I have sensitive data to secure. My computer may likely be compromised physically in the future. How can I secure my date from various attacks like Evil Maid attacks and so forth. I have some basic knowledge of encryption and I can work with hidden Veracrypt volumes, but it doesn't protect me when attacker has physical access.
Tails is exactly what you want, being designed with activists in mind! It is a live Linux-based operating system that can run from a DVD or USB stick which is amnesic, meaning that any data that isn't explicitly saved to storage will vanish on reboot, including settings, metadata, and other information. Every time it boots up, it boots up fresh as if you have never used it before. Additionally, it forces all network connections through Tor, using a firewall to protect even from a compromised web browser.
Tails includes a variety of useful tools for document processing such as video and audio editors, text and document processors (generally compatible with the Microsoft Office suite), and a myriad of tools for cryptography, such as email clients supporting GnuPG encryption, chat clients supporting a wide variety of protocols (IRC, XMPP, AIM, etc) with chat encryption using OTR, and disk encryption utilities. It also contains Tor Browser, a browser designed for anonymity with use of the Tor anonymity network.
Basic evil maid attacks are prevented by keeping the Tails DVD or USB stick on your person, or downloading and verifying a fresh one if your primary copy was out of your sight for too long and may have been compromised. However, it is effectively impossible to protect from a sophisticated attacker who has prolonged access to your computer and is able to insert hardware backdoors.
Prevent someone with your powered off computer from learning what was done on it.
Protect the content of your internet communications from a Wi-Fi or ISP-level attacker.
Allow you to visit websites without the websites knowing your location (anonymity).
Tails does not
Hide the fact that you are using Tails from an attacker on the network or a local adversary.
Protect your computer from prolonged physical access before or while it is on.
Prevent you from making OPSEC mistakes, such as accidentally publishing your identity.
For more detailed information on Tails' threat model, consult the design document.
Disclaimer: While not a core developer, I contribute code to Tails and as such could be considered associated with it.
Whole disk encryption, UEFI secure boot, with TPM hardware.
This won't stop an embedded key logger from capturing the credentials, but it's about as secure as you can get.
If you want to go even further, link the decryption to a Yubikey (or equivalent) in challenge-response mode and even a key logger won't work.
Just remember that Rubber Hose Cryptography doesn't have a technical solution.
This is an important conversation, as the same thing needs to be considered with politicians and other possible higher-profile targets. While something like Tails (mentioned already) is great for your physical machine, it is also important to consider the email and online platforms that you use as they are often the target of phishing attacks. Not sure what the rules on here is about specific product endorsements, but if you are using a Gmail account then I would look into Google's "Advanced Protection" account. It takes your gmail account and forces you to do the following:
- Password requirement is stronger
- Requires a UFA key (like the Yubikey or Google's new Titain USB Key)
- Restricts apps that can connect to the account
- Strict rules about the devices that can log in
- Etc, etc...
WIRED ran an article on this when it was first released and this quote really stuck out to me: "If John Podesta had been able to turn this on sometime last year, the world might be a very different place."
Even if you don't use Google, then make sure that you are using 2FA everywhere you can (UFA keys are great too if supported), and consider using a password manager to generate secure passwords and that you are not reusing those passwords anywhere else.
Protecting against Evil is very hard, especially if you are the target. I'll write some complementary solutions to user10216038's answer.
Use a Live CD so that your operating system cannot be modified. You can prepare yourself with the necessary software; Disk encryption, etc. (see user10216038's answer.)
There is also a Tempest attacks where the adversary may steal your information even giving any effect on your laptop/PC. To secure against Tempest attack you have to buy specialized hardware and power filters. In some cases, a secured room may be required.
As a political activist whose computer may be of interest to local, unethical state operators, I suggest you really want something sort of deniable encryption.
Currently there is not a great deal of choice around implementations - but product recommendations are off-topic here. Googling the magic words "Deniable encryption" should take you to some potential sources, but do beware that the bad guys may also be watching your internet searches.
Make sure you already do routine preventive measures you have access to today, and its free. Again, protection methods reduce the speed of penetration and requires more skill level of the perpetrator so it deters 'evil maids' from accessing your unattended laptop to try and plant malware.
Note, how these features prevent access varies by make and model. Many 'high end' laptops have ways to bypass UEFI/BIOS locks, some easier than others. However, if they bypassed locks they also erase your former passwords, you know you've been penetrated. If you have UEFI with TPM and its required by your OS it may erase all Secure Boot keys as well as the ownership, and may stop, make it hard or alter the boot sequence, again showing something is not right.
Set a UEFI or BIOS based password for both ADMIN and USER? This prevents the operating system from loading so your device is stopped at the firmware level. This is more secure in general in UEFI setting with TPM.
Disabled boot from anywhere but the internal HD? This disables USB or any external ports, as well network boots.
Set a different hard drive password, if available? This prevents the hard drive from starting up, and has firmware independent of the UEFI of your laptop, in case its bypass able, see first item above. There maybe software to unlock the drive, but often it can be done by wiping it clean, or requires laptop disassembly, but if they managed to unlock it in situ, loss of password would betray its been penetrated.
Some manufacturers may have a hidden UEFI/BIOS reset to factory sequence built into their firmware accessible via the keyboard, such as Dell, the firmware is stored in a recovery partition on the HD. Access can be halted by setting a HD password, if available, as this prevents the HD from booting and is independent of the manufacturer's firmware beyond the UEFI. Regardless, with passwords reset it again reveals to you, something is not right.
Never sleep your computer, power down completely, versus cold boot, evil maid issues
Use Veracrypt as whole disk encrypt mode, and use the hidden operating system mode, which creates a decoy environment. Do the same for containers. Alternatively, use Windows bitlocker if on Windows, which is better is best left for another question.
Don't save sensitive files on your PC but on an encrypted card you take with you, if net access is variable quality or untrusted.