the resource usage became light enough to where most anyone could consider it and, not surprisingly, we are seeing it done more often. This is not rocket science... pun only slightly intended.

--
"Someone needs to talk to the tree of liberty about its ghoulish drinking problem." by ohnocitizen

Right Time by bill_mcgonigle · 2012-11-15 06:48 · Score: 2

I've personally been using LUKS for 4-5 years but I've also taken a power/performance hit for doing so.

Just ordered a new laptop with an i5 in it, and even within the i5 family I had to be careful to order a chip with AES-NI in it (the unit with the other specs I wanted winds up being mid-market due to limited configuration choice). But at least now the top 50% of the market has AES-NI built-in and those trade-offs are something to not-so-fondly remember.

--
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)

Re:This is amazing: Why didn't they do it 10+ year by Terje+Mathisen · 2012-11-15 08:07 · Score: 1

No, the resource usage was not "extreme":

We did measure some slowdown of applications, but mostly in the single-digit percentage range.

This was simply because most applications those days did all their work in memory, only Microsoft's virtual disk swapper would use the disk during normal operation, and then only in case you suddenly needed a lot of free memory space.

Bulk load of application and data files did slow down a bit, but significantly less than 50%, i.e. the hard drive did not suddenly become half as fast even for bulk transfers.

When I was involved in the AES process more than 10 years ago, one of our targets was to optimize the crypto code so that a 1996 vintage PentiumPro could handle a 100 Mbit/s full-duplex communication line, or correspondingly about 20 MB/s of disk en/de-cryption.

Today full disk crypto is effectively free, except in power usage, since all computers have multiple cores, most of which are idle even when an application is working hard, and a single core can keep up with the fastest available (spinning) hard drive. A modern i7 core with the AES extensions can do the crypto without getting hot. :-)

Terje

--
"almost all programming can be viewed as an exercise in caching"

Re:Public, private, practical by colinrichardday · 2012-11-15 09:02 · Score: 1

Would you be willing to work for NASA if your Social Security number were posted on a publicly available website?

Re:Obligatory ref by colinrichardday · 2012-11-15 09:07 · Score: 1

Wouldn't a rubber hose be better than a wrench? If you hit people upside the head with wrenches, they're not going to be able to give you much information.

why not use desktop virtualization... by freshlimesoda · 2012-11-15 09:08 · Score: 1

but then again..its not rocket science.

--
I come to Slashdot only to read sigs. One you are reading is mine.

We do by Chris+Mattern · 2012-11-15 09:35 · Score: 1

I work for a fairly large university. It's been part of our IT standard that all laptops must have full-disk encryption for a few years now.

Re:When you have a billion hammers, flies ARE nail by garyebickford · 2012-11-15 11:49 · Score: 1

No need to beat - threats and bribery, or just cuteness and heavy breathing, will generally work fine. In red team tests back in 1999 (IIRC) a Navy group found that the average cost to bribe a sys admin to let 'bad guys' into the data center and provide passwords to get in was about $7000. With inflation, maybe that's $10,000 now.
I'm sure that 90% of workers would give up the password with merely a threat of pain, although I like to think that most would resist bribing.

--
It's easier to be a result of the past, but more fun to be a cause of the future! http://www.spacefinancegroup.com/

Encryption isn't always the best solution by SaZZer · 2012-11-15 12:43 · Score: 1

Where I work, all laptops are required to have full disk encryption. These are windows laptops, and includes the swap file. And this includes developer machines. Building large source trees on a machine with this encryption just isn't realistically feasible, but its what were expected to do...

The security people tested it out first of course - on some support machines that do nothing more than email and word. And because it worked well enough there it was rolled out compony-wide...

Re:what about laptops on the ISS? by Eunuchswear · 2012-11-15 18:52 · Score: 1

Do you now the send electronic signals to the Space Station? I know, amazing, right?
Did you know electronic signals can be used to get into a computer by a person who isn't even in the same room? I know,. shocking!

Do you know that encrypting the disk is a way of protecting against getting data from machines that are turned off and provides no protection at all against being hacked by remote access?

--
Watch this Heartland Institute video

Re:48 'mobile devices'? in two years? by FaxeTheCat · 2012-11-15 21:27 · Score: 1

Most businesses would have shit after a few devices were lost or stolen. Seriously, how do you lose a laptop or smartphone like that? Do thieves rove the NASA parking lot in packs? Is there a mugger riding up and down in the elevator?

For an organization of that size with a fair share of mobile users, I do not think the number is very high. Our organization has all policies and training in place to avoid laptop theft, but there are still quite a few of them. Most happen during travel. Airports are bad. Then again, most organizations keep their numbers internal, so we will not know if NASA lose more than the average.

Slashdot Mirror

NASA To Encrypt All of Its Laptops

152 of 226 comments (clear)