Securing a laptop

Here’s a list of security tips I have that might be useful for your laptop.

BIOS

Set password for BIOS access
Disable boot from USB
Disable boot from CD

Boot loader

Syslinux and GRUB supports bootloader passwords. Use them.

Filesystem permissions

By default, filesystem permissions allow read access to almost everything. Change the default umask to improve security for newly created mask. Use a umask of 077 for maximum security, which makes new files not readable by users other than the owner.

Disk encryption.

Use full disk encryption with a strong passphrase.
You can choose to only encrypt /home if performance is an issue.

Truecrypt

Use Truecrypt to encrypt data that go into cloud storage services such as Dropbox or Google Drive. Hidden volumes are highly recommended. Store miscellaneous stuff in the encrypted volume and the sensitive information in the hidden volume.

Backups

Backups should be encrypted as well.

Hardware

Disable hardware that you do not use:

Webcam. (Cover it when not in use)
Microphone.
Bluetooth.
USB.

Network Security

Use wired networks.
Set up iptables firewall.
Change mac addresses with macchanger on each boot.
Setup static ARP entries to prevent ARP spoofing.
Use arpwatch to detect ARP spoofing attacks.
Use DNSCrypt to secure DNS communications.

Chrome

Recommended extensions:

Ghostery.
HTTPS Everywhere.
Disconnect.
User-Agent Switcher.

Search Engines:

Passwords

Set up a password manager. Keepass, LastPass.
Change passwords every three months.
Use two factor authentication.

Chat

Any XMPP client with OTR for encrypted chats.
CryptoCat?

Other

Use a generic username and hostname. user@laptop:~$

Published on 27 Jul 2013 by Stanley Tan

Home