On Thursday, December 5, 2019 9:26:09 AM MST Przemek Klosowski via devel
wrote:
On 12/4/19 6:59 PM, John M. Harris Jr wrote:
> On Wednesday, December 4, 2019 12:38:20 PM MST Przemek Klosowski via devel
>
> wrote:
>> - stolen/lost laptop: I think this is the most important one for most
>> people; it is mitigaged by a trusted-network-based decryption, unless
>> the device is in unencrypted sleep mode and the new 'beneficial owner'
>> manages to read the disk before the system goes down.
>
> That may be the case for home users, but not for businesses. Let's take
> this example. Employee A has files from a given project, but Employee B
> doesn't have access to that project. Employee B is malicious, and takes
> Employee A's laptop, gets it on the network, it unencrypts itself and
> then takes it.
Defending against threat model allowing physical access and malicious
insiders, who e.g. install a screen/keyboard capturing camera in the
target office, is an entirely different ballgame, requiring multi-factor
authentication, etc. --- and even those are not infallible (c.f. wikileaks).
You're conflating issues. For example, Snowden was an issue of trust, the
human element. He had access to the data he removed. I'm not talking about
that, because that is out of scope.
>> - someone breaks into your home/office/hotel room and
extracts the data:
>> important to some people but not very common scenario.
>
> This is important to most businesses.
Same argument as above. Again, we're talking about taking care of the
low hanging fruit like hard disks stripped from equipment and sold on Ebay.
The argument from above does not apply here. You're talking about physical
security, which is out of scope. I'm talking about software security.
--
John M. Harris, Jr.
Splentity