SQLServerCentral / Editorials / SQLServerCentral.com / The $50,000 Laptop / Latest Posts

RE: The $50,000 Laptop

Mad Hacker — Mon, 14 Jan 2013 07:30:57 GMT

I work for a public school system and all of our portable devices have the district seal laser etched on the exterior of the device along with GPS tracking devices embedded internally that automatically notify the network of the current location each time the devices are powered up. While these devices do nothing to protect the data, they will facilitate the recovery of a lost or stolen device, as well as capturing and prosecuting any culprits. Local law enforcement authorities recently recovered (5) stolen devices using this technology.The bottom line is that it is the user's responsibility to protect both the device and the data. In my opinion, sensitive data should always be protected by encryption if it is carried off site.

RE: The $50,000 Laptop

D.Oc — Thu, 10 Jan 2013 11:01:12 GMT

Definitely need to buy a laptop with TPM chip [url=http://en.wikipedia.org/wiki/Trusted_Platform_Module]http://en.wikipedia.org/wiki/Trusted_Platform_Module[/url]

RE: The $50,000 Laptop

TravisDBA — Mon, 07 Jan 2013 14:40:40 GMT

I'm not sure that posting a notice like that would get your laptop back at all, or even if so, how much big $$$$$$ the person(s) would try to hold you hostage for it. You would probably be better served just giving a description of the lost laptop rather than revealing what is on it. Anyway, leaving a laptop on a bus is the height of absent-mindedness IMHO, not like leaving a cell phone, which is much easier to lay down and overlook when you leave the bus. That is one big brain fart..:-D

RE: The $50,000 Laptop

GSquared — Mon, 07 Jan 2013 11:40:08 GMT

[quote][b]Eric M Russell (1/7/2013)[/b][hr][quote][b]GSquared (1/7/2013)[/b][hr][quote][b]Eric M Russell (1/7/2013)[/b][hr]Using the a VPN to connect to my desktop at the office, I don't even have any corporate email on my laptop, it absolutely nothing work related except for the VPN client configuration itself. However, [b]when using VPN it's important not to save your login credentials in Remote Desktop[/b]. Giving a hacker the opportunity to Remote Desktop into your office is an even worse scenario than having a laptop with confidential data on it.[/quote]We use 2-factor authentication on VPN. Even with stored credentials, it dials your phone and you have to hit the hash (#) key on the phone to authenticate there. That way, if someone steals your laptop (or finds it and decides to joy-ride, I guess), unless they also get your phone, they can't connect to VPN.Storing RDP credentials doesn't matter (much) unless you have your VPN domain password on the laptop, even without 2-factor authentication.If someone got my laptop and my phone, they'd still need to know my current domain password, before they could connect VPN. If they have all that, then stored RDP credentials are the least of my worries (especially since they already have the domain username and password somehow, in order to establish the VPN connection).[/quote]I don't dial in through a phone connection, always some broadband connection from multiple locations, but I guess the VPN could be setup to only accept from specific IP address. You're right, I first have to login to the VPN using my domain uid/pw. However, knowing hackers, they can probably find a way to decrypt any credentials stored in the VPN or Remote Console config, so I type everything in manually.[/quote]I'm not dialing in via a phone connection. Connect however you normally do, but the VPN server then calls a pre-defined phone number that's assigned to you. Can be your business cell phone, for example. The phone rings, you pick up, hit # on the phone keypad, and then it considers you authenticated. That's AFTER you've typed in your username and password to the VPN client. Nothing to do with how the computer (laptop or otherwise) is connected, just an authentication step.With that, even if someone uses a keylogger to steal your UID and password, and can somehow copy the VPN connection settings via packet-sniffing or something, unless they also steal your phone, they can't connect.

RE: The $50,000 Laptop

SQLRNNR — Mon, 07 Jan 2013 10:56:37 GMT

[quote][b]Steve Jones - SSC Editor (1/7/2013)[/b][hr][quote][b]GSquared (1/7/2013)[/b][hr][quote][b]sqlpadawan_1 (1/7/2013)[/b][hr]With a terabyte of storage for less than $100, free utilities like Sync Toys from Microsoft, and unlimited online backup services as cheap as $60\yr, I will never understand the mentality of not backing up your data. I haven't lost a laptop, but I have lost the hard drive. With my Carbonite backup, I was back up and running with no losses within hours.[/quote]Of course, even that isn't completely foolproof. Carbonite lost data for some customers a couple of years ago. Bing/Google "carbonite data loss" and you'll find the news articles about it. Summary here: [url]http://www.datacenterknowledge.com/archives/2009/03/25/more-on-carbonites-data-loss/[/url]However, the odds of Carbonite (or DropBox or SkyDrive or whatever) losing your data is MUCH, MUCH lower than the odds of losing a laptop or having a hard drive fail.[/quote]Very true, and you'd hope you wouldn't lose both at the same time.I keep a backup of my laptop handy, and run one before I leave town. I also make sure I have a third around. I need a remote backup like Carbonite as well, just to be sure, since I'm somewhat depending on Dropbox right now as my final backup.[/quote]Similar boat here. I need a carbonite subscription as an extra measure.

RE: The $50,000 Laptop

Eric M Russell — Mon, 07 Jan 2013 09:36:20 GMT

[quote][b]GSquared (1/7/2013)[/b][hr][quote][b]Eric M Russell (1/7/2013)[/b][hr]Using the a VPN to connect to my desktop at the office, I don't even have any corporate email on my laptop, it absolutely nothing work related except for the VPN client configuration itself. However, [b]when using VPN it's important not to save your login credentials in Remote Desktop[/b]. Giving a hacker the opportunity to Remote Desktop into your office is an even worse scenario than having a laptop with confidential data on it.[/quote]We use 2-factor authentication on VPN. Even with stored credentials, it dials your phone and you have to hit the hash (#) key on the phone to authenticate there. That way, if someone steals your laptop (or finds it and decides to joy-ride, I guess), unless they also get your phone, they can't connect to VPN.Storing RDP credentials doesn't matter (much) unless you have your VPN domain password on the laptop, even without 2-factor authentication.If someone got my laptop and my phone, they'd still need to know my current domain password, before they could connect VPN. If they have all that, then stored RDP credentials are the least of my worries (especially since they already have the domain username and password somehow, in order to establish the VPN connection).[/quote]I don't dial in through a phone connection, always some broadband connection from multiple locations, but I guess the VPN could be setup to only accept from specific IP address. You're right, I first have to login to the VPN using my domain uid/pw. However, knowing hackers, they can probably find a way to decrypt any credentials stored in the VPN or Remote Console config, so I type everything in manually.

RE: The $50,000 Laptop

GSquared — Mon, 07 Jan 2013 09:28:22 GMT

[quote][b]Eric M Russell (1/7/2013)[/b][hr]Using the a VPN to connect to my desktop at the office, I don't even have any corporate email on my laptop, it absolutely nothing work related except for the VPN client configuration itself. However, [b]when using VPN it's important not to save your login credentials in Remote Desktop[/b]. Giving a hacker the opportunity to Remote Desktop into your office is an even worse scenario than having a laptop with confidential data on it.[/quote]We use 2-factor authentication on VPN. Even with stored credentials, it dials your phone and you have to hit the hash (#) key on the phone to authenticate there. That way, if someone steals your laptop (or finds it and decides to joy-ride, I guess), unless they also get your phone, they can't connect to VPN.Storing RDP credentials doesn't matter (much) unless you have your VPN domain password on the laptop, even without 2-factor authentication.If someone got my laptop and my phone, they'd still need to know my current domain password, before they could connect VPN. If they have all that, then stored RDP credentials are the least of my worries (especially since they already have the domain username and password somehow, in order to establish the VPN connection).

RE: The $50,000 Laptop

Eric M Russell — Mon, 07 Jan 2013 09:20:52 GMT

Using the a VPN to connect to my desktop at the office, I don't even have any corporate email on my laptop, it absolutely nothing work related except for the VPN client configuration itself. However, [b]when using VPN it's important not to save your login credentials in Remote Desktop[/b]. Giving a hacker the opportunity to Remote Desktop into your office is an even worse scenario than having a laptop with confidential data on it.

RE: The $50,000 Laptop

djackson 22568 — Mon, 07 Jan 2013 08:41:09 GMT

Eric and Jay make good points. I don't understand why anyone would store all their data on their laptop. Companies routinely provide personal shares on the network that are backed up. Smaller companies may not do this, but then alternative backup options exist.The main issue I have is the ridiculous cost the study author(s) came up with. It is the same methodology that software companies use to determine lost profits from unlicensed use, the music companies use to determine the cost of listening to unpurchased songs, and probably similar to the science behind the Mayan calendar and the end of the world. Sadly, I seemed to have missed that last event due to being abducted by aliens, although they seem to have returned me to the same planet in an alternate reality. Just not one that is alternate enough to stop these stupid studies based entirely on opinion.Losing laptops, smart phones, iPads and other devices is costly, yes. I just completed a study, though, that proves the cost of studies far outweigh any cost associated with lost data. I plan on posting it on the Internet for all as soon as I find out what the aliens did with my laptop.Seriously, I believe the cost is in one of two broad ranges. Those companies that employ halfway intelligent people, and that listen to the experts in their technology department, probably encur costs for the laptop, and some labor involved in purchasing a new one and deploying it. I think a figure between $1,000 and $3,000 is reasonable. I believe most companies fall in this range. The mean value would almost certainly be within this range as well.The other range, well, are we sure those instances aren't from the current US government?

RE: The $50,000 Laptop

jay-h — Mon, 07 Jan 2013 07:40:34 GMT

Laptops need to be thought of as commodity carriers for data, not the end object in themselves. Encryption, offsite backup, etc are what we need to be mostly concerned with, not so much protecting the laptop itself. Frankly in the long run, it's futile to think you can totally prevent theft or failure.On a lighter note, here's a story about lost and recovered research 'data'http://jalopnik.com/5963982/the-university-of-maine-scallop-guts-placed-in-the-wrong-car-have-been-found

RE: The $50,000 Laptop

Eric M Russell — Mon, 07 Jan 2013 07:40:21 GMT

At my company, those of us who work remotely use our laptop to Remote Console into one more Virtual PCs or just a desktop tucked away in a forlorn cubicle. In the case of a Virtual PC, the images get routinely backed up by server admins, so we don't even need to worry about it. There is no confidential or valuable data stored on the laptop hardware, so if it gets lost or stolen the cost of replacement is $350; that's how much I paid for the laptop I'm using now. In a pinch, I could even borrow my wife's laptop and miss nothing.

RE: The $50,000 Laptop

Steve Jones - SSC Editor — Mon, 07 Jan 2013 07:19:04 GMT

[quote][b]GSquared (1/7/2013)[/b][hr][quote][b]sqlpadawan_1 (1/7/2013)[/b][hr]With a terabyte of storage for less than $100, free utilities like Sync Toys from Microsoft, and unlimited online backup services as cheap as $60\yr, I will never understand the mentality of not backing up your data. I haven't lost a laptop, but I have lost the hard drive. With my Carbonite backup, I was back up and running with no losses within hours.[/quote]Of course, even that isn't completely foolproof. Carbonite lost data for some customers a couple of years ago. Bing/Google "carbonite data loss" and you'll find the news articles about it. Summary here: [url]http://www.datacenterknowledge.com/archives/2009/03/25/more-on-carbonites-data-loss/[/url]However, the odds of Carbonite (or DropBox or SkyDrive or whatever) losing your data is MUCH, MUCH lower than the odds of losing a laptop or having a hard drive fail.[/quote]Very true, and you'd hope you wouldn't lose both at the same time.I keep a backup of my laptop handy, and run one before I leave town. I also make sure I have a third around. I need a remote backup like Carbonite as well, just to be sure, since I'm somewhat depending on Dropbox right now as my final backup.

RE: The $50,000 Laptop

sqlpadawan_1 — Mon, 07 Jan 2013 07:06:11 GMT

Agreed, nothing is foolproof. I have a Carbonite subscription for offsite and a external drive with a sync toy transfer setup for onsite. I put my source in VSS or SVN. It's overkill, but I'm lazy and paranoid. I don't want to have to reinvent the wheel or explain how I lost source code to the manager or all of our digital pictures to the boss.

RE: The $50,000 Laptop

GSquared — Mon, 07 Jan 2013 06:32:39 GMT

[quote][b]sqlpadawan_1 (1/7/2013)[/b][hr]With a terabyte of storage for less than $100, free utilities like Sync Toys from Microsoft, and unlimited online backup services as cheap as $60\yr, I will never understand the mentality of not backing up your data. I haven't lost a laptop, but I have lost the hard drive. With my Carbonite backup, I was back up and running with no losses within hours.[/quote]Of course, even that isn't completely foolproof. Carbonite lost data for some customers a couple of years ago. Bing/Google "carbonite data loss" and you'll find the news articles about it. Summary here: [url]http://www.datacenterknowledge.com/archives/2009/03/25/more-on-carbonites-data-loss/[/url]However, the odds of Carbonite (or DropBox or SkyDrive or whatever) losing your data is MUCH, MUCH lower than the odds of losing a laptop or having a hard drive fail.

RE: The $50,000 Laptop

sqlpadawan_1 — Mon, 07 Jan 2013 05:40:52 GMT

With a terabyte of storage for less than $100, free utilities like Sync Toys from Microsoft, and unlimited online backup services as cheap as $60\yr, I will never understand the mentality of not backing up your data. I haven't lost a laptop, but I have lost the hard drive. With my Carbonite backup, I was back up and running with no losses within hours.

RE: The $50,000 Laptop

Jeff Moden — Sun, 06 Jan 2013 17:00:17 GMT

Referring to the poster in the article about the laptop on the bus. I think it's bloody well amazing that 1) the laptop is the (apparently) only source of the scientific data and 2) that people that have a laptop with such data on it actually unhook it from their shoulder when riding a bus or taking a cab.

The $50,000 Laptop

Steve Jones - SSC Editor — Sun, 06 Jan 2013 04:17:36 GMT

Comments posted to this topic are about the item [B]The $50,000 Laptop[/B]