Keeping Laptops Secure: Solutions

1
Keeping Laptops SecureSolutions
Defense Team

• Mike Delahunty
• Bryan Lutz
• Kimberly Peng
• Kevin Kazmierski
• John Thykattil

2
Agenda

• Real world analysis of laptop security
• Four cornerstones of secure computing as they
  relate to laptop security
• Confidentiality
• Authenticity
• Integrity
• Availability
• How can we apply these cornerstones to ensure
  laptop security?

3
Real World Balancing Cost and Risk

• The greater the security risk, the greater the
  cost to mitigate
• Software and administrative costs
• Some laptops need more security than others
• Bank employees laptop must be very secure
• Financial data could be compromised
• Government employees laptop must be very secure
• Public records could be compromised
• College students laptop might not need as much
• MP3s and videos could be lost

4
Real World Business/Legal Consequences

• A survey of almost 500 IT professionals in 2006
  revealed that 81 percent of firms lost machines
  containing sensitive data last year.1
• Loss of laptop containing personal data belonging
  to the public can lead to
• Financial loss to those affected, and the company
• Stolen identities of those affected
• Lawsuits from those affected
• Loss of customers
• Lowered public perception of company

5
Real World - Feasibility Analysis

• Companies must dedicate appropriate resources to
  maintain a sufficient level of security for
  laptops, based on their accepted level of risk
• Ranges from 10s to 100s per laptop
• IT personnel to administer laptops and keep them
  secure
• Employee training on security
• Having the appropriate level of laptop security
  should always be feasible, or the company is not
  doing their due diligence.

6
Solutions to Ensure Laptop Data Confidentiality

• Laptop Data Encryption
• Two Types of Encryption
• File
• Full Disk (Preferred)
• Most Encryption Products are FIPS Certified
• US Federal Information Processing Standards
  (FIPS) certification from the National Institute
  of Standards and Technology (NIST), which
  verified the encryption algorithms in the
  products as conforming to the Advanced Encryption
  Standard (AES) algorithm

7
Case Study BitLocker

• Microsoft Product with Windows Vista
• Targets the Lost Laptop
• Encrypts operating system volume on a sector by
  sector basis
• Two Layer Approach
• Cipher Layer Well-Established Cipher, AES in CBC
  mode
• Diffuser Layer Unproven algorithm premise is to
  make manipulation for authentication attacks
  harder

8
Case Study BitLocker Cont.

• Premise/Design Approach
• Software Based Attacks Most Prevalent
• BitLocker does not require user to enter special
  boot password or use boot SmartCard or USB device
• Hardware Attacks Rare but Supported with TPM Chip
• Seal/Unseal Function used to encrypt key which
  can only be decrypted by same TPM chip other
  OSes can be booted and fully functional, but
  drive cannot be read.

9
Case Study BitLocker

• Secure Boot Process
• If Attacker has access to ciphertext, and
  modifies it to create weakness in the normal boot
  process
• Authenticate Data From Disk
• Poor Mans Authentication trust that changes in
  ciphertext do not translate to semantically
  sensible changes in the plaintext
• 512 to 8192 byte block cipher
• If attacker changes any part of ciphertext, all
  plaintext in that sector is changed randomly

10
Solutions to Ensure Laptop Data Confidentiality

• Physical Security
• Keep Devices in Safe Locations
• Lock them up
• LCD Privacy Screens
• Dont Display Confidential Documents in Public
  Areas
• Lock Down Ports USB, IEEE 1394, etc.
• Exploitation of Legitimate Forensics Tools

• Use TPM Chip to thwart hardware attacks

11
Authenticity Solutions

• Make it difficult to guess passwords and account
  names
• Disable well known accounts such as guest and
  administrator
• Disallow passwords that contain login names,
  dictionary words, or simple variants of previous
  passwords
• Require long passwords with a mix of characters,
  numbers, and symbols
• Use systems that employ SHA-512 or MD5

12
Authenticity Solutions Cont.

• Disable access to I/O ports
• Popular vendors of security products offer
  software that blocks the use of removable storage
  devices and media. This can prevent theft of
  data through USB devices or booting alternate
  operating systems on CD.

13
Authenticity Solutions

• Prevent users from connecting to rogue access
  points
• Host-based Require the use of secure tunnels
  whenever using any connection outside of the
  company. VPN clients can be launched at startup,
  however this can lead to connectivity problems.
• Network-based Employ software that detects and
  shuts down rogue access points installed within
  the companys network. An example would be
  RogueScanner, which is an open source tool for
  detecting rogue devices.

14
Integrity Solutions

• Do not give laptop users administrative rights
• Prohibits the installation of unapproved software
• Most malware / spyware exploits administrative
  privileges to install without user knowledge
• Provides greater stability - extraneous software
• not running in the background
• Laptops run more efficiently and quickly
• Less need for maintenance
• Only allow network administrators to install
  approved software
• Have a standardized, approved laptop image

15
Integrity Solutions Cont.

• Do not allow laptops on the network with expired
  Virus definitions
• Use a product such as Cisco Clean Access to place
  the laptop on a quarantined subnet upon first
  connection, download current virus definitions,
  and grant access once the laptop is in compliance
• Do not allow laptops to use unsecured wireless
  networks
• Enforce minimum requirements for wireless access
  using group policy or similar
• Do not allow open access SSIDs or WEP

16
Retaining Availability

• Availability - The ability to use the
• information or resource desired
• A loss of availability is a loss of data
• Logical Prevention
• Data redundancy
• - Ex Oracle's Data Guard
• Virtualization software
• Regular backups to
• corporate network
• Physical Prevention
• Toughbook laptops

Oracle's Data Guard
17
Retaining Availability Cont.

• Cost (per 100 users)
• Data Redundancy
• Oracle's Data Guard - 6k (enterprise license)
• Virtualization
• VMWare's bundle pack - 15k for 100 Virt.
  Machines
• Toughbooks
• 3x over standard laptops
• At 50 enterprise discount 100k for 100 users
• Simple data redundancy through server backups is
  most cost effective. However, high availability
  has its drawbacks.....

18
Retaining Availability Cont.

• Risks
• High Availability comes at a price
• Performance synchronization for backups,
• loading virtual machines, n/w latency
• Deployment costs, training, personel
• Feasibility
• 99 uptime 8,649 hrs/yr
• or 87 hrs downtime / yr
• If 95 uptime is good enough,
• Gartner suggests doing nothing.

Source Gartner Research
19
Laptop Security Solutions - Conclusion

• There is no silver bullet product that covers
  all areas of laptop security
• Use a combination of products to achieve your
  optimal level of security
• Keep the balance between usability and security
• Employees must be able to work effectively while
  remaining secure

20
Questions?