3

The possibility of having one of your users' laptop being either stolen or lost is fairly high. What are some of the best practices/policies when protecting your data on mobile computers?

Understanding that Disk Encryption is a must have, what products give you as the IT admin the most flexibility when working with a user's laptop?

splattne
  • 28,508
  • 20
  • 98
  • 148
TechGuyTJ
  • 792
  • 1
  • 13
  • 26

6 Answers6

5

In addition to disk encryption, a policy to not allow any sensitive data to be left on the laptop may be helpful. Instead require the laptop to VPN & RDP to a secured machine back at the office. With this approach you will lose the ability to work offline, but depending on how sensitive the data is, this might be the best option.

You can also use some type of Remote Laptop Security (RLS) that phone home. If the purp is using the laptop, this can be a good way to find and recover the laptop. I have never used these services, but here is an example.

Bob
  • 2,937
  • 5
  • 29
  • 32
  • I would also lock up the machine with Windows Steady State which resets the machine to any state you want to. If it gets infected, reboot. Put a belt with those suspenders baby. – Matt Jun 11 '09 at 18:52
  • Why do you have to keep sensitive data off the disk if it's encrypted? Also, how could the "purp" use the laptop if it's encrypted? He's have to wipe the drive to install an OS, killing your RLS. – Jeremy Stein Jun 12 '09 at 17:54
  • I'd error on the side of caution with sensitive data. It is possible someone could steal the laptop while it is unlocked. – Bob Jun 12 '09 at 19:32
2

Two words - Disk Encryption.

We use SecureDoc from WinMagic, but there are a number of them out there.

Ok, 7 words. In addition to the above we have the policy "no data allowed on c:"

Some cautions on certain disk encryption packages

  • Sleep mode can bypass the encryption login as the system does not go down far enough. Hibernate is a workaround for this, but hard to enforce.
  • Make DARN sure to unencrypt a disk prior to trying to run any kind of Windows recover console tools (.....)
  • Look for something that'll encrypt removable media as well.
squillman
  • 37,883
  • 12
  • 92
  • 146
  • +1 for caution about sleep mode. To mitigate this, have the system automatically lock the screen on sleep mode (and use a *strong* password). – sleske Feb 22 '10 at 23:35
1

I suggest TrueCrypt for full disk encryption. Being open source, the price is right and it works well. The one downside is there's no way to centrally manage it, so if someone left on bad terms, there's no way to retrieve the password.

Knox
  • 2,463
  • 2
  • 26
  • 34
  • 1
    Yes, you can recover the password. Just create a rescue disk with your admin password before handing over the laptop. The user can change the password, but you can always restore it. http://www.truecrypt.org/docs/rescue-disk – Jeremy Stein Jun 12 '09 at 17:52
  • Very interesting. It's not clear from the doc's that it's the case. – Knox Jun 12 '09 at 18:13
  • I agree about the docs. When you actually do it, the on-screen instructions make this clear. – Jeremy Stein Jun 12 '09 at 19:26
1

Things other people have said about disk encryption and VPN are very good. Another good idea is to disable USB ports. If a legitimate user moves data to a USB stick from an encrypted drive, the encryption is useless.

The best thing you can do, above and beyond that, is to have multi-factor authentication such as Yubikey or RSA SecurID. Someone who steals an unattended laptop is unlikely to also steal someone's keys. By forcing someone to have a password as well as a physical object in order to authenticate, it becomes extremely difficult for thieves to access the data. If they steal the laptop, they'll get free hardware, but they won't get your data.

Apreche
  • 1,405
  • 5
  • 17
  • 20
  • "disabling USB" seems more like an alibi solution. You can always use the net, plus users might legitimately need to use USB. If you don't trust your users, you're screwed anyway... – sleske Feb 22 '10 at 23:36
1

If your machines are Windows Vista or 7, go with BitLocker, which is a pretty nice built in full disk encryption solution. I think with Vista you need Ultimate or Enterprise, and 7 includes it with those two and buisness. If I am wrong on this feel free to comment and I will adjust my entry.

Matt
  • 433
  • 1
  • 5
  • 10
0

At my company, we use Symantec Endpoint and disk encryption.

Will
  • 58
  • 6