The Simple Things Part One – The Lock Lead

ImageWhy is the humble lock lead the first item in my top ten? Many people would complain it is a pain in the backside to use day after day, that it can’t provide that much protection given the tiny connection to the laptop in the small rounded rectangular hole, and the cable must be pretty easy to curt through, so why bother?

Let us look at the two main aspects of lock leads, namely the physical aspect (how strong, reliable etc) and also the deterrent aspect (will it put people off?).

1. The Physical

There are good quality, well made lock leads and there are bad quality, poorly made lock leads. Make sure you choose the right one. How do you choose? Look for recommendations, and also purchase range of them and try them out yourself. Some can be opened with a rolled up business card, and some can be snapped off with a sharp turn of the barrel using a pair of pliers. My current favourite is the Compu-Lock lead, http://www.compu-lock.com (I have no business or personal interest in the success of this company but the lead they produce meets many of there criteria I lay out in this article). You of course may fall to one of the other major manufacturers.

The cable itself (at least in a good one) is made of stranded hardened steel (allowing flexibility with strength) and covered in a durable plastic coating that also provides initial protection from cutting (such as with pliers). The construction is very similar to a bike lock albeit thinner, and although it can be cut it takes some considerable effort with hand tools. I have tested this with a lower specification cable, cutting through it in just under two minutes with a pair of snips; it took a considerable amount of effort and grunting to do so, and I was still left with a “tail” attached to the laptop. The better specification cables will take significantly longer.

The lock itself is also important. Kensington came under fire some years ago (somewhat unfairly) when many of their locks were shown to be susceptible to Bic biro barrels and rolled up business cards being forced into the key hole to take the shape of the key and subsequently open the lock in a matter of seconds. This problem went beyond laptop locks and affected other barrel lock manufacturers for bikes etc.. Although the problem has been solved, I still feel wary of these types of lock, albeit without foundation! As an enterprise you will want a lock that provides master keys specific to your organization, something that is not always easy to find, especially in the lower end of the market.

Finally, the fit is important. Many locks will connect with the laptop but then be loose. Some try and overcome this with rubber flanges which is ultimately useless. the problem a loose lock poses is that if the gap is big enough to get a hacksaw into you can attack the pin(s) that lock it, or even worse get a good grip and twist the barrel to break the pins. The better locks will have an adjustment mechanism that ensures the barrel is tight against the laptop meaning there is significantly less leverage and no gap to cut through.

2. The Deterrent

So you have the Rolls-Royce of locks in your possession… there are a numbers of things to bear in mind to ensure its effectiveness.

Firstly, you have to use it! Time after time I see them looped into a desk and then not connected to the laptop. FAIL on all counts. Use it all day, every day; in the office, hotel room, client site, even in the boot of your car if you have to leave it in there for whatever reason (avoid this last one at all costs though!).

Secondly, given it will not put off a determined attack, it should not be left overnight in your office for instance. Their primary use is as a casual theft deterrence; any thief in a time pressured situation (perhaps during a fire evacuation drill?) will not bother with the laptop that is locked and move very quickly onto the one that isn’t. If somebody has the luxury of thirty, undisturbed, minutes in the middle of the night they may think differently as well as be equipped for it! Always take your laptop home; if nothing else it is a very effective contributor to your company’s BCP initiative!

Finally, having the lock leads helps keep you in a security mindset (hopefully without becoming paranoid!). It is a constant visual reminder of the need for security, and if it reminds you to lock your screen every time you step away for a coffee then you have doubled the value of the lead straight away.

In conclusion, the lock lead has to be one of the most simple, best value and effective data loss prevention tools available. It’s use will significantly reduce the potential for theft of not only the physical device, but the cost of replacing the laptop, the data, the time in getting everything back and potentially a front page spread in a national newspaper;” Company X loses One Million Public Records“.

Surely £25 is worth avoiding that?


The Simple Things are Effective

It occurred to me while I was preparing to give a security briefing to a number of internal teams that fundamental security is not difficult. There are a number of simple activities or tasks that if carried out correctly, will significantly reduce the the potential for data loss, data breaches, security weaknesses and incidents. After a bit of scribbling in my book I boiled it down to ten things (or actually made it up to ten as I originally only cam up with seven, but every “list” needs to be either three, five or ten!). Many of them can even be driven by the individuals themselves rather than the organisations they work for; perhaps a version of BYOD called BYOS, or Bring Your Own Security. I think that in itself is a good topic for conversation!

Over the course of the next few weeks I will post each one (or two if they are related) of these activities, but in summary they are:

  1. Lock Leads
  2. Encryption
  3. Screen Privacy Filters
  4. Removable Media
  5. Collaboration Tools
  6. Mobile Devices
  7. Social Engineering
  8. Background Checks
  9. ID Badges
  10. Escalation & Education

I am sure there are more, and I have the feeling these posts will form the basis of a presentation later on in the year! However, the fundamental aspect of all of this is that basic security is not difficult. it doesn’t require thousands of pounds on DLP solutions, security guards and endpoint solutions (although they all help add layers of defense of course), it just needs to focus initially on a few effective measures that can me implemented across an organization quickly, easily and in the grand scheme of things, at great value.

In the process of writing these up I hope to explore both their effectiveness and ease of use; I will also challenge some preconceptions, including my own, on the ease in which they can be implemented and more importantly, adopted buy individuals in a BYOS environment.


An Anatomy of a Risk Assessment

The video below is my presentation to the RANT forum in London on “An Anatomy of a Risk Assessment”. In it I give a personal view on the mechanics underlying a risk assessment or audit. It is not a highly technical approach, and is not meant to be; for that purpose there are plenty of books and guidance available elsewhere. Instead I take a more human approach as to how to get the most out of an assessment, from both sides of the table. The slides are available at the link below, in Keynote, PDF and Powerpoint format or can just be viewed through your browser. Presenter notes are there and are my original presentation ideas, and so therefor may not accurately reflect the presentation on the night!

http://bit.ly/wF3pKe

Technically, this was my first ever public speaking engagement of any note (I did a two minute session in the November RANT), and so I am scrutinising my performance significantly to ensure I can improve upon this presentation for reuse at other venues. If you attended, or indeed if you care to review the video below I would welcome your feedback. I must say though, having watched it a number of times now, I am very much painfully aware of my annoying personal tics, mannerisms and expressions of speech! Still, it was an immensely enjoyable experience and one I am looking forward to repeating at some point in the next twelve months.

The book I make reference to at 16:00 is The Leaders Workbook by Kai Roer (http://amzn.to/xm3dy2), an inspirational book, but only if you use it properly!


Under Construction… No Longer!

On the eve of my first real post for nearly a year, but a busy few months, this site is officially no loner under construction! There is more work to be done, namely About Me, Reading List and and a few other pages I have in mind. They will come over time, but most importantly is the fact I am now ready to contribute to the infosec ecosphere!

Bear with me while I transfer old content and add new content throughout this site. Trying to keep it simple and engaging!


The New Home of TandTSEC, the blog

Fairford Airshow 2011I am in the early days of setting up this site as the formal blogging site of TandTSEC. It has been almost a year since I set up the original site, and after an initial flurry of blogs they dried up quite quickly. I have come a long way in my professional development since then, significantly catalysed during the RSA Europe conference last year.

Moving to this site will allow me to overcome one problem in particular, namely that of being able to update my blog from anywhere and on any of my mobile devices. My hope is that I will be able to post an update when the mood hits me rather than when I get back to my desk at home. Given the amount I find myself traveling this was a problem!

I am also starting on the speaking circuit. I am in the middle of preparing my first presentation ready for delivery this coming Tuesday at the RANT forum in London. With that in mind I am challenging myself to come up with more frequent updates, opinions and thoughts to act as the “manure” for new presentations, articles, and hopefully a book!

Here is to a new chapter in my InfoSec career!