The SANS Technology Institute

Musings

Laptop Security

March 20th, 2008
By Ted Demopoulos and Stephen Northcutt

If there is one area of information security we need to make progress on, it is laptop security; these systems now routinely ship with disk drives that hold over 100 gig of data, and that number is rising quickly. Laptop computers are often stolen and often the reason for data breaches. They are small, easily sold, and valuable, and criminals are starting to understand the data they hold can be worth far more than the laptop itself. When a laptop is stolen it is a major inconvenience at best; and, if company confidential data gets into the wrong hands, the results can be truly catastrophic.

Many professionals use a laptop, often transporting it between home and the office. Most travel, at least occasionally, with a laptop. Laptops are particularly vulnerable when traveling but are often stolen from offices and residences as well.

These simple steps should be taken to help protect laptops from physical theft:

• Do you have to keep a laptop in a laptop bag? It is a sure tipoff. When traveling there are times we are vulnerable: putting the laptop in the trunk of a cab, overhead of a bus, train, or plane where it is easy to snatch. If you take a bus or shuttle, hold on to your laptop. Don't put it “in back” with the other luggage. Consider an inexpensive small carry-on size, rolling suitcase and your shoulders will thank you as well.
• Keep any passwords and PINS separate from the laptop and its case. If you must write them down, put them in your wallet so they cannot be stolen with the laptop. If you have full disk encryption, make every effort to memorize that PIN or passphrase.
• Use a locking cable and perhaps an alarm for your laptop, available at any computer store. I don’t always lock my laptop, for example at home, but often lock it in hotel rooms and even in my private office when leaving for extended periods of time. Yes, these systems can be defeated, but they buy you time.
• Use disk encryption to protect sensitive data. Disk encryption can be defeated if the laptop is stolen and it has not been shut down. I use TrueCrypt with its default to automatically dismount the partition if the system is hibernated to protect against the so called cold boot attack.
• Try not to leave laptops in a car. This isn't always practical, but minimize it as much as practical. Never leave a laptop, laptop case, or briefcase in plain sight in a car. If I have to leave it in the car, I thread the security cable through the hinge of the trunk. Now, granted, the sight of the cable going into my carry on bag is a dead give away, but a thief feels very exposed with the trunk open and will want to move as fast as possible.
• Watch your laptop carefully in airports and train stations! Certainly do not put it in checked luggage. Do not ignore or leave it alone for even a few seconds. When going through security, place it on the x-ray machine last, immediately before walking through.
• Ask your organization to look into asset tags or even engraving the organization’s name onto the lid. This makes it just a bit harder for the thief to resell the laptop and may even help it get returned if it is stolen.
• Many laptops are stolen from businesses. If you don't know if it's safe to leave your laptop unattended, ask someone. A colleague once had his laptop stolen from a "secure building" at a police facility during lunch!
• Don't leave your laptop or any laptop accessories visible in your hotel. In a drawer covered by clothes is a good hiding place.
• Never put your laptop on the floor. I was teaching in Chicago and at lunch there was limited table space. I was tempted to put it on the floor, but kept it in my lap. Another student put hers on the floor and sure enough, a drink was spilled on it. She was lucky, it booted. Laptops on the floor might also be stepped on or forgotten when you leave the room.