1. Out of sight, out of….. control?
The enhanced risk of teams away from the office
Securing the Law Firm
February 13th 2013
Martin Baldock

2. What is Security – reminder Pre-Travel security
Agenda
What is Security – reminder
Pre-Travel security
In-country physical security
In-country electronic security
Security of meetings
Secure telephony
Post-travel security

3. What is Security?

4. What is Security?

5. Pre-travel

6. In-country physical security
Physically protect equipment
Avoid confidential conversations in hotel rooms
Computer monitors
Code names – agreed at briefing
Electronic eavesdropping, avoid using identical routes
Nondescript carrier bags

7. In-country physical security
Diagrams and analysis on walls
Access to Project rooms
Clear desk policy
Waste
Shredding
Backups
Do not discuss the project in public

8. In-country physical security
3rd parties
BAD
GOOD

9. In-country electronic security
Turn laptops off
Power down properly, un-mount encrypted volumes
Use multi-factor authentication
“thin client”-type devices
Avoid using public Wi-Fi connections (e.g., hot spots)
Always use an encrypted VPN/Citrix-like solution to access the Internet

10. In-country electronic security
Do not reproduce confidential documents on machines that are not under your control, this includes copy and fax machines in hotel business centres.
Do not lend or borrow an electronic device from anyone (including the client).
Avoid local purchases if possible
Use a surge protector in conjunction with a laptop power supply
BYOD

11. Meetings

12. Meetings Location of meeting rooms
Remove all electronic devices from meeting rooms
Consider Technical Security Countermeasures (i.e., bug-sweeping) in high-risk countries
Conference calls
Flip charts
Hand-outs
“Need to know”

13. Secure telephony Protect mobile phones including SIM card
Use Blackberries for calls, and SMS
Passwords and auto-delete
Turn off Wi-Fi and Bluetooth
Do not load non-approved applications
Turn off mobile phones (remove battery) when in transit
Beware that phone calls may be monitored
Eavesdropping and shoulder surfing

14. Post-travel Forensic examination of laptop activity
Forensically wipe hard drive before reconnection
Data retrieval
Debrief staff returning from high-risk countries and document anomalous incidents
Maintain a database of risk information by county/client/project