31–40 of 55 posts
Is anything special even required, as most services have their own encryption? Email, chat, git server... VPN seems only if you use Windows Filesharing? So sharing docs via some cloud service would get around that?
Full disk encryption, close the lid of the laptop when you wander away from it. No need for a VPN if your connection to the email, chat and vcs servers are using TLS. If not, why not? It is the year 2015.
Why not? Because you're leaking DNS traffic. Why not? Because you're disclosing where your company assets are reachable from a public connection. I don't know, but a publicly reachable vcs server that's supposed to contain confidential data makes me shiver.
Isn't that literally the business model of GitHub (apart from the enterprise edition which seems to have mixed reviews), Visual Studio Online, etc.?
I found VPN configuration complicated, routers you have no control over sometimes have problems with VPN bypass, paid service doesn't let it through and so on. Instead I am using the SOCKS5 proxy in OpenSSH together with redsocks and iptables. For me this seems to be simpler and works everywhere. If you have a dedicated IP or your server runs SSLH then you can SSH to port 443 which is rarely if ever blocked. Also, th…
On my work laptop, I have the following (because it's simply harder to do development remotely than it is locally):
- Populated onboarding documents, containing everything you would need to steal my identity. These represent my copy of these contracts.
- A local checkout of our code
- Network passwords (encrypted in the repo, but decrypted locally since I need them to deploy). Working to remove these, but they exist now.
- Complete topology to the entire corporate network.
- Logged in email access with a jucy number of archived emails.
- Logged in to various corporate assets from bug trackers to CMS systems, to git frontends...
Now then, an attacker could certainly grab my open laptop out of my hands, and outrun me, all while keeping the laptop from going into screensaver mode. Not too hard for your average federal arrest, but a lot harder for your average opportunist.
If they get my laptop while the lid is closed, or screensaver active, they get nothing but the laptop. Without FDE, they get everything.
It's all about limiting your attack surface.
> since the connection dropped
SSH connections don't magically terminate, by the way: it requires the server to be configured with connection timeouts, and for your client to be inactive long enough to trigger the timeout.
Otherwise, you can change connections, your computer can go to sleep, you can run on mobile with a terrible connection... all while keeping the same open session.
This means your setup just as vulnerable to pickup-and-run attacks as one protected by FDE, with the added downside of their ability to capture data out of your application caches even if they go the with the opportunistic route.
Can't speak for other OSes but OS X constantly phones home to Cupertino, sometimes not even using encryption, thus leaking data when you're booked into a public Wifi. I literally spent weeks last year grepping the entire Mavericks base installation for hardcoded URLs, domain names and IP addresses and setting up entries in /etc/hosts and NAT rules to hardwire that stuff to 127.0.0.1. I also had to disable lots of Lau…
I don't know how OSX works, but can't there still be addressed you missed that are hiding in the proprietary code?
Also, if you are this worried about security, wouldn't you be better off just using a free OS?
Some others have provided their inputs, my one is just short: take your devices with you, all the time. Yes, that includes the quick toilet break at starbucks. I can't remember how many times I heard total strangers asking around "can you look after my stuff quickly?". You can do that for your beach towel, but not for your devices.
Some others have provided their inputs, my one is just short: take your devices with you, all the time. Yes, that includes the quick toilet break at starbucks. I can't remember how many times I heard total strangers asking around "can you look after my stuff quickly?". You can do that for your beach towel, but not for your devices.
Provided that you lock your device before you leave, have the disk encrypted and do regular backups, what's the problem here?
Full disk encryption, close the lid of the laptop when you wander away from it. No need for a VPN if your connection to the email, chat and vcs servers are using TLS. If not, why not? It is the year 2015.
Why not? Because you're leaking DNS traffic. Why not? Because you're disclosing where your company assets are reachable from a public connection. I don't know, but a publicly reachable vcs server that's supposed to contain confidential data makes me shiver.
Can't speak for other OSes but OS X constantly phones home to Cupertino, sometimes not even using encryption, thus leaking data when you're booked into a public Wifi. I literally spent weeks last year grepping the entire Mavericks base installation for hardcoded URLs, domain names and IP addresses and setting up entries in /etc/hosts and NAT rules to hardwire that stuff to 127.0.0.1. I also had to disable lots of Lau…
I don't particularly have any security measures other than a secure password, full disk encryption and locking the screen after a few minutes. If you are taking a device outside of the office (e.g. to take home to work over the weekend) you should be using those anyway. Pretty much all the services (even internal systems for staff only) I interact with are available publicly and have HTTPS, so using a VPN isn't reall…
> using a VPN isn't really going to change much I disagree, using a VPN on open wifi protects against HTTP downgrade attacks, weak cypher compromise, replay attacks... HTTPS for most sites is just not as secure as it should be. It also masks your traffic so outsiders can't even see what servers you are accessing, or how. Wrapping the traffic in a VPN and securing access to your internal assets to office and VPN IPs o…
Can't speak for other OSes but OS X constantly phones home to Cupertino, sometimes not even using encryption, thus leaking data when you're booked into a public Wifi. I literally spent weeks last year grepping the entire Mavericks base installation for hardcoded URLs, domain names and IP addresses and setting up entries in /etc/hosts and NAT rules to hardwire that stuff to 127.0.0.1. I also had to disable lots of Lau…