Choosing laptop brand for company

Question

Recently we have been wondering whether it makes a difference (from a security and privacy perspective) what brand laptops should be used in our company. I have heard wild stories about backdoors existing in "most" laptops (esp. the ones coming from China), but it is hard to say whether it really makes a difference for a normal company that is not associated with the government and/or military.

Answer 1

For a normal company, you're not really in a position to identify or deal with hardware or firmware level compromises of any laptops you buy - so you mostly have to base your decision on the reputation of the vendor (i.e, go for a big name brand that is reasonably trusted).

The more practical thing that you can do is to wipe the systems as soon as you get them and put on your own clean operating system install. Because quite a few of the "backdoors" on new laptops have been the result of dodgy software, drivers and CAs installed in the OEM image (such as the Lenovo Superfish debacle or preinstalled an audio driver with a built in keylogger on HP laptops), rather than hardware itself

Answer 2

As other comments have noted there is the possibility of hardware or software being undermined, and this is something that requires advanced capabilities to mitigate and with a lot of difficulty, to detect.

In lieu of advanced capabilities you can base your decisions around:

• What your business produces and how that is used?
• Who your business produces to (individuals, other companies, etc.)?
• How big it is currently (number of systems being of primary interest, but monetary metrics can matter here, too)?
• What risks it is willing to accept in order to achieve its objective(s)?
  • Do different parts of your business need to make tradeoffs in how they handle risk (via @user1937198)?

A "normal" company still has something to protect, and we can certainly debate on what that means in a subjective matter. Just because you are not military/government does not mean you have something to protect to the best of your ability - it just means you will (likely) be unable to go to the same lengths for said protection.

While this is not a debate around The Value of Privacy - it is worth considering for the downstream consumers of your business as well as your employees because (to me, personally):

the nature of cybersecurity as it relates to business in this world is by nature a battle of power.

Ultimately this boils down to your risk profile and the risks you are willing to accept (that are outside of your time, capabilities, or budget) or based on business deliverables:

• Does your business have limitations for Operating Systems and the available software on them?
  • Can you accept aspects of Microsoft or Apple telemetry?
  • Can you accept what that OS entails for the management of your systems and your system/network footprint?
• Does your business have limitations in hardware that may restrict the ability to run Open Source firmwares like coreboot or libreboot?
  • You may choose to do this if you are trying to avoid the possible risks associated with the Intel Management Engine
• Does your business have peculiar Mobile Device Management requirements that restrict your hardware choices?

Your risks in time will change, especially as the software and hardware landscape change; so you can choose to the best of your ability now and as the business grows and evolves you can introduce new choices in hardware and software.

Answer 3

What you do is determine a vendor that meets your needs and check that vendor's reputation and news of backdoors.

There are many companies that are starting to reject hardware assembled in China as a blanket rule because of the rising number of concerns, even though there is not enough evidence to rule out any specific vendor. However, you need to assess the risk for yourself.

The problem is that unless you spend a lot of money to have the hardware analysed, you will unlikely know whether there is a hardware backdoor or not.

Answer 4

Everyone is writing about the hardware/chip manufacturer inserting backdoors. Unless you're in the military or intelligence business, that's not your concern.

What is more important from a hardware perspective is the vendor cheaping out and doing stuff wrong. For example, a number of notebooks have useless TPM chips because the decrypt key is passed over the bus unencrypted and a bit of hardware sniffing will get to it, quickly. Others allow for side-channel attacks too easily. Still others have terribly insecure remote maintenance firmware installed. It's impossible to give a complete list in an answer here, so these are just some examples to get you looking into the right direction.

The best approach to find a manufacturer that does things mostly right is probably to make a short-list of respectable brands that have been around a while, and then research into which hard- and firmware issues have come to light with these over the past decade or so. Doing the legwork on 3-4 possible manufacturers is manageable.

Answer 5

Other responses are right. Anyhow, System76 is doing laptops with open source firmware, which is a significant step forward in security. Certainly some other brands do offer the compatibility, check "coreboot".

Answer 6

I suspect part of the question is "assume the computer is compromised... Does this even matter?"

And that depends on what the computers are used for. Do they hold information that isn't backed up, so that you could be subject to ransomware? Do they hold security keys that could be used to drain your company's bank accounts directly? Security keys that could login to compromise or shut down something bigger than your company, such as shutting down power transmission for a state? Are they used as personal machines so that someone could be subject to blackmail over stuff they shouldn't have on there, but will?

Your actual risk is almost certainly less than security fans assume ... but it is probably more than you assume.

Answer 7

As others have said: it's the job of the vendor to worry about these supply chain issues, as long as you've chosen a reasonably reputable vendor.

Where I'll deviate slightly from other answers so far is you want to ensure that when/if these issues are found, you have a reliable way to quickly patch your fleet and report on the results.

While there are a number of ways to accomplish this, for my money I'd want to pick a vendor who supports hands-off firmware patching through Windows Update. Not everyone does this yet. So far, I believe at least HP, Dell, Lenovo, and Microsoft all support patching firmware via Windows Update, at least for the business-class product lines, where your users can get these patches through normal updates according to policy as a matter of course, without having to think more about it (other than the usual monitoring and reporting to ensure the offered patches are actually installed). This also ensures any updates went through Microsoft's Windows Hardware Quality Lab (WHQL) before release.

This is a relatively new thing, and I am not personally aware whether Acer, Asus, or other manufactures are doing this yet, but it seems like larger manufactures are mostly on board, while smaller outfits may not be there yet.

---

As a next step, you want to ensure to get devices that use UEFI, rather than BIOS (BIOS systems are rare now), and that the UEFI SecureBoot feature is available and enabled.

---

Finally, it's a good idea to build your own system image to apply to the new Windows devices before deployment. In this way, the drive is wiped clean as part of your deployment. Though newer MDM tooling is making this less useful than in the past, there are also still good practical reasons to do this separate from security.