Hi all, we are hiring a remote worker and will be supplying a laptop to them. The laptop will be running a Debian variant of Linux on it.
We are a small shop and this is the first time we have entrusted somebody outside of our small pool of trusted employees.
We have sensitive client data on the laptop that they need to access for their day-to-day work.
However, if something goes wrong, and they do the wrong thing, we want to be able to send out some kind of command or similar, that will completely lock, block, or wipe the sensitive data.
We don’t want any form of spying or tracking. We are not interested in seeing how they use the computer, or any of the logs. We just want to be able to delete that data, or block access, if they don’t return the laptop when they leave, or if they steal the laptop, or if they do the wrong thing.
What systems are in place in the world of Linux that could do this?
Any advice or suggestions are greatly appreciated? Thank you.
DLP solutions are honestly a joke. 99% of the case they only cost you a fortune and prevent nothing. DLP is literally a corporate religion.
What you mentioned also makes sense if you are windows shop running AD. If you are not, setting it up to lock 1 workstation is insane.
Also, the moment the data gets put on the workstation you failed. Blocking USB is still a good idea, but does very little (network exfiltration is trivial, including with DLP solutions). So the idea to use remotely a machine is a decent control, and all efforts and resources should be put in place to prevent data leaving that machine. Obviously even this is imperfect, because if I can see the data on my screen I can take a picture and OCR it. So the effort needs to go in ensuring the data is accessed on a need basis.
That was kinda my point. Securing a laptop that will have access to data you want to protect from loss is a near bottomless pit of issues. There comes a point you have to do a risk assessment and apply a level of security that meets your legal requirements and contractual obligations. I’m sure this is all doable on Linux as well but the low cost / easily available tools are mostly for Windows.
I suspect that taking the “secured remote session” approach is probably good enough for their needs. It just needs a client app you can trust to respect the security rules they want to enforce (no screen shots, no screen recording, no data transfers for any sort, etc).
OCRing what is on screen is not really stoppable unless you force them to keep their camera on so you can monitor them 24/7. But if you try hard enough there is usually a way around most security measures.
Either way, they need to decide what the risk impact vs likelihood profile is, and what the business can tolerate. They’ll need to discuss it with legal and data protection folks to assess that.
One tip is to embed records and values that look meaningful, but are unique, into the copy of the data given to the specific employee. This can be used to potentially prove that a data breach was a result of something that employee did. We like to put QUID’s as invisible watermarks in document headers. These trigger our DLP systems which is always funny cos its usually an employee who is leaving and wants to keep something. I love those conversions.
I like the idea of canaries in documents, I think is a good point but obviously it only applies to certain types of data. Still a good idea.
Looking at OP, they seem a small shop, with a limited budget. Seriously the best recommendation I think is to use some kind of remote storage for data (works as long as the employee complies) and to make sure the access control is done in a decent way (reducing the blast of employee behaving maliciously). Anything else is probably out of reach for a small company without a security department.
Maybe I sounded too harsh, that’s just because in this post I have seen all kinds of comments who completely missed the point (IMHO) and suggested super complicated technical implementations that show how disconnected some people can be from real technical operations, despite the good tech skills.