Slashdot Log In
TSA to Contractors - Encrypt Your Laptops
Posted by
Zonk
on Wed Oct 17, 2007 12:32 PM
from the probably-a-good-idea dept.
from the probably-a-good-idea dept.
eweekhickins writes "After two laptops were lost containing the personal data of 3,900+ truckers who handle HAZMATs, the Transportation Security Administration has ordered its contractors to encrypt any and all data. 'After the second theft or loss, the TSA conducted an IT forensic investigation that ascertained that the (previously) deleted information could be retrieved if a thief had the proper training. "So even though [there's only a] small chance of [the data being misused], we did notify all affected individuals and advised them of what steps to take to protect themselves, and we mandated that contractors need to encrypt any and all data in addition to any deletion procedures that might be in place," Davis said.'"
Related Stories
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Overheard conversation (Score:5, Funny)
Re: (Score:3, Interesting)
Re: (Score:2)
Not flying or going to an airport since 9/11 (presuming *because* of 9/11's aftermath) as a result of your demands, would appear to border on paranoia in the extreme, however. Someone has your IP address for the message you posted, and has already traced you back. It's in your service provider's info sent to the NSA. You didn't have an https connection, so everyone saw what you
Re: (Score:3, Funny)
Many have been told to backup... (Score:2, Insightful)
I think that even if you force the security measures in place people will always find a way around it. People write their passwords on a Post-in note or tape it to their monitor. These security measures are good but definitely not perfect.
Re: (Score:2)
There, is that good enough for you? I know it sort of slams the users too but what the hell, it is a slow news day.
It's always sad (Score:3, Insightful)
Re:It's always sad (Score:4, Interesting)
It's more likely it was pitched, but either for cost or time, management probably shot it down. Never mind there've been high profile laptops missing all over, like the VA one. Being naive, I would wager that the IT department would like to lock down the systems as tight as possible (I know I would) but are being thwarted by management becaue it'd make things too hard, too different, or cost too much.
It's always after the sole data server blows up that they decide "oh, guess that backup option would've been worthwhile." (Had this happen too. Financial data, customer data, and no paper trail. But the tape drive cost 'too much'.)
Parent
Re:It's always sad (Score:4, Insightful)
If someone needs offline access (for example in a remote location with no Internet access), that is a different story, but in a number of laptop theft cases, there is no real reason the info is physically sitting on the laptop.
Of course, this won't prevent an employee from doing an export of all the tables to their laptop, but having the sensitive data behind a username, password, and a SecurID token means that the losses due to a stolen laptop will be minimal. Add a decent FDE program (BitLocker is decent because it doesn't get in the way of users, provided they can access their user), and a laptop loss can be written off as "just" hardware.
A number of Dell laptops and desktops have the ability to have CompuTrace installed in the BIOS. This is another good tool to help find stolen goods.
By using the tools out there, from WDE, to having data physically residing on a different location (although there are cases where this isn't possible), to CompuTrace, damage done from a stolen laptop can be greatly mitigated.
Parent
Re: (Score:3, Informative)
You can't believe how sad... (Score:3, Insightful)
Yeah, I installed TruCrypt today so I could encrypt my drive yesterday.
Uh, dude, I think you mean "reactive".
Re: (Score:2)
The norm for govt. (Score:3, Informative)
Mod Parent Informative (Score:2)
the govt organizations themselves are too cheap to do security right in the first place,
Most of the orgs comply on paper, but operationally its pretty bad.
and many contractors are too greedy to include proper security measures in their govt projects since those will cut into their profits.
The blame goes both ways. I've been in situations where good security was seen as not necessary by the agency. There is also the nasty proble
Re: (Score:2)
Also think about all the ways some one can get to your data. You have to step up your protection to all of these
Re:It's always sad (Score:5, Funny)
Chris Mattern
Parent
Encrypting Personal Information (Score:3, Funny)
Re: (Score:3, Insightful)
Yeah - "Don't write your encryption passphrase on a sticky note and attach it to your laptop"
Because you just know that'll be the next TSA directive.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Not Enough (Score:5, Interesting)
Either the data needs to be "shredded" [fileshredder.org] or stored in it's natural form on a fully encrypted volume.
Encrypt the drive (Score:2)
Encrypt the drive ... except for a partition or flash module with enough of the OS to get started and prompt for the drive key password.
Re: (Score:3, Informative)
Full Disk Encryption is just that. It encrypts the entire thing and requires pre-boot authentication. Even the OS is encrypted.
this should read (Score:2, Interesting)
Don't forget! (Score:3, Funny)
And it seems... (Score:2)
That problem is it does NOT provide good stego. I've went over that before, but there's a way to prove by contradiction that there is a likely chance of hidden partitions in data.
Re: (Score:2, Interesting)
I'm not as concerned about the laptops being lost as I am about contractors keeping the data on their laptops as long as they like.
Tim
Re: (Score:2)
And I dont see an easy to maintain that kind of security with exception of TPMs. They support remote network control as you describe.
If I was attacking that kind of setup, I'd extract the HD partitions to my emulator (yes, a real ICE) and pro
Re: (Score:3, Interesting)
Next the VM... Yes, you could roll back the clock, but how would one prevent that simple of an "attack"? Record via signed encrypted file when the last time/date access was. Ok.. so now we can just 'freeze' the VM so restart starts with those very files at that
"Only a small chance"? (Score:4, Informative)
You steal a laptop. If you're not a complete dimwit, you first of all check what you got. So you boot the thing up and notice that you have a government laptop in your hands.
Question for 100: Do you want to know what's on it? Let's even assume you don't know jack about computers, but do you want to know what's on the box?
Now, it's fairly trivial to get information out of a hard drive and restore deleted information (unless it's been overwritten, where it becomes less trivial). A halfway informed person with a bit of knowledge is enough, you don't need a forensic expert. All you need is the usual program(s), downloadable at leisure. And presto, instant information recovery.
The question is not whether information can be gained from the laptop, the only question is whether the thief has the brains to use it. That he has access to it without any hassle is a given. The only thing that matters is whether he knows a fence for information rather than just hardware.
And yes, those people exist...
Re: (Score:2)
The question is not whether information can be gained from the laptop, the only question is whether the thief has the brains to use it.
Or the motivation... There is a good chance the thief just took his/her booty to a pawn shop and sold it. The person who ends up buying the laptop from the pawn shop will most likely pop the latest Ubuntu Boot CD in and re-format (only a geek would buy a used laptop from a pawn shop). The laptop could have contained the answer to who really killed Kennedy, but, now it is really gone!
Seriously, the TSA is having a hissy about a few laptops that got stolen, but the reality is that probably hundreds of
Re: (Score:3, Informative)
Re: (Score:2)
And if it's from one of the smart gov agencies that followed policies since the SSA lost some laptops, you may or may not notice that through BIOS it's phoned home provided it's been reported stolen, and you've got full disk encryption on your hands. Have fun!
The real question is why "smart" doesn't seem to extend to TSA and their contractors. Agency I contracted for mandated that over a year ago.
Re: (Score:3, Insightful)
You're forgetting that most smash 'n grab thieves *are* complete dimwits. They're going to take the box to the pawn shop for cash for their next hit of a controlled substance. They couldn't undelete a file to save their life.
If someone has the wherewithal to undelete files and sell the contents to the Russian Mafia, they're not going
Re: (Score:2)
Chris Mattern
Now that got me thinking (Score:4, Insightful)
The data that goes out, why spend incredible efforts tracking every action of the victims in case it's a fraud.. versus, invalidating the data that went out?
Your social security number was leaked because of the government? The government changes your social security number, fixes their data, and the old one remains as a trap waiting for some fraudster wanna be try and use it.
Re: (Score:2)
Because, right or wrong, that social security number is your magic number. It sounds simple to just invalidate it and get a new one. And if it were more like a credit card, it would be that simple. You run the risk of having to update one or two automatic payments out of your account, and that's about it. To get your social swapped, a bunch of gov
Oh, and don't drop big heavy objects on your head (Score:2)
Easy encryption, but not with Windows (Score:3, Informative)
Boot from the CD, and it'll find and load the data you stored. Enter your password (correctly, one would hope) and go. It doesn't get much simpler than that.
Of course, you can't use your insecure Windows "helpers". But if they were *really* concerned about data security... well, I won't go *there*.
Ch-ching! (Score:3, Informative)
Effective solutions? (Score:4, Insightful)
Encryption requiring a simple password:
They key space will be limited making for easy cracking.
Encryption requiring a sufficiently complex password to avoid above:
The password will be too hard to remember so people will write it down... on a sticky note on the laptop.
Encryption requiring an external device to supply complex key:
This will fail because many people will either attach the device to the laptop, or keep it in the same bag as the laptop.
I guess the simple password solution is the best since it would at least require a degree of technical expertise from the thief to get around.
Re: (Score:3, Informative)
Now they have a lot of issues with their implementation currently, but the underlying concept is a good one.
Re: (Score:2)
Now, even if someone has the token and the laptop, they have 3-15 tries to guess the password on the token, and usually that password is 8 characters or more.
Truecrypt! (Score:5, Informative)
You can even encrypt a whole device. If you do that, it just looks like a blank volume and a thief won't even know there is data on the volume to be decrypted.
Re:Truecrypt! (Score:5, Informative)
The biggest thing to remember with TrueCrypt, if you lose the first 1024k or so of an encrypted volume, you have completely lost the volume because the first part contains the encryption key (or keys) for the rest of the data. ALWAYS back up the volume headers (they are encrypted with the same mechanism as the volume itself, so they just need to be stored safely) of all critical volumes.
Of course there will be people saying that "I don't use encryption programs, I have nothing to hide." That is analogous to saying "Don't have a front door as you might has something to hide." Its not the governments these programs are for (most governments can obtain the decryption key via other means including a rubber hose), its thieves. These days, TrueCrypt and other security programs are highly necessary to keep a $1000 laptop from becoming a loss of many thousands in ID theft.
Parent
FDE works too.. (Score:3, Informative)
My gig at I%$&#, they had me write my FDE password down and give it to the nice Systems tech. That way, when I left, they could recover the disk and reissue the machine after the usual shredding and wiping.
Without it, they would have to throw out the drive and buy a new one.
And yes, you need to remember your password. This you write down and leave at home, or with the Keymaster in the office, or your boss.
Honestly, this is not that hard.
Re: (Score:3, Informative)
This is the hardware encryption scheme - supposedly, even if you put the drive in another Thinkpad, that chip has a different hardware key and even the right password won't decrypt. So it encrypts data onto the drive.
Yes, you could send
Re: (Score:2)
Also in Soviet Russia.... they know how to make 'In Soviet Russia' jokes.
Re: (Score:2)
Performance wise, I've not noticed any slowdown (the bottleneck is the HDD rather than the encryption layer.)
Please don't discount WDE programs in general because one of them is underperforming. I have used WDE p