Our small company uses Google Drive to store some medium-sensitivity documents (they should not contain highly personal information, but still things that would be embarassing to leak and potentially benefit our competitors). Storing them in Drive has been a very convenient solution in our situation, and our employees would be resistant to moving away from it. Most people have installed the google drive desktop app, that syncs the Drive files to their own machine, and they like this feature too.

What I'm concerned about is a scenario where our employee's laptop would be lost or stolen, and the thief would access the hard drive, and thus these Google Drive synced files. What are my options to protect against this scenario? I would like to interfere with our employees' processes as little as possible, so I would appreciate the most convenient, but still secure solution. Some kind of encryption of files, folders or entire hard drive would probably be required, or is there another way? How could I enforce this on all users without too much extra work for them?

  • Encrypt the laptops? That would handle things efficiently and elegantly.
    – schroeder
    Nov 18, 2016 at 18:27
  • Do you want to protect the files in the cloud or locally? Is your worry that the thief could log in and download files, or that they would have access to the files already on the drive. If the latter, then the whole Google/cloud/sync thing isn't a factor.
    – schroeder
    Nov 18, 2016 at 18:28
  • I mean the local files. I know that those not different from any other files on the laptop hard drive. I imagined, though, that the fact that the files are synced through a cloud service could change the scenario in that it may offer some options for encrypting the synced folder with the service's features or something. I'm not very familiar with how these syncing services handle the local files and what kind of features they have for protection.
    – Waiski
    Nov 18, 2016 at 18:41
  • Some services sync the files in a sandboxed container. Drive does not (there may be 3rd party apps).
    – schroeder
    Nov 18, 2016 at 18:42

1 Answer 1

  • You could only sync specific folders from Google Drive, i.e. the ones used most often, while the rest are only available via online sign-in. However, it sounds like that is not what you are looking for, and it may be difficult to enforce.

  • Tighter access control, and even using multiple accounts per person. Mobile use may not need the same files as office use.

  • Full Disk Encryption is probably the best option here. Keep in mind that if the laptop is stolen while unlocked then the security will not be in effect.

    While it's not actually necessary to encrypt the entire disk, I think that will be easier to set up.

My favorite solution from a security standpoint is not to store the files locally at all.

  • Perhaps providing a means to remotely sign in to in-office computers from the mobile laptops. Unfortunately, such screen mirroring requires quite a bit more bandwidth.

  • Migrating to cloud-based solutions, i.e. Google Docs and Google Sheets, or other services that are cloud-based and only accessed through the browser would be the best solution. I'm not sure what kind of documents you are currently dealing with so this might not be an option.

Obviously making sure that sessions are invalidated (signing out) when the device is stolen could be important, as well as detecting the theft to begin with.

Fortunately, with Full Disk Encryption, once the device is shut down, and assuming you have a sufficiently long Password, it is fully secure.

  • Many devices come with a Kensington Lock Slot which can be used to physically tie the device to its vehicle or something. Obviously many attack options are still available, but least it definitely will increase the amount of time needed for theft. (since simply snatching the laptop is no longer possible without breaking something first)

Finally, it is possible that there is some utility out there which provides filesystem-like access (i.e. a mounted drive, e.g. SFTP or other solution) without actually syncing the file itself. However, I'm not familiar with these options.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .