Ask HN: How Do You Maintain Security When Working Remotely?

Having worked in an enviroment with people traveling all over the world to conferences, this has happened countless times, although it is much more likely something will be forgotten, or lost, rather than stolen when on the road. Nothing magical, and all common sense, just try to limit your exposure. Here is a quick list:

  - VPN (no split tunnel)
  - 2FA
  - loner laptop pool (with base OS and their presentation)
    - do not take sensitive data off-site
    - encrypted hard disk
    - antivirus
    - screen locks after X minutes
  - let office know if something happens (lock out accounts)

Operate from the standpoint that this is going to happen. Work to limit your exposure. You really want to separate your work and personal life as much as possible, by using two computers, as your personal habits, can have big impacts on your work. I know this is not really what you wanted re: working at Github, but I think most of this still applies. I think a lot of opsec applies to this two.

At a previous job (security company) we had an extensive ~/.ssh/config and would forward anything back through a gateway to get at any internal data.

We were pretty much alway connected to the gateway and would used the SSH SOCKS5 proxy feature to get back to any webapps in development and staging staging webapps, code review etc.

To remove anyone from the system we would simply remove their keys/lock one account on the gateway.

Sometimes a bit annoying having to make sure your SSH connection is up all the time but pretty simple to maintain.

Disks encrypted with Full Disk Encryption of course so no worries when laptops get stolen.

I found VPN configuration complicated, routers you have no control over sometimes have problems with VPN bypass, paid service doesn't let it through and so on. Instead I am using the SOCKS5 proxy in OpenSSH together with redsocks and iptables. For me this seems to be simpler and works everywhere. If you have a dedicated IP or your server runs SSLH then you can SSH to port 443 which is rarely if ever blocked.

Also, this allows for easy bastion hosts. While some tutorials still miss it, ssh has -W for 5+ years now and it makes creating bastion hosts even easier than when you needed nc in there. Hire a cheap physical server, put OpenBSD on it, run OpenSSH and absolutely nothing else. Firewall off everything from the sensitive servers except this server and there you go. Of course the bastion host does not have any credentials on it, agent forwarding is your friend.

Put your SSH key on a Yubikey NEO, the NEO on your keychain and never ever ever depart with it. Make it a habit not to be plugged into your laptop more than for the few seconds when actually log into a server. Stealing your laptop is pointless now.

If you work remotely then the exposure to social engineering is bigger as all chat facilities become an attack surface. Practice. Create a Skype account with a disturbingly similar screen name to your own Skype account and try to coax passwords out of your colleagues. If there are no static passwords to be had then you automatically win.

To me, full disk encryption was always of dubious value. You are sitting in a cafe someone walks in and suddenly grabs the laptop and runs out the door. What's good your FDE? Instead, have nothing stored locally and work over SSH. Now at worst what the brazen attacker has is the files open in your IDE but can't open any other files since the connection dropped and the yubikey is still with you. Also, when at the border you are not facing any issues since there are no passwords to be revealed (I do not want to get into a legal debate with anyone whether I can be forced to reveal a password. It's easier to not have the issue.). Your laptop boots, runs etc. Just there's nothing interesting on it.

I like the Yubikey as 2FA better than having some sort of 2FA on my phone because the keychain and the Yubikey is a much lower profile target than a phone. You probably have your keychain affixed to your belt/pocket by a carabiner or similar solutions so ordinary pickpockets, casual coffee shop thieves won't easily walk away with it and honestly don't want too much it either -- phones and laptops are too easy a target. (I do not wear it on a neck chain when showering but you can since it's waterproof. Pick your level of paranoia freely.)

1/vpn is actually easier than ssh, its just that you've probably never used it before

2/fde is nice when you leave the laptop powered off and unattended, which happens generally every night and during travel, obviously doesnt save you if you get it stolen from your bare hands...

OpenVPN