Lain Security Policy

Sticky thread is locked. Post collective knowledge on policy, tools to make recommendations for lains.

>Threat: Confidentiality of Laptop Contents may be threatened by a local attacker capable of seizing machine. The local attacker may be an APT with advanced forensic knowledge but has not broken modern cryptosystems. The disclosure that there is an encrypted disk is itself not a problem , plausible deniability is not required. >Security Posture: Mitigation >Policy: Local Storage will be full disk encrypted to prevent unauthorized disclosure of information. >Tools: <Linux luks (Linux Unified Key Setup) - an in kernel open source full disk encryption solution. Allows whole partitions to be encrypted and unlocked via keyfile or pass phrase. Allows more than one passphrase, and modifications exist that allow a dummy nuke passphrase. Does not allow for dummy containers. <Windows Veracrypt - An open source fork of TrueCrypt. Supports full disk encryption for Windows. Allows key files and passphrases. Provides limited plausible deniability by having a dummy file system that can be decrypted. If your threat model includes government action through propetary ISVs you shouldn't be using Windows. Using an open source FDE solution can help migitate that threat by avoiding backdoors written explicitly into bit-locker, but cannot avoid targeted attacks remotely, such as via Windows update, if such attacks exist. <OS X Veracrypt - not capable of full disk encryption. An open source solution that will allow you to create a volume and choose what is encrypted. >Alternatives: <Linux Encrypted File System - ecryptfs allows the encryption of a file system rather than a block device. This allows one to avoid encrypting the entire disk, and to choosing individually what to encrypt. <Windows Bitlocker - A Propetary solution from Microsoft. Its commonly deployed, and well supported, but if your threat model includes the US government, you might wonder if there are not any backdoors Dell Data Safe / McAfee Full Disk Encryption ... - You would be absolutely retarded to use any of these products. They are not well supported. Proprietary. Offline decryption for repair is a nightmere. < OS X File Vault 2 - the default solution, proprietary, does support full disk encryption. Do not use if your threat model includes US government acting through apple. >Advantages: - Local Attacker cannot simply read file system - Local Attacker will have more difficulty locally backdoor OS. However, encrypted boot partitions can be used to trojan kernel for next boot, this can be mitigated. >Disadvantages: -Makes repair take longer if system doesn't boot, and sometimes impossible. - Having your disk full disk encrypted can prevent repair tools from accessing the disk to fix configuration issues, integrity issues that prevent system from booting. For operating systems like Windows 10 that fail updates and don't boot routinely this is nightmerish. -Makes Data Recovery near impossible, and threatens data availability If your hard disk should begin to fail encrypted, you may find yourself trying to restore a backup you don't have. Make sure you make routine backups with full disk encryption to mitigate the enhanced difficulty of data recovery. -Makes operating system minorly slower Now there is a tiny overhead on reading / writing files. Largely unnoticeable. -Because computer is unusable to random stranger, computer will probably be reset immediately if stolen and chances of recovery, and especially recovery with data are slim. (See famous talk about stolen server recovered by dynamic dns and remote access software)

>>6301 Wherever you copied this from, it's retarded, and you're a chucklefuck. Nobody here is going to be "threatened by a local attacker" who is also an APT (the term APT doesn't even fuarrrking make sense in the context of a physical attacker). Nobody has broken modern cryptosystems, which is why they're modern cryptosystems. We don't call KASUMI a modern cryptosystem despite relatively widespread use, because it's broken. In conclusion, just use fuarrrking FDE.

>>6325 >"threatened by a local attacker" who is also an APT (the term APT doesn't even fuarrrking make sense in the context of a physical attacker) Go through a US border, or bring your laptop to china as a business man. >In conclusion, just use fuarrrking FDE. Retarded. Understanding what FDE does, and what it doesn't do is important. FDE can have disadvantages and understand them is important to understanding how to mitigate them. For instance, having a backup plan with FDE is essential if availability matters at all. >chucklefuck You are actually the reason this post in necessary. People ranting about 1 size fits all security technologies without understanding what trade offs are being made misunderstand what security is.