Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

If the user knows that other people will repeatedly have physical access to her notebook - running Linux - while she is absent, and that there is no way around this, what are best practices for protection?

The obvious one is to lock the login screen - ok. Still not sure how to protect from live CDs, live USBs and most of all, hardware modifications, such as inserting physical keyloggers in the machine.

As to this last case one can verify after it potentially happened but any creative idea on how to prevent it in first place? Maybe some special locker, tape or what-not?

share|improve this question
    
What asset(s) are you trying to protect? What is the sophistication level of the 'other people'? Are you trying to keep data confidential or protecting the operation of the system? –  this.josh Sep 18 '11 at 4:09

4 Answers 4

up vote 11 down vote accepted

This should be sufficient at least for the moderately to quite paranoid:

  • Change BIOS settings to boot only from the harddisk, so you can't boot from other devices. Make sure to disable network boot, which is usually in the same menu.
  • Set up a password for changing BIOS settings and for startup, so nobody can get past the BIOS loading screen without resetting the BIOS.
  • Set up automatic shut down when closing the lid (you should be able to do this in the power saving options). That way, intruders will have to go through the BIOS password prompt to get anywhere.
  • Encrypt the whole disk. That way, you'll have to get to the PC while unlocked or to add keyboard sniffing to access anything.

Some more outlandish suggestions:

  • Install a James Bond-type trigger which will be broken if someone opens up the case. Ideally, this should be detectable only by the owner, and should be easy to see.
  • Glue up the ports which are not used.
  • Fill up the insides of the computer with resin or glue, so nobody can install hardware devices there without seriously messing with it. Of course, you might run quite a risk of hardware failure if the machine contains any moving parts.
share|improve this answer
1  
Using hibernation or suspend to RAM on computers with sensitive data is bad idea: the disk encryption key is in the clear in RAM (bad) or saved to disk (worse). Completely defeating encryption this way. In short: encryption gives you 95% of security, the rest are only little additions. –  Hubert Kario Sep 16 '11 at 8:58
1  
Won't the hibernation data be stored on the encrypted harddisk, so you still have to decrypt to restore from it? Anyway, changed it in the text. –  l0b0 Sep 16 '11 at 9:04
    
Encrypting the whole disk sounds a bit like overkill. Without taking out the hard disk (which is possible) I can't think of anything they can do which would not be prevented by controlling the boot –  symcbean Sep 16 '11 at 11:52
2  
The resin idea: you might also run quite a risk of hardware failure if the machine contains any air-cooled parts. –  Piskvor Sep 16 '11 at 13:20
1  
This doesn't protect against phishing. Unless you only enter your BIOS password from inside a shielded room, someone can create a laptop that looks externally identical, trick you into entering your BIOS password which they exfiltrate via the wireless network. :) –  Mike Samuel Sep 16 '11 at 23:09

Put glue into the heads of the screws protecting sensitive pieces such as the hard drive. You can always chip it out when you need to, but it provides tamper detection, since the attacker would also need to chip it out, and presumably would have trouble replicating the specific look of the glue spot you left in place.

share|improve this answer

External parts (usb ports, firewire ports, cd drive) are somehow visible. User should watch them. I couldn't find any device that could be inserted inside an USB port and locked with a key: USB ports weren't designed to afford such screwing, so probably putting some lock inside it (physical lock) could cause damage.

To prevent from opening the notebook case: put some seal in every place that you could open using screws. If the seals are somehow personalized, better, so it's hard to replace one after being damaged. There are some seals that can't be removed without destroying themselves.

And be sure that this will only prevent soft spying. If you have informations that you want to hide from NSA, well.. good luck trying. :)

share|improve this answer

Without physical security, you can't have strong protection. So I don't know of any very strong, robust security measure for your situation.

But you can mitigate some of the risks. One possible approach is to have two OS installs. One of them should be Truecrypt encrypted with a strong passphrase. The other, not encrypted at all. Before giving the laptop to someone else, reboot to the unencrypted OS instance. This doesn't protect against physical keyloggers or some other threats, but at least it prevents straightforward ways that a malicious user might use to get at your data.

share|improve this answer
1  
+1 for this "Without physical security, you can't have strong protection". –  DanBeale Sep 16 '11 at 16:29

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.