Tag Info

New answers tagged

1

In many places I've been in departments typically have "travel laptops". These are blank laptops with standard corporate encryption, office, a web browser (for email access) and that's it nothing else! No access to corporate networks, no access to personal disk areas nout! These laptops were used whenever an employee left the country regardless of where ...


0

Let's start with this quote from Tate (who asked the StackExchange question), "Long-time blog readers should know that I don't rely on tools to defend my enterprise. I rely on people first, followed by tools, then processes", Richard Bejtlich This is about right. It's almost exactly right. The one thing I would change is that tools and processes must be ...


-1

This works as a security for all types of communication. It's also a kind of security by obscurity. Simply insert a number of keywords into any document / communication: Terror threat. Bomb. Nuclear. Royal family. Selection of current time important individuals by name ~ presidents, prime minsisters, etc. Do the same for events ~ Olympics, World Cup, etc. ...


2

Full-disk encryption, three-level. First level: secure boot to the OS. Normal counter-measures (two flash drives/CD for bootloader signature verification, USB-AES passthrough devices and TPM/UEFI signing where applicable). Second level: inner container with data - split it into two parts (each 128 KB of disk space, eject 1 KB of data to remote ...


3

Unfortunately I would have to agree with the poster named "Freedom" who has made the observation that you cannot trust U.S.-manufacturered, -owned or -designed systems. The Snowden revelations proved far beyond a reasonable doubt that not only the NSA (but a long list of other "alphabet-soup" U.S. surveillance state entities), long ago declared war against ...


11

I have two solutions. Both require Full Disk Encryption (FDE). First Solution Credit to Bruce Schneier. Just before leaving home, create a second key. Type it with your forehead, a cat or dog, just so it's random and not possible to remember. Send the second key to a trusted person, preferably someone with a privileged relationship, i.e. lawyer, ...


2

Yes the risk is very big. NSA is know to put spyware on hardware before shipping (see here), NSA is know to ignore the US constitutions and spy on calls and internet activity of US citizens so do you really think they care about foreigners? If they seize your laptop and you ever get your hands back on it, throw it on the trash its junk now. I can bet ...


16

A useful and practical guide to securing information devices when crossing borders is provided by the Canadian Bar Association here. I would not say the U.S. border is the only one of concern, others such as China might eventually become similarly aggressive (though I've seen little sign of that to date). The guide echos many of the points made in other ...


4

Though you might expect this if traveling to certain countries, this question hinges on whether we should trust the authorities (or a specific person, still an opinion) and somewhat separately known capabilities (which are broad). An essential answer is the risk you're willing to accept. You could say you can't trust your device if it ever leaves your ...


-1

You can hide the fact that you have heavily encrypted files by using the one time pad method. You can dump (encrypted) data from sensitive files in the form of fake high ISO noise in image files. To decrypt, you must have access to the original image files via e.g. Google Drive. If someone gains access to your Google Drive account they will only see image ...


3

The most efficient approach I can imagine is the following: Boot from a USB media Mount a hidden encrypted volume located on internal media Leave boot media at home Use a screen saver which upon seeing a secondary password will cause a system crash. Have a bootable system on the internal media using the secondary password as login password. There is a ...


72

The ANSSI, French government service in charge of IT security, has published a document providing brief advice to people having to travel abroad. Relevant here are the advisories concerning preparation before travel: Review the applicable company policy, Review destination country applicable laws, Prefer to use devices dedicated to travel (computers, ...


15

The best way to protect against that type of border search is actually not to have anything suspicious on the hardware you take through the custom. Using encryption technology will most likely raise suspicion in the first place. Refusing to provide the necessary codes can, in some places, leads to the hardware being confiscated or even to you being ...


13

Full disk encryption is the most common one used. The cost would depend on the time which needs to be implemented by the IT department ontop of normal laptop staging. However in my experience FDE is a must for any organization taking its security serious. Aside from that there are also some really anti-forensic tools, I remember a talk at Brucon where one ...


0

No organization's objective is "security." The purpose of sensitive information is not its own existence, but its application to organizational objectives. This is to say that any effort in security takes away from real organizational objectives - it's detrimental. That said, let me follow your question directly. With a question: "Strict" in what way? It ...


5

There are a lot of complex issues, mainly related to effort and trust dynamics, that undermine security policies in organisations. Whilst individual factors have been uncovered by researchers, there isn't as of yet a single unified theory of what security management styles are preferable or of what policies to implement in every single organisation. The ...


11

What you are pointing is the difference between imposing security rules to people and involving people to get better security. Chances are that you will find this video quite interesting. After a walk through issues quite similar to the one you mention, the presenter (Jayson E. Street to name him) ends up by talking about positive enforcement. It makes the ...


1

A lot of a correct answer for you will be up to the jurisdictions that you are subject to (laws, regulations, contracts with customers, etc.) But, as for industry standard ways of dealing with access to customer data, you would need: a ticketing system to record the request by customers for changes (and thereby, permission to access) clear separation of ...



Top 50 recent answers are included