Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 7 down vote favorite
2

Linux has grown in popularity in the past few years. Many more people are using Live CD's now than they were say 3 years ago. And with this comes a new problem for network admins. How do you stop a person from accessing certain file on the HDD that they, under Windows, would not be allowed to access, or even see. If you have a personal computer you can't really protect it either. A password on the BIOS won't work because if you remove the battery on the motherboard, wait 10 seconds, insert the batter back in, your password is gone.

So how do I stop this threat?

[This is a security management question, not a programming question.]

share|improve this question
Um... You do know this is a programming-question-only site, right? – Shog9♦ Mar 16 '09 at 23:40
Sorry, I just found it puzzling. I voted to close it also. – Lucas McCoy Mar 16 '09 at 23:43
3  
Lucas - Once a person has physical access to the machine, they, for all intents and purposes, can do anything to it and with it. If you want to protect your data, an encrypted filesystem is your best bet, but beyond that there's not much you can do. – Adam Davis Mar 25 '09 at 17:29
@Adam Davis: Wheres a self destruct button when you need one ;-) – Lucas McCoy Mar 25 '09 at 23:53

migrated from stackoverflow.com Aug 23 '09 at 23:24

6 Answers

up vote 17 down vote accepted

Keep all personal data (possibly your entire profile) in an encrypted partition that is decrypted with your account password (or even a separate password).

TrueCrypt can do such things (and it's free software).

share|improve this answer
Also see PGP (pgp.com/products/wholediskencryption), and dm-crypt (saout.de/misc/dm-crypt), EFS, bitlocker, and so on. – Zoredache Mar 16 '09 at 23:44
2  
Just... don't ever forget the password! If they can't break into your computer, you can't break into it either. – Ilari Kajaste Sep 2 '09 at 10:40
up vote 10 down vote

The most obvious option is to remove (or move to lowest priority) the CD boot option and then set a password on your boot configuration utility.

share|improve this answer
3  
You'd also have to padlock your computer chassis, so there's no easy access to 1) removing the BIOS battery - which would reset the password and allow the attacker to re-enable CD boot, or 2) plugging the hard drive directly to the attacker's portable computer, for example via USB. – Ilari Kajaste Sep 2 '09 at 10:39
And most BIOSes have "emergency passwords" that only "service personel" knows (fat chance, Google knows them too). – vonbrand Feb 16 at 5:34
up vote 9 down vote

If they have access to your hardware, you can't be 100% secure. Keeping your secure data physically separate is the safest thing to do.

share|improve this answer
up vote 0 down vote

  1. There are BIOS passwords that can't be removed.

  2. Encrypt your hard drive. There are some good tools out there.

share|improve this answer
What kind of BIOS passwords can't be removed? (I'm not disagreeing, I've just never heard of this technology) Thanks! – Lucas McCoy Mar 16 '09 at 23:40
1  
That really depends on the manufacturer. I, for example, haven't yet been successful removing the BIOS password of my secondary computer. Portable computers are often more resistant against such attempts. – gs Mar 16 '09 at 23:42
1  
A basic security principle is that "I don't know how to do it" != "it cannot be done". I also have never heard of such a technology, so am a little sceptical. – Peter Mar 16 '09 at 23:50
2  
It can be undone by replacing the whole motherboard or by just moving the hard disk to another computer. – gs Mar 17 '09 at 8:32
up vote 0 down vote

If you are putting it like that, you don't.

Or you can encrypt part of the files on the disk which will lead to a slower load time due to decryption and you will have to have extra applications installed for it.

share|improve this answer
up vote 0 down vote

You could keep all of your personal data on an external encrypted drive. That way you can take all of your data wherever you go, and not have to worry about someone getting to it on your personal PC.

32Gb USB thumb drives are coming down in price.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.