36

A law firm I've been in contact with has recently been broken into 3 times in the past 4 months. In spite of a number of laptops and other equipment containing sensitive information being stolen, the tech support company occasionally doing work for them has done nothing to safeguard against future theft. I proposed installing anti-theft software (such as Prey) and later considered establishing one system as an information-gathering honeypot with hidden keyloggers sending information to a number of email addresses.

All physical security best practices aside, what other measures could possibly be implemented here? These are all Windows systems. I don't doubt the separate incidents are linked and being carried out by connected if not the same criminals.

The firm has already been in contact with the local authorities. However due to a lack of documentation on the stolen items, there are no serial numbers or additional helpful information on the missing devices besides make and model, so recovery seems a dead end but at the least they're aware of the incidents.

D.W.
  • 98,420
  • 30
  • 267
  • 572
Mike H
  • 477
  • 4
  • 4
  • Making the laptops harder to find/steal (locking them away) would probably reduce the number lost per incident, saving on downtime. It may not save on material costs if desks are destroyed looking for them. On the software side you should consider how you can make them as useless as possible to a thief (BIOS boot passwords used to be recommended but can often be bypassed). – Chris H Sep 30 '15 at 12:17
  • 8
    What do you want to do? Stop them being stolen? Stop stolen ones being of financial use to the thieves? Prevent thieves from having access to data on the devices? How much time and effort are you going to have someone spend to try and turn keylogged information into something you can sensibly use to recover the device? Do you plan to recover the devices yourself or try and talk the police into doing it? –  Sep 30 '15 at 12:50
  • 10
    My main approach to gathering information in your place, if you expect another break-in, would be a couple IP cameras. Then if the cops still won't do anything, go to the district attorney directly with the video and your complaint. Nice thing about an IP camera, they can cover or smash the cameras, but they cannot un-send the identifying info. Of course if they are wearing masks, a camera would do no good. But I kind of think masks are more Hollywood than common among actual thieves of this sort. – WDS Sep 30 '15 at 15:01
  • 8
    Judging by your overall description of the firm and their hands-off normal tech operations support, I'm going to guess that they didn't, in fact, have full-disk BitLocker enabled on those machines. Which means that now you and them should be having a conversation about what "incident response" means and how to piece together what confidential client-matter info was on the hard drives so that clients can be properly notified accordingly. Something tells me the firm would probably be quite recalcitrant to do client notifications, however.... Just a feeling... – mostlyinformed Oct 01 '15 at 04:23
  • 5
    This sort of doesn't add up. A law firm ignoring tax law? Do they not have the ability to call the vendor they bought the laptops from and get the serial numbers (the major manufacturers keep track of who buys what serial numbers)? That's of course assuming they don't have shipping labels or invoices that usually list the serial numbers. Plus a loss like this is HUGE for a law firm because of confidentiality. How could they still be working with the same IT firm after the second loss? – Todd Wilcox Oct 01 '15 at 18:16
  • 1
    I would like to mention this talk from Defcon, which has some interesting ideas about the scenario of a stolen laptop: https://www.youtube.com/watch?v=U4oB28ksiIo – L0j1k Oct 01 '15 at 21:09
  • 1
    [Paint them pink](http://www.livescience.com/32701-what-color-car-is-most-likely-to-be-stolen.html). – Federico Poloni Oct 02 '15 at 06:37
  • 5
    Get new lawyers. These people are incompetent. I am basing this on the fact that they don't know the serial numbers of their computers. The first time, barely plausible. The second and third time, not plausible. You don't need a tech support company to write down serial numbers. – Stig Hemmer Oct 02 '15 at 08:48
  • 1
    You should probably do a background check on all the employees. Repeated thefts would make me think you have a bad apple in the bunch, and don't forget the cleaning staff in those checks. – boatcoder Oct 02 '15 at 15:19
  • "broken into 3 times in the past 4 months" [jaw near the floor] is it not worth the money to hire a night time guard and setup cameras? rinky dinky law firm if you ask me. – BAR Oct 02 '15 at 22:15
  • @Mark0978 Excellent point. Just don't give off the vibe that employees are suspect. – BAR Oct 02 '15 at 22:22

14 Answers14

58

Consider getting a software product which fully encrypts your hard drives. Such a software will prompt the user to enter the password used to encrypt the hard drive during boot. Without the correct password, the hard drive (including both the OS and any data) can not be decrypted, the system won't boot and the user won't get any access to the data.

In that case a thief might still be able to sell the hardware by nuking the disks, but won't have access to any sensitive information stored on it.

The default solution for Windows is Microsoft BitLocker, which is already available out-of-the-box in some editions of Windows. There are also other products on the market like Sophos Safeguard or Truecrypt. For recommendations which product to use, consult Software Recommendations Stackexchange.

Philipp
  • 48,867
  • 8
  • 127
  • 157
  • 3
    Yes, this is excellent advice. A primary concern in this case is the theft of information itself, not necessarily the hardware in use. – Mike H Sep 30 '15 at 09:40
  • 8
    Note that at best there are some big questions over Truecrypt. – Chris H Sep 30 '15 at 12:14
  • @ChrisH Good call, especially right now. Truecrypt is mentioned on Twitter the past few hours as having 2 identified critical issues. This one doesn't seem to be a false alarm, though time will tell. – WDS Sep 30 '15 at 14:52
  • @WDS I wasn't even thinking of that, but the blowup a few moonths back. – Chris H Sep 30 '15 at 15:07
  • 9
    VeraCrypt is the still-maintained fork of TrueCrypt and it patches critical security vulnerabilities: https://threatpost.com/veracrypt-patched-against-two-critical-truecrypt-flaws/114833/ – twotwotwo Sep 30 '15 at 19:20
  • Talking of nuking the disks you could also look at something like this:- http://gizmodo.com/self-destructing-ssds-will-nuke-themselves-if-you-text-1640733628 – James Snell Sep 30 '15 at 20:42
  • 5
    But don't put a post-it with the password on your desk ! – Stephane Mathis Oct 01 '15 at 07:23
  • Full-disk encryption plus Yubikey is a good, quite cheap (few tens of dollars or equivalent) way to ensure reasonable data confidentiality in case of physical theft, if data needs to be stored locally. Ideally then one laptop per employee, one Yubikey per employee, and strict instructions to keep the two separate except when they need to interact with each other. (The physical key ring is a good place, as is one's wallet.) Configure one of the Yubikey slots for a static password, use that password to encrypt the disk, and you are mostly good as far as confidentiality in case of theft goes. – user Oct 01 '15 at 13:20
  • 1
    It should go without saying that you should keep robust backups of your encrypted data as well, so that if hardware is stolen, the only real cost incurred is the replacement of said hardware. I've heard that such things can even be insured, but then you'll probably need to start keeping track of serial numbers and stuff... – 40XUserNotFound Oct 02 '15 at 03:00
  • I would not recommend TrueCrypt, have you seen the ancient bug that was just announced? I am almost certain that was not an accident... – BAR Oct 02 '15 at 22:19
15

Rule no.1: Contact law enforcement.

Rule no.2: If the firm itself doesn't seem to care, nor does it want to contact law enforcement, please consider stopping doing whatever business you have with them.

Rule no.3: Think about the attacks in their broad context, and do not limit yourself to technical measures.

Rule no.4: Installing keyloggers is unlikely to be helpful. Instead of preventing theft or uncovering attackers you open wide a backdoor which can be exploited by the attackers.

Deer Hunter
  • 5,297
  • 5
  • 33
  • 50
  • 2
    As regards 1&2, the firm has already been in contact with the local authorities, however due to a lack of documentation on the stolen items there are no serial numbers or additional helpful information on the missing devices besides make & model, so recovery seems a dead end but at the least they're aware of the incidents. At the least I reckon that it'd be an extremely good idea to make note of these details in the relation to the current devices in use, somewhere inaccessible, or even using Prey. Good advice. – Mike H Sep 30 '15 at 09:37
  • 3
    @MikeH - ah, OK. Basically, there's a bunch of extra actions you can take. Beefing up the accounting, of course :), and FDE as per [Philipp's answer](https://security.stackexchange.com/a/101509). Hiring PIs, checking if insiders were involved, that sort of stuff. Adding GPS tracking may be on the menu as well. – Deer Hunter Sep 30 '15 at 09:42
  • 3
    @MikeH When you don't even know the serial numbers of the stolen devices, you might want to work on your hardware configuration management. Always having an up-to-date list of which inventory item is assigned to which employee is very useful, not just in case of theft. – Philipp Sep 30 '15 at 11:44
  • 1
    Sounds sketchy that a business would not have records of their fixed assets. I don't know of a situation in which the IRS doesn't require keeping track of that information. – Todd Wilcox Oct 01 '15 at 18:11
  • 1
    @ToddWilcox - the OP did not specify the country. – Deer Hunter Oct 01 '15 at 19:09
12

If the laptops don't need to be used offline, store no data on the laptops. Use the laptops as thin clients. This can then allow you to require multi-factor authentication, set up access hours, and many other additional improvements over storing the data locally.

thunderblaster
  • 317
  • 2
  • 10
  • 2
    Temporary files can reveal quite a lot, and may still be saved locally in a scenario like what you describe. – user Oct 01 '15 at 13:16
  • From what I understand, something like RDP wouldn't save temp files that could compromise information. Obviously if you are opening a file on a file server in Word on your local laptop, that would be problematic. You'd need to prevent users from doing that and/or just encrypt the local disk anyway. – thunderblaster Oct 01 '15 at 14:07
  • 1
    The RDP/VPN idea is great but would probably annoy non-tech people. – slebetman Oct 02 '15 at 21:26
3

Apart from using tracking software and full disk encryption, the company may invest in educating the concerned people to use their laptops only to connect to virtual private servers (VPS) where they must save their data. That way, if a laptop of a given worker is stolen, no data could be found within it (I take in account the fact you stated good safety practices are known). A similar goal can be achieved if they can invest to buy their own -physical- servers.

3

In the cases of companies with sensitive information on their mobile devices, most companies i've dealt with do not take measure to recover. It is strictly about making sure the devices are useless if stolen. The companies where security really mattered, didn't bother with some of the other suggestions mentioned here, like saving data only on VPS (hard to enforce), BIOS passwords (useless), OS based password/encryption (useless). They just simply had full disk encryption with something like LUKS, which is unlocked by the bootloader. Very straightforward, and effectively bricks the machine if stolen.

You should tell your employer that this is an effective solution, and that you're not in the business of recovery, that should be the insurance companies job. You should let him know that 'honeypotting' could lead to an imperfect solution that causes data leakage. Assuming these thefts are most likely data theft related (repeat B&E, lawyers offices) that should be their first priority.

Zachary Iles
  • 2,181
  • 2
  • 10
  • 9
  • No, LUKS don't brick the machine. It makes data inaccessible, but you can easily reformat the machine. If the machine has its BIOS password set, the harddrive can be replaced with a new harddrive, containing a new OS. Normally, anti-theft in IT-security should be about preventing data compromise, not preventing assets from being used. For securing assets, its better to use a physical security method of lockable racks or security locks or such to prevent theft. – sebastian nielsen Mar 07 '16 at 01:45
3

I feel that you are limiting yourself to the tech side too much. first you need to lock up the laptops at the end of the day in a secure room. I mean secure room as the easiest way to the room is through a locked door which lock can be easily changed. in the room put some sort of security camera for in the case the thief gets into the room. that way you will have an idea of who got in the room.

this change itself would make any thief lot less motivated to get to the laptops. and finally after employ full disk encryption

5hammer
  • 71
  • 4
3

Except the softwares mentioned above, I recommend you to use Remote Administration Tools. They are efficient controlling your computer from whenever in the world you are.

Prey Anti-Theft (free) lacks when it comes to record audio, view webcam, etc.

Thus, you'll be able to monitor your computer, get information about the thief, track its location and so on.

Then, you know what to do :-)

The VaLo
  • 41
  • 2
2

Anti-theft software installed after the laptop is purchased can be bypassed if the thief begins by reformatting the hard drive. If you choose to implement it as part of an overall defense system (as Philipp said you should be starting with encrypting the disk). You'd be more likely to get useful data back if you bought laptops that have it pre-installed and that are using MS provided tools to have the BIOS re-inject it into the OS if the drive is wiped/replaced. They recently came into the news when Lenovo abused them to install crapware, but used as intended they make it significantly more likely that you'll be able to get information that could lead to the laptop being recovered.

Obviously it's not foolproof, if the thief (and all future users) only install a different OS they can bypass it entirely; but typical buyers of used laptops will generally want to keep using what they're familiar with and that's statistically far more likely to be Windows than Linux/etc.

Community
  • 1
Dan Is Fiddling By Firelight
  • 1,382
  • 10
  • 14
2

Bios Level Passwords prevents anyone from even turning on the computer without a password, but this doesn't prevent them from putting the hard drive into an extrenal enclosure.

Bitlocker full drive encryption built into windows prevents them from reading the information entirely unless it is in that computer.

Even with/(out) all of this encryption private, harmful, and secret information should still be stored in an encrypted & password protected folder.

At this point if a person steals the laptop, good luck EVER getting data off of it. Of course this also runs into the problem that now if someone forgets the passwords you up a creek, and so you need to run an in house password and username lookup system that is secure and safe. But that's the nature of security. The more secure you are, the less useable it is.

The most secure computers are buried six feet underground, have no network access, are turned off, and destroyed.

Of course if Bitlocker is overkill, the are other options for encrypting anything.

Another route to go is the thin client architecture that would mean no sensitive data would be stored on the laptop at all. This however requires a server to log into and store files on, and client and server setups, and VPNs that need to be encrypted as well.

Robert Mennell
  • 6,968
  • 1
  • 13
  • 38
1

As others have mentioned, I think you need to consider the physical security first. At the end of each day you collect the laptops back and lock them in a filing cabinet in a locked room.

I would set up an asset register to log the makes, models and serial numbers of the laptops and other IT equipment. This doesn't need to be anything fancier than a spreadsheet. This would give you something to hand over to the insurance company and police in the event of theft.

A seperate spreadsheet could be used to log the users of the laptops. They come to you and request a laptop, you enter their name in the sheet with a datestamp. If the laptop doesn't come back you know who to go and shout at.

If the laptop needs to leave the premise (to go to the courtroom in this instance) make sure the user is aware that they are financial responsible for it if it gets damaged, lost or stolen. People are a lot more careful with equipment if they know they might have to pay to repair/replace it.

When I worked for a tech support company several of our customers were solicitors. They got round the potential data loss issue by having a terminal server and their remote workers could only access email and client information through that. The laptops effectively became dumb terminals. This also meant that all the heavy processing was done on the server so cheaper laptops could be purchased.

Once the physical security is dealt with they can start to consider drive encryption and geo-tracking of laptops. We had great success with services like AirWatch. We only ever had one device go missing with AirWatch installed on it and the field engineer was able to retrieve it with our guidance via GPS. I felt like a spy, it was great! :)

Burgi
  • 436
  • 3
  • 14
1

Firstly encrypt the hard disks to protect the information on the laptops.

You need to make it easier for the police to find the people and easier for put them in jail.

There are modifications to the bios of laptops that make then ping an IP address whenever they connect to a network. You can then look at the source address on the pocket and get a court order for the given ISP to tell you where the laptop is. www.absolute.com is one company that sells such a system that allows an device to be remotely disabled as well as tracked.

I would also think about having alarm that activate a smart water spray when it goes off, that way it is easy to prove that someone was in the building at the time the alarm went off.

Upon activation the SmartWater Forensic Spray System sprays intruders with an invisible liquid, marking their skin and clothing. The liquid can only be seen under UV light, remaining on skin for weeks and indefinitely on clothing. It can be used to link a criminal to a particular crime scene, remaining detectable long after the crime has been committed.

I would be incline to do the above without putting up any warning notices with as few people knowing about it as possible. It is better to put people in jail, then just get them to rob the next office instead of yours.

Ian Ringrose
  • 641
  • 1
  • 4
  • 9
0

What measures to take depends on which of the inconveniences from the theft you want to protect against:

  • Loss of data: Keep backups. Data which exists only on the laptop can of course not be avoided while the laptop is offline. But as soon as it is online with a decent connection the data need to be backed up.
  • Leaks of data: Encrypt the entire disk. If the encryption solution is unable to wipe the keys from memory when the screen is locked or the laptop is suspended, then shut it down completely instead.
  • Financial loss: Losing the hardware means a financial loss. The way to protect against that is by having an insurance.
  • Make it less attractive to steal: There are two approaches to this. Increase the chance of getting caught by tracking the device. Make the hardware unusable to the thief. Making the hardware unusable is something which cannot be done with just software, it requires certain protections built into the hardware itself. My recommended way to measure the value of any measure to make the hardware less attractive to steal is: how much of a discount is the insurance company willing to give you.

One nice to have feature which doesn't fit into the above list is backups that works after the laptop was stolen. While the laptop is working offline and cannot backup immediately, it is possible to create incremental backups which are encrypted and signed, and then store those on the disk. This can be done in such a way that the encrypted and signed incremental backup can be send to a server without needing the disk encryption key to be provided. This is however a fairly complicated feature because it spans areas that are usually kept separate, so I wouldn't put it high on the priority list. In particular there is a significant risk of messing up the security of the disk encryption while adding such a feature.

kasperd
  • 5,402
  • 1
  • 19
  • 38
-1

It's going to depend a lot on the sophistication of the thieves. In addition to the ideas mentioned here, what about a physical tracking device like thetileapp? (I don't know what other similar options exist, as my experience is limited to Tiles.) If you're handy you could possibly hide one of these inside the chassis of the laptop. Maybe slip another in the laptop bag? At $25 a tile it might be a cost effective security measure and then you're relying on something that is virtually undetectable if it's inside the laptop.

Rick Chatham
  • 234
  • 1
  • 13
  • 2
    How would you locate a Tile that is more than 100 feet from a configured phone?? – schroeder Oct 01 '15 at 23:38
  • @schroeder the app has a "I lost it" function that then uses all other phones running the app to search for it dragnet style. Thus it's dependent on other users of the app. – Rick Chatham Oct 27 '15 at 20:40
-2

You can consider modern solutions like UEM (Unified Endpoint Management) solutions. It comes with a whole range of features to manage Windows devices (mobile and PCs) along with other platforms. In your situation, you can always use the remote tracking option or if you are also concerned about the data, you can remotely wipe them too. And also, when you enroll a device in UEM, it automatically captures its details which once exported can also be treated as an inventory of all devices you are managing.

schroeder
  • 123,438
  • 55
  • 284
  • 319
user2546446
  • 1
  • 2
    The OP already mentioned Prey. And UEM won't help if the machine is kept off or the hard drive is removed. – schroeder Sep 26 '19 at 06:33