1. Laptop Security SIRT IT Security Roundtable Harvard Townsend IT Security Officer harv@ksu.edu May 2, 2008

2. Laptops are risky business… 2

3. Agenda Physical security Protection while traveling Information security Recording identification information Tracking and Recovery software Wireless security Public WiFi hotspots Home wireless VPN service Useful freeware tools demod throughout USB thumb drive security 3

4. 4 Physical Security – Theft Prevention Never leave unsecured laptop unattended Lock your doors (reshall room, apt., office) Lock it in a cabinet Use a locking security cable Room/office Hotel room Public locations Conferences, training sessions Cost $15-$50, combination or key lock Use strong password on all accounts

5. 5 Traveling Dont let it out of your sight when you travel Be particularly watchful at airport security checkpoints Always take it in your carry-on luggage Never put it in checked luggage Use a nondescript carrying case Be careful when you take a nap in the airport Dont leave it in view in your vehicle Dont trust the trunk - remember the quick release lever inside the vehicle?

6. 6 Information Security DONT store confidential data on mobile devices If you must, encrypt it Whole-disk encryption best File or folder encryption reasonable Demo TrueCrypt (open source, Win/Linux/Mac – http://www.truecrypt.org ) http://www.truecrypt.org Beware of managing encryption keys Work with temporary copies on the laptop – keep original file(s) on secure server Backup data regularly Imaging is a lovely tool Diligently manage the security of the device (patches, antivirus software, firewalls, etc.)

7. Finding Confidential Data Dont assume you dont have any confidential data on your laptop Spider from Cornell useful for finding confidential data http://www.cit.cornell.edu/security/tools http://www.cit.cornell.edu/security/tools Searches files for SSNs and credit card numbers Lots of false-positives but still very useful 7

8. Preventing Recovery of Deleted Files Deleted files easily recovered Even after you empty the Recycle Bin Eraser freeware tool to securely delete files (http://www.heidi.ie/eraser/)http://www.heidi.ie/eraser/ Erase Recycle Bin Erase a file instead of delete it Erase free space on hard drive Erase a USB flash drive Media Sanitization when disposing media 8

9. Record Identification Information Record make, model, serial number Take pictures of it Label it with ownership and contact info Engrave cover Tamper-proof asset tag Write on it with permanent marker Distinctive symbols, art Record network MAC addresses 9

10. 10 How To Find Your MAC Address In Microsoft Windows XP/Vista Get a Command Prompt window Select Start, then Run, then type cmd.exe In the command prompt window, type ipconfig /all Look for the Physical Address, which is the MAC address For other operating systems, see http://www-dcn.fnal.gov/DCG-Docs/mac/index.html http://www-dcn.fnal.gov/DCG-Docs/mac/index.html

11. 11 MAC address

12. 12 Tracking & Recovery Software If stolen, the computer contacts the company who traces it and contacts law enforcement to recover it Computrace LoJack for Laptops from Absolute Software (www.absolute.com) is an examplewww.absolute.com Pre-installed in BIOS on many laptops Dell HP Have to buy the license to activate Costs about $30-$50 per year

13. 13 Wireless Safety K-State, home, hotels, public hot spots Rule of thumb – FEAR WIRELESS! K-State information: http://www.k-state.edu/infotech/networks/wireless/ http://www.k-state.edu/infotech/networks/wireless/ General wireless security: http://www.onguardonline.gov/wireless.html http://www.onguardonline.gov/wireless.html Wireless terminology: http://www.onguardonline.gov/wireless.html#glossary http://www.onguardonline.gov/wireless.html#glossary

14. 14 Wireless Safety Use encryption WEP (weak) WPA (strong - coming to campus soon) VPN Dont work with sensitive data in public hot spot

15. 15 Wireless Safety Securing wireless at home http://www.k-state.edu/infotech/news/tuesday/archive/2006/10-24.html#sectip http://www.k-state.edu/infotech/news/tuesday/archive/2006/10-24.html#sectip Use strongest encryption possible – WPA2 Restrict access to specific computers by MAC address Change default settings Admin password for configuration interface SSID Do not broadcast SSID

16. 16 Default SSID No Encryption

17. 17 Default SSID Strong Encryption Weak Encryption (WEP)

18. 18

19. 19

20. 20 Virtual Private Network (VPN) Encrypts all network traffic between your computer and the K-State border Makes your computer appear to be on campus to get access to restricted resources Does NOT necessarily encrypt everything that goes to the Internet (split tunneling) Also does not encrypt traffic on campus

21. 21

22. 22 Virtual Private Network (VPN) Must install VPN Client software Information and software available at : http://www.k-state.edu/infotech/networks/vpn/ http://www.k-state.edu/infotech/networks/vpn/ Cannot use it on campus yet (to secure your wireless, for example); will be able to soon. If can get to Internet but not K-State, modify the Transport configuration: Enable Transparent Tunneling IPSec over TCP

23. 23 Disconnected Connected

24. USB Flash Drive Security No confidential data! Too easy to lose, easy target of theft Dont use it as a backup device Erase files so they arent recoverable Encrypt files on it with TrueCrypt or - Encrypted USB flash drives Ironkey very popular - https://www.ironkey.com/ https://www.ironkey.com/ View demo? 24

25. 25 More Information… K-States Mobile Device Security Guidelines: http://www.k-state.edu/infotech/security/mobile.html

26. Whats on your mind? 26