What is the current best practice to secure an executive's laptop?

The exec will be processing highly sensitive documents (high-value bids, merger & acquisition info, technical specs). As such they are a potential victim for a targeted attack or APT. They will primarily use web, email, and office. And they need to be able to work offline.

I am aware the minimum best practice is:

  • Use a firewall
  • Use anti-virus software
  • Update all software
  • Encrypt the laptop

However, these precautions do not guarantee that the laptop will resist an APT. I have seen various ideas for creating a more secure environment (e.g. Qubes). However, these appear to be fairly experimental and aimed at a techie rather than an exec. So what practical steps can I take today to secure a highly sensitive laptop?

  • 3
    Pray to whatever god you believe in.... Feb 25 '14 at 14:24
  • 1
    I would try application whitelisting in conjunction with full disk encryption
    – CtrlDot
    Feb 25 '14 at 20:26

The biggest thing you can do is user training. The majority of targeted compromises are a result of stupid users. It doesn't matter how secure you can make the system when your PHB (pointy haired bastard) follows the link spoofed from their buddies e-mail address to some custom malware infested porn site and clicks ok to every dialog they see.

If you can't get awareness of security and what are appropriate uses of the computer and get the executive's buy in on that, then no amount of additional effort on your part will make a bit of difference. If you can get their buy in and investment in keeping the system secure, then most of what you described is fine.

Another alternative is to give it an always on internet connection and use it like a dumb terminal for a virtual machine hosted within the company's network. That's a bit more pricey and a bit more of a nuisance, but it is even more secure as you don't have to worry about whether the laptop may be able to be hacked if lost because there won't be anything on the laptop itself worth stealing.

  • 1
    No amount of training will help an executive against a targetted attack. They simply do not have the knowledge and understanding to react properly. It's normal: that's not their job.
    – Stephane
    Feb 25 '14 at 14:42
  • I agree, user training is important. Training should be tailored for specific roles in the organizations. Executives need to know that they are high value targets. A healthy bit of paranoia isn't a bad thing for them as they are typically more exposed. This is just good risk management, it IS THIER JOB! I'm sure the shareholders will think executives have some responsibility for protecting the information to which they have access. Feb 25 '14 at 18:41
  • I can probably train them not to click through security warnings, although I would prefer a technical solution which automatically says "no" rather than presenting the dialog (presumably possible with group policy?) But they will need to visit untrusted websites, which could contain malware that uses exploits - user training can't solve that.
    – paj28
    Feb 26 '14 at 9:34
  • Training is very expensive. A CxO in s major company costs in salary alone something like 3000 USD$/hour. You really wan to make things as simple as possible for the CxO and spend as little of his/her time than possible. Dec 14 '15 at 8:46
  • And when you lose a 50 million dollar contact because the CxO got phished, the 30k or so training them would have cost looks pretty damn good. Nobody ever accused security of being cheap. Dec 14 '15 at 14:22

Have a techie setup Windows on Qubes and teach the exec to separate trusted and untrusted/personal activities (rightclick - open colleagues 'fun' links in Disposable VM or resend to personal mail address before opening). Setting up Qubes might be quite techie, using it is mostly about secure copy-pasting and where to open / make accessible which file, extra hassle is minimal. He can get a simple-to-remember pass-phrase (not password), and a vault with a password manager. Each domain may even save his passwords in Firefox/Chrome/whatever. let him use java or whatever in a disposable VM. If it is practical of course will depend, but if your data is valuable enough, then it will be more practical to implement this and teach your user than to run the higher risk to lose the sensitive data by not doing so..

  • I have tried running Windows under Qubes, but it limits much the usability. For many tasks, I believe it is easier to get used to Linux than to use Windows under Qubes.
    – v6ak
    Mar 14 '18 at 17:33

I have always had issues with "best practices" as most of those "best practices" were written to specific networks, businesses, and not my own. ALL businesses differ and historically, we see that best practices have done nothing to slow down compromise. I'm not against best practices, I think people should not rely on them as any holy grail.

You named the top tier best practices, so I will point out what people tend to miss with regards to best practices.

FIREWALLS: Right. Now how many people implement things like bidirectional rules, or logging all. It is one thing to "block" say China from coming IN the door, but if you throw up a "state" rule, there is nothing stopping the machine from initiating an OUTBOUND connection to China. Rules and policies with regards to firewalls need to be placed on both sides of the fence.

Think about this for a minute, you have a laptop for an exec who goes on a business trip. What are his goals during that trip. Perhaps to make a presentation, where he may need to connect to and from corporate to make a presentation, or a pitch? One rule, to and from, block all others. Not that you need to get to that extreme, but firewalls are so often misconfigured, they're useless.

Antivirus: Does little for target attacks since many signatures for advanced threats are not even created. A more effective tool would be some form of notification when the exec is traveling. E.g.: "Your machine is initiating a connection to (PERFORM A WHOIS LOOKUP HE CAN UNDERSTAND) and trying to access THIS DATA"

Updating all software does not defend against (I dislike this term): 0day attacks.

Encrypting the laptop (say with Truecrypt) won't work if your exec DEMANDS his password be simple.

There are methods to defend against APT like attacks however, most are bandaids. I say this because most PEOPLE are the cause of attacks. Opening spear phishing emails, visiting sites they shouldn't visit. Replace Adobe Acrobat with say Foxit, remove flash, block java+javascript, switch them to Chrome using a proxy, and see how far down the attacks go. At this same time, try dealing with the complains of high level execs who want pretty, "open this right now," versus security. Solve that problem, and you'd worry less about APT like threats.

  • I agree, best practice is a starting point, not a holy grail. Not sure about restricting outbound firewall - what if they need to visit a Chinese website? Monitoring suggestion sounds good, know any specific tools? Using Chrome, Foxit and disabling Java sounds good. Disabling JavaScript will break too many sites. In general the execs are sold on security so I think we can fight off "open this now" requests. Thanks for the tips.
    – paj28
    Feb 26 '14 at 9:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.