Subject: Re: Improving Security with Encryption

From: "James M. Polk" <[email-masked]>
Date: Fri, 10 Nov 2006 10:49:44 -0600

At 09:58 AM 11/10/2006 -0500, King, Kimberly S. wrote:
> > Fred Baker wrote:
> > What I would suggest is that people encrypt confidential
> > information on their laptops, and perhaps the entire laptop.
>
>I strongly agree and my entire laptop is encrypted.  Perhaps people could
>consider suggesting to their management that data protection is critical and
>disk encryption is a simple effective step.

Is *everything* on your laptop work related, or do you (speaking generally) 
sneek a few personal files on the laptop.

If the latter, what are you plans on transferring that info to/from other 
personal devices, such as a hime computer, a PDA, or another device?

If this policy you suggest is taken only a little bit too zealously, your 
company will mandate encrypting your work files, create and perhaps enforce 
a policy that only work related files are on your work owned laptop, and 
prevent things like synchronizing your calendar on your laptop and PDA, or 
other useful and harmless activities...

I don't like this slippery slope (of my org making this choice)

>Sometimes managers aren't aware
>of the tools (or risks) available and maybe it is up to the technical
>community to inform them and help protect sensitive information (e.g.,
>individuals data, company and client confidential data, etc.).
>
>Kimberly
>
>
>
>-----Original Message-----
>From: [email-masked]
>To: Fred Baker; [email-masked]
>Cc: [email-masked]
>Sent: 11/10/2006 12:34 AM
>Subject: RE: Risk of Laptop Seizure by Customs or Border Patrol Officers ...
>
> >> JORDI PALET MARTINEZ wrote:
> >> http://www.acte.org/resources/press_release.php?id=91
>
>Ah, our brilliant government in its infinite wisdom....
>
>
> > Fred Baker wrote:
> > What I would suggest is that people encrypt confidential
> > information on their laptops, and perhaps the entire laptop.
>
>I would not recommend encrypting the entire laptop. As George Carlin
>would say (*), border service agents with a double-digit IQ and a
>triple-digit income might think that if dude encrypts the entire laptop,
>dude must really have top-secret stuff on it, while the only two
>confidential files dude has on his laptop are the payroll spreadsheet
>showing how much more dude makes compared to his office buddies and
>dude's mistresses phone numbers (one in each city, needs a database to
>keep track of). No need to trigger un-necessary scrutiny: Traveling
>Terrorist's 101: do not look, dress or act like one.
>
>Besides, there are several ways to carry confidential info while flying.
>Here's an example: They'll look at your laptop, but will not bother
>looking at the 4GB SD card you have in your digital camera, which
>happens to be a perfectly good plug-and-pray disk for any computer, PC
>or Mac. I have stored Excel and PowerPoint files both in and out of the
>directories used for pictures and it never bothered any camera I had in
>my hands.
>
>And even if they do look at it, there are ways to embed your
>confidential data within pictures. You need to use a lossless
>compression format such as TIFF. If done correctly, on a digital camera
>with a noisy CCD at high ISO settings, there is no way to find out that
>the least-significant bit of the picture contains actual data. A
>5-megapixel 24-bit picture is 15MB, out of which 1.8MB are useable in
>theory and 300KB in practice. In short: configure the camera to TIFF,
>noise reduction to off, ISO 400 or higher.
>
>Heck, you don't even need a laptop. Just a digital camera.
>
>Michel.
>
>
>(*) Info: recorded _before_ 9-11-01
>(*) Warning: absolutely politically incorrect and rude language.
>(*) If you have a problem with the "F" word, do NOT click the link
>below.
>(*) http://www.youtube.com/watch?v=BZwMz2bsbNY
>
>
>_______________________________________________
>Ietf mailing list
>[email-masked]
>https://www1.ietf.org/mailman/listinfo/ietf
>
>_______________________________________________
>Ietf mailing list
>[email-masked]
>https://www1.ietf.org/mailman/listinfo/ietf

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: [email-masked]
Date: Fri, 10 Nov 2006 17:11:09 +0000

> >I strongly agree and my entire laptop is encrypted.

> company will mandate encrypting your work files,

If your company's goal is to prevent corporate espionage
then this is a rather shortsighted way to do it. If an employee
with such an encrypted laptop is sitting in front of the 
immigration police who ask him for the encryption passwords
then he would be stupid to refuse to divulge it.

A wiser move would be to require all confidential documents
to be encrypted and stored on a server. Before travelling
such documents should be deleted from the laptop. On reaching
the destination, the documents should be retrieved from the
server. This way, if a laptop is lost, stolen, or in the hands
of some police agency in some country or other, there is no
corporate confidential information on it.

And if there is serious risk associated with the confidential
information, whether monetary risk or legal risk associated
with making information public, then this *TRAVEL* rule should
apply to the daily commute as well.

After all, some of you may have noticed this thing called
"the Internet" which makes it easy to move around encrypted
files to any part of the world where a laptop is likely to
travel to.

--Michael Dillon

---

From: Harald Alvestrand <[email-masked]>
Date: Fri, 10 Nov 2006 09:26:45 -0800

--On 10. november 2006 10:49 -0600 "James M. Polk" <[email-masked]> wrote:

>> consider suggesting to their management that data protection is critical
>> and disk encryption is a simple effective step.
>
> Is *everything* on your laptop work related, or do you (speaking
> generally) sneek a few personal files on the laptop.

technology reset:

when you encrypt an entire laptop, that usually means that there's some 
preboot stage that picks up the key from a "secret" place, inserts itself 
as a disk driver, and transparently decrypts everything that comes from the 
disk (and encrypts what goes out).

The encryption doesn't care one whit whether the files are personal, 
work-related or just random gunk off the IETF mailing list.

What it protects against is (I think) people who grab the laptop, pop out 
the disk and try to read it on another device, or without the benefit of 
having cracked the key-hiding code of that particular encryption product.

It doesn't protect you against people who know where the crypt software 
hides the key, but is pretty good against the rest.

<http://en.wikipedia.org/wiki/Full_disk_encryption>

                    Harald

---

From: Russ White <[email-masked]>
Date: Fri, 10 Nov 2006 21:30:26 -0500

> corporate confidential information on it.

I've always believed that the move towards storing tons of stuff on a
laptop is a bad one.... It risks data in multiple ways. I keep virtually
no data on a laptop, and just count on having network access in some way
to get to it, or I store it on a key I keep encrypted and on/about my
person all the time when traveling, or on an encrypted r/w cd or dvd.

There are so many other ways to transport data than on your laptop's
hard drive that I have a hard time making sense of doing so.

Just my 2c.

:-)

Russ

- --
[email-masked] CCIE <>< Grace Alone