I am a "power user" with a limited knowledge of information security. I frequently store confidential documents on my computer. How can I protect these against a rootkit that gives an attacker complete access to all your files?

The question is not so much about best rootkit prevention practices (like having an up-to-date firewall, antivirus), but rather, if you are to appreciate the fact you can never be 100% certain something isn't lurking in your system from all the dodgy files/software you download or websies you visit, what would you say are the best practices of storing sensitive data on the hard drive which would make finding/downloading those files very difficult? For example, I now store all this data in encrypted TrueCrypt containers which get mounted occasionally. However, when these containers are mounted as a separate drives, what stops attackers downloading decrypted files off me?

How do people working in secret services across the planet manage this issue? What could you recommend for a beginner who is interested in thi? What's an easy way to lock down specific files from leaking over the internet, or at least be able to monitor traffic and spot irregular patterns/files being accessed by other programs?

  • information safety ... Nitpicking: You mean security instead of safety. To put it short, security is against malicious humans and safety against stuff like fire, earthquakes, coffee on the keyboard etc.
    – deviantfan
    Dec 7 '15 at 0:15
  • As for the main problem, the simple but not practical solution: Your data and the internet connection are on different computers, you won't ever transfer something from the internet computer to the data computer, and the data computer is in a secured room. ... tldr: For useful practical solutions, you'll have to weigh security against usability.
    – deviantfan
    Dec 7 '15 at 0:19

As mentioned, you can keep sensitive data and your internet connection on separate machines. It is quite a hassle, but it is quite secure. It really depends how valuable you think your data is.

One method a bit easier than separate physical machines, is separate virtual machines. Qubes OS has the basic idea here. Because it's a software layer, any of your internet exploits will be blocked, provided they don't manage to bypass the hypervisor. Although this is quite good security from software, for some people, that's too big an if.

  • Convenience isn't security... Security isn't convenient, right. Dec 7 '15 at 11:42
  • @CanadianLuke, well, yeah, that's the basic idea. The rest comes down to economics.
    – timuzhti
    Dec 7 '15 at 12:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.