How to protect against leaking Google Drive synced files from a stolen laptop?

Question

Our small company uses Google Drive to store some medium-sensitivity documents (they should not contain highly personal information, but still things that would be embarassing to leak and potentially benefit our competitors). Storing them in Drive has been a very convenient solution in our situation, and our employees would be resistant to moving away from it. Most people have installed the google drive desktop app, that syncs the Drive files to their own machine, and they like this feature too.

What I'm concerned about is a scenario where our employee's laptop would be lost or stolen, and the thief would access the hard drive, and thus these Google Drive synced files. What are my options to protect against this scenario? I would like to interfere with our employees' processes as little as possible, so I would appreciate the most convenient, but still secure solution. Some kind of encryption of files, folders or entire hard drive would probably be required, or is there another way? How could I enforce this on all users without too much extra work for them?

Answer 1

• You could only sync specific folders from Google Drive, i.e. the ones used most often, while the rest are only available via online sign-in. However, it sounds like that is not what you are looking for, and it may be difficult to enforce.

• Tighter access control, and even using multiple accounts per person. Mobile use may not need the same files as office use.

• Full Disk Encryption is probably the best option here. Keep in mind that if the laptop is stolen while unlocked then the security will not be in effect.

  While it's not actually necessary to encrypt the entire disk, I think that will be easier to set up.

My favorite solution from a security standpoint is not to store the files locally at all.

• Perhaps providing a means to remotely sign in to in-office computers from the mobile laptops. Unfortunately, such screen mirroring requires quite a bit more bandwidth.

• Migrating to cloud-based solutions, i.e. Google Docs and Google Sheets, or other services that are cloud-based and only accessed through the browser would be the best solution. I'm not sure what kind of documents you are currently dealing with so this might not be an option.

Obviously making sure that sessions are invalidated (signing out) when the device is stolen could be important, as well as detecting the theft to begin with.

Fortunately, with Full Disk Encryption, once the device is shut down, and assuming you have a sufficiently long Password, it is fully secure.

• Many devices come with a Kensington Lock Slot which can be used to physically tie the device to its vehicle or something. Obviously many attack options are still available, but least it definitely will increase the amount of time needed for theft. (since simply snatching the laptop is no longer possible without breaking something first)

Finally, it is possible that there is some utility out there which provides filesystem-like access (i.e. a mounted drive, e.g. SFTP or other solution) without actually syncing the file itself. However, I'm not familiar with these options.