Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I've got a laptop that is currently 'Air Gapped' that I want to further secure by locking down the USB ports and NIC. I've disabled the NIC from the BIOS, removed the WiFi and bluetooth modules. But I don't want to disabled the USB ports and when re-installing i need to use the NIC as well. I do however want to control access to them and to remind myself (primarily) that I should not be connecting 'untrusted' devices to the machine.

I'm tossing up between

A) using some like the devices mentioned here to lock the USB ports (doesn't seem to apply to NIC's however)

B) Putting the laptop in a small safe or something and running the cables through it. (I'm concerned about heat issues)

I don't want to use epoxy as I still need to use the ports from time to time.

Are there any suggestions or recommendations for this?

share|improve this question
    
Should you want to investigate the "laptop in a box" option further...As you well know given your over-clocking experience, cooling is all about airflow. As long as you have vents and a fan to draw sufficient air through the enclosure you've secured the laptop in, over-heating shouldn't be an issue. –  Xander Aug 27 '13 at 15:28
    
@Xander Yeah it sounds like everyone reckons its the way to go. I'll see what i can do about getting a strong box of some description... –  NULLZ Aug 27 '13 at 22:41

2 Answers 2

up vote 4 down vote accepted

It really depends on who you are trying to secure the machine against.

If you just want to deter honest but creative users from plugging random USB devices in ports, some tape over the ports ought to be sufficient -- to remind them that this is not acceptable behaviour. Prefer some tamper-evident tape: this will make it more "official looking".

If you want to prevent evil attackers from plugging USB devices into the machine, conditions are harder. Such a person could also bring a screwdriver and open the laptop case altogether -- this is not that hard, and can be done relatively silently and quickly. Storing the machine in a hardened case would be safer. you would need some air flow to dissipate heat, but this can be as simple as a metal grid in front of the air holes of the laptop. The keyboard would still be a challenge: if the attacker can put his hands on the keyboard then he may "dive" through it (destructively, but attackers are not nice people).

Alternatively, you may plug an external keyboard, letting the wire exit the box, but this gives an entry point to the attacker: by dismantling the external keyboard, the attacker would gain access to some wires directly plugged into one of the laptop USB ports, the very thing you would like to avoid. Paradoxically, a wireless keyboard might be safer here, or not, depending on the details of the radio protocol between the keyboard and the dongle plugged in the laptop (and it would be in flagrant contradiction with the whole "air gap" concept).

To sum up, if the potential attacker is definitely hostile and has physical access to the machine, then you are in big trouble, and you need some really strong protection (supervision by an armed guard or even with CCTV could do the trick). If, on the other hand, the attacker is not really evil, then this becomes a matter of user education, and simple "plugs" should suffice.

share|improve this answer

If you're willing to physically lock it away, that would probably be the best solution. If you're going to be running cables, then I'm assuming you'd be drilling holes, and all you'd need to do to avoid most heat issues (assuming you're not gaming on it) would be drill air holes near where the vents on the laptop are normally.

Now, depending on the laptop, that might not be enough, and the best option would be to cut holes to fit fans into and put a fan in the top and a fan in the bottom to bring air in one end and out the other. Liquid cooling would be a good option too if you could figure out a way to do that. Without knowing the exact situation, it's hard to say, but a laptop wouldn't be easy to liquid cool at all, and I'm not sure how effective liquid cooling would be on the outside of the laptop to protect the inside.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.