perfect security or security overkill?

i havent done this but i want to.

first off obviously i have a cable lock mounting the laptop to my desk which will stop it from being stolen quickly while it is in my house but this is useless while im traveling.

first level: bios password 8 digit alphanumeric which is changed daily. i want to set up my bios so that after 3 attempts the laptop cannot be powered on for 24 hours to stop any brute force attacks but for now i have to stick with having to turn it off and back on after 3 failures which will slow down a pure force attack.

second level: a USB 256meg Keyfob must be inserted before attempting to power on or when you do power on you are taken to a fake bios password screen which does nothing but print wrong password no matter what you put in. (which goes along with the 3 atempts in 24 hours)

third level: if the proper keys are not held down after boot a fake Lilo boot loader will come up and take you too a fake log in screen again here it will print wrong password no matter what you put in.

fourth level: all files are encrypted with 512bit PGP at least 5 times

fifth level: this goes back to the second and third level, while the fake screens are up the computer will run a small program that does nothing but run shell as su root, cd then rm -rf * and write garbage over everything a few dozen times.

is this too much or is it perfect?

Hi, neither :D

have a look at my tutorial on Windows Pc Data Security.

You have forgotten the bit of software that phones home if your PC is stolen :)

Cheers

Id say it depends on a a few things. What is your overall goal? Are you trying to prevent your laptop from ever being stolen or are you trying to protect the data from ever being compromised?


If I cut your cable lock, wipe your drive and bios I have my own new laptop.

But you do seem to have overkill on being able to login. One thing Id recommend is maybe not to change the bios password everyday and just change it at random times that do not follow a pattern.

The phone home thing that Nihil said sounds like a good idea. If youve gone this far Id say add some kind of GPS device so that you can track your laptop if it is stolen. And I would not recommend the fifth step, why wipe the drive if every file is encrypted 5 fold.

Hmm...

Whether that is 'perfect' (or really good at least) - or 'overkill'... I think that would be easiest determined if we knew what you intended use of the laptop is.

For example - if its a 'gaming' system, I'd say thats a bit of overkill to use to protect your saved game files...

RRP

i dont give a damn if they steal the thing i just want my data to be secure.

i got a lot of **** on here that if anyone was to get ahold of i could be royally screwed.

hell im running XP now and i do a weekly delete and reinstall just because im paranoid.

With Windows you could simply put the computer in a domain and don't cache user accounts or profiles. This alone would make the system more secure than what you've got with FAR less trouble.

For linux, you can just store all documents of any value on an NFS and make sure to to dump the swap on power down and of course don't store NFS authenitaction data on the laptop.

catch

Do you dual boot?

or are you just palnning to switch over to *nix?

Id also say a weekly reinstall insn the smartest idea unless youve got all patches on a disk and you install with not network connectivity

Pirogoeth,

If your only concern is security of your data, you might do well to have a look at my tutorial on Windows PC Data Security that I posted today. Some of it might be relevant?

If you have a need for very secure data you should not be storing it on a laptop. A DVD re-writer might do the trick as you can get 4.7 Gb on a single disk. Just make sure that it is strongly encrypted with strong passwords?

Cheers

Edit:
overkill....way too much overkill. If you have stuff that is that sensitive you shouldn't have it on a laptop. (encrypted 5 times with 512...come on).

It's really close to the border of overkill and retarded. Use a external HDD (usb pen thing if it's big enough) and keep it secured. Physical security is number 1

seabass

i personally think some of it is overkill from what your objectives are.

Changing the bios password daily might be a problem cos you might forget which one it is since you changed it so often. Also it wastes too much time changing it that often. this might result in you using simple passwords so you can remember them easier which means that they become easier to guess. Better to change maybe weekly, 2weeks once or monthly or like one of them suggested randomly.

fake boot screens not really much use cos if I already got past the bios password and realise that i cannot get thru the boot screen then I'll just remove the hard drive and put in another system as secondary

The encryption would be good as this would prevent me from doing what i said above too easily. But depending on your sensitivity of the data then your need o decide on how many bits to use in encrypting. dont go too overboard.

finally, if your data is really that important dont store it on a laptop unless you absolutely have to. laptops are not as physically secure as a desktop.

There's no such thing as "perfect" security or "overkill" when it comes to computer security.

Quote:

---

Originally posted here by amorphous
There's no such thing as "perfect" security or "overkill" when it comes to computer security.

---

"Perfect" and "overkill" are such vague terms, security is overkill when it interfere's with user functioning at an unacceptable level.

I think perhaps the original intent of this post is one of two things:

1. To brag (?) perhaps and impress all of us with his um... security, though the system is not as secure as it could be. (see my post above) ("Perfect?")

2. Because this level of security is interfering with his functioning at an unacceptable level and he is looking to see if it would be ok to detune it. ("Overkill?")

Again I will state to the original poster, all the boot crap is silly, an attacker will just yank the drive first, I know I would to ensure it is in a controlled environment. And encryption is always less secure than just not storing any data on the system, plus this deals with the third point of the security triad that you have missed, Availibility. That data is not availible if you are storing it on the laptop and the lap top is stolen.

catch

#1 if you read through you will notice that it says that i havent done it but would like to, so theres nothing to brag about.

#2 again i havent done it so theres nothing to interfere with my daily usage

and for #3 again i dont care if it is stolen, i just dont want anybody to beable to access that drive.

Quote:

---

Originally posted here by Pirogoeth
#1 if you read through you will notice that it says that i havent done it but would like to, so theres nothing to brag about.

#2 again i havent done it so theres nothing to interfere with my daily usage

and for #3 again i dont care if it is stolen, i just dont want anybody to beable to access that drive.

---

Then why did you post?

I have answered your question, don't store data on the computer, store it on the network.

catch

Look at it this way:

- All of your bios screen measures are essentially futile if someone removes the HD and puts it in another machine
- You say "PGP encrypt all files" - but most programs cannot work with pgp encrypted files, hence they need to be temporarily decrypted. They then hang around in slack space and remain there after power off
- Having more than one layer of encryption is pretty pointless. Nobody is going to attack the key anyway.

The system is only as good as its weakest link... who are you trying to protect it from?

Most attackers would stop if they didn't know what was in there - for this reason you should probably use an encrypted container file, which prevents the filenames or other attributes from being seen without the key. Also you might want to consider using steganography to further hide your stuff.

They can't attack it if they don't know it's there.

But more seriously, it is very difficult to prevent bits of sensitive files ending up in the registry, the swapfile, or temporary space.

Overkill or perfect? I'm thinking yes to overkill because it's just too much trouble and definately not perfect because you failed to mention physical security....what gets me is that you change your bios password every single day but you can only try 3 times before it locks you out for a day....what happens when you forget your password? I change my passwords once a month and then I have trouble remembering the new for about a day, so it just seems like it's too much trouble. So there's MHO :D

how about this.....

encrypted hard drive

how about this...

store your kiddie porn somewhere else. Seriously, what could be so important that you have to go through all those rediculous motions just to keep it safe. This thread ought to have been in tech humor so we could all contribute ideas to building a rediculously "secure" system.

That's not a bad idea....somebody should make a thread like that in tech humor! I don't know enough to get it started though, so it's definately up for grabs. Whoever can take it and run with it should do it. Seriously though, I'm wondering what is so important that you'd need that much security....if I were a hacker (and I might be but I'd never say that...:p) and I ran into that much security on a computer, I'd steal it and then try and find whatever I could just because I'd be so curious... Ever hear the phrase "hidden in plain sight", well it isn't false.....security should be as small of a hassle as possible but also as strong as possible, and the way you've got it set up is far too much of a hassle and not as simple or as strong as it could/should be. I like Roadclosed's solution, but seriously, you shouldn't have anything extremely important on a laptop.

depends on what you mean by "security" if you just don't want anyone else to get your data, that'll do it, if you want to make sure your data isn't lost, its overkill, in fact, if you go that overboard to protect your data, i can almost guarentee you'll lose it. if not to a theif, to a stupid accident. good luck.

I'm still seriously hope this is a joke. I couldn't stop laughing. There's a line where overkill starts, this post is miles beyond overkill. I can see security, yes, but this is retarded.

Pirogoeth: You say this doesn't affect your daily functionality? I have issues with changing my passwords once a month on certain systems...Unless you tell someone your password, changing your BIOS password won't make a difference. If it's stolen, they have it, they can sit and try and crack it forever, if it's not stolen, you have it and it's in your possession. Either way you are the only one who knows the password. Having to have a specific combination of keys held down, again an inconvenience. I normally hit my power button and walk away from my PC, as do several people I know. Locking down your laptop in your own home? Go commit yourself, get some help. 5 x 512 encryption?? useless and rediculous. I agree with whoever mentioned the kiddie porn, you have something highly illegal on there and are worried about being busted if you are going to all these trouble. I'd suggest stepping away from the computer, picking up the phone and calling the men in white.

Amen

Where's the elecric shock keyboard, the self-desroying hard drive (not rm -rf * :) ), the auto destruction if you havn't logged in within an hour, the honey pot, the flame thrower, the bullet proof screen and case, the randomising of the keyboard layout and the requiring of 100% perfected typing!

Maybe just a little overkill. You know british spies leave there laptops in taxis (we will of cause deny this) and do you see british nuclear weapons heading of in to the sky.

you forgot the laser in the web cam and the C4 under the mouse pad if you don't point at the right things in the right order :D

why not just post an armed guard? how about putting the laptop in a vault 15 miles under the surface of the earth? why not just explode the whole thing, that'll make sure noone ever gets your data!

Forget all of the crap you are on about.

Take the HD out of the laptop & carry it with you at all times (They are smaller than a ciggarette packet)

It'll be much less hastle than pressing <Left CTRL> <Right Shift> <F1> <F12> <d>[i]<c><k><h><e><a><d> while booting and changing your password every day and whistling dixie with a penny whistle up your a$$

Unless of course you are screwed if you are caught carrying your HD by the Feds. In which case you're doing something very naughty.

Get [real|help|a life] numbnuts. Who the ***** do you think you are trying to impress

Prove me wrong, what are you storing that's so important. Perhaps the JupM folks should be digging out the logs & handing them over to the feds.

Steve

Jnet, you forgot the 'Cone of Silence' from "Get Smart"

It hurts! oh it hurts! oh my, I think I was laughing a little too hard. K, now that I need to get arm-rests for my chair so that I don't fall out of it laughing so hard, here is my 2 cents, lol.

You want perfect security. Alright, understandable, I'm sure we all do. ;) Want a sure-fire way that its secure? Fine, here it is:
1) Don't use a laptop and carry it around with you. Its like a wallet, you can get mugged on the street too you know.
2) Build a concrete bunker (walls at least 6 feet thick) about 150 feet below the surface. Fill it with non-perishible food items, air-recycling systems (biological works well) and your own power supply. (In event of nuclear attack, you should be ok, except for radiation of course)
3) Don' tell anyone about his laptop (oh wait, too late...) :D
4) Secure the entrance to this bunker using military level tactics. Start with cameras, lots of them. Then add land mines all over the place, and Claymore's triggered by motion tracking systems. Don't forget the lasers, they are a must-have.
5) Put the laptop in a different bunker, 100 feet below the first one. (250 feet under earth) with same security. Also add some conventional nuclear warheads in the tunnel just in case...
6) Have everything run off biometrics. (Doors, etc) Hey, its only you protecting this, right?
7) Use tempested screens, never know who or what may be watching. (Don't forget the tim-foil hat for your head, aliens could be listening to you think of your next BIOS password)
8) Every day, take your old drive and grind it down to dust, and melt it back into its elements, and then freeze them at absolute zero. (which is -273.15*C)
9) Run away (the elements' nucleous will stop moving and collapse, causing a black hole which will suck up the earth in about 1000 years)
10) Don't buy your parts, make them from their elements. (How do you know your computer wasn't hard-wired to transmit all your data into space for the aliens to read? hmmm?)

Follow those 10 steps and you will not only kill yourself and everyone who comes near, but you could theoretically erase the Milky Way. (with the black hole in a few million years) At least your kiddie porn will be safe! (Though, no more will be produced. My, what a shame that would be.)

Is the above too much? Maybe, here are some alternatives:
http://www.tworivershospital.com/
http://www.ynhh.org/ynhph/ynhph.html
http://www.austenriggs.org/ <-- Hey, its non-profit!
http://www.lasencinashospital.com/
...

Get the point? So now that I'm done making fun, I'm going to go live my life without worry of a supernatural race stealing my work from under me, or a government for that matter. (ever try sitting on your laptop? Who would ever look there!) <<crunch>> hmmm....

lol, I will be quiet now,

Dave

first off its not kiddy porn its my files from work.

i usually take my work home with me and i really dont need anything i have on here to get out to anybody.

*Thread moved from *nix security to Misc security (I didn't even realize this wasn't related to *nix specific for some dumb reason -- not enough caffeine this week I think)*

As for whether it's "perfect" or "overkill", it doesn't matter what the opinion is here. The question is "does the countermeasures you are putting in ensure that the asset is protected"? Based on what you wrote at the beginning, I'm inclined to say yes and no. You do protect your data to a degree but you state over and over again you don't care whether the laptop is stolen. The problem is, if the laptop is stolen, then someone could get physical access to the HD and find a way in (there always is a way in.. just because no one here knows about it doesn't mean it doesn't exist -- sorta like a Schroedinger cat scenario).

Some of the suggestions, aside from the comments, remarks and jokes, have some validity like encrypting the whole drive. I'd almost suggest ensuring that your drive only works with that specific laptop (there are some manufacturers like that. I believe Panasonic is one and IBM is another). You may want to do some searches for military level of data protection as this may be more along the lines of what you are looking for. XP isn't bad but even when joined to an AD domain there are ways to by-pass the security of that.

There is, however, a fine line between useability (being able to alter the data) and security. (There is a triangle concept to this: useability aka ease of use, security and stability -- OSes today can only do 2 of 3 at any time or so I've been told).