[SOLVED] Securing Laptop for SANS training

faultylee · 2018-03-06 01:13:06

Hi, I'll be attending SANS training soon, and as per recommendation from them:

During the workshop, you will be connecting to one of the most hostile networks on planet earth! Your laptop might be attacked. Do not have any sensitive data stored on the system. SANS is not responsible for your system if someone in the class attacks it in the workshop.

I currently only have my primary laptop running Arch Linux meeting the requirement, but it does have personal data on them. I would like to know if blocking all incoming ports is safe enough? Any tips to further secure the laptop network wise, and tools to monitor potential attacks? This would be a good learning experience along with the training itself.

To be honest, I'm not well verse in terms of firewall setup. I do have Gufw installed but I seldom turn it on, unless I feel the needs. Beyond that, I can't seems to tell if it's actually working, though I didn't spend enough time investigating and testing it. Will do soon before the training.

My current setup:
Arch Linux with up to date packages on latest kernel (updated weekly)
VMWare Player 12

Any tips and tricks is welcome and thank you in advance.

Last edited by faultylee (2018-04-08 14:11:15)

jasonwryan · 2018-03-06 01:20:10

https://wiki.archlinux.org/index.php/Security

I'm not well verse in terms of firewall setup. I do have Gufw installed but I seldom turn it on

Tbh: I think you are toast. Enjoy the course!

Trilby · 2018-03-06 01:44:47

faultylee wrote:

but it does have personal data...

Back up your data; wipe the drive and start fresh; bring a live usb.

A cheap padlock on an empty box is more secure than fort knox.

faultylee · 2018-03-06 02:13:01

jasonwryan wrote:

Tbh: I think you are toast. Enjoy the course!

I know... hahaha, thanks for the link.

Trilby wrote:

Back up your data; wipe the drive and start fresh; bring a live usb.
A cheap padlock on an empty box is more secure than fort knox.

That's true. I'm trying to avoid having to remove all my personal data which I might need during the travel, I have to fly to a diff country for the training. Though I consider moving them to another laptop. I also need to be back at work after that, wiping and re-setup might not be an option.

I wonder if a hardware firewall will do any good?

ngoonee · 2018-03-06 02:22:31

Move all personal data to an external disc and bring that along with you. Don't bring it to the course itself.

Assume you will be penetrated (I'm quite certain you will be), and prepare some nice easter eggs for the other participants. Some ideas:-

1. Download a bunch of cat videos, corrupt them by randomly overwriting certain sections, and then label them provocatively (e.g. 'Latest Evidence for Russian Hacking')
2. Create fake (un-used) ssh/gpg authentication certs, with identifiers such as 'Mickey Mouse'.
3. Have a 100-level deep set of folders in your home directory which contains random text files. Label the root folder 'code breaker'. For extra points, have the only readable text file say "I'm really quite boring"

Trilby · 2018-03-06 02:32:46

faultylee wrote:

I'm trying to avoid having to remove all my personal data

Wouldn't you rather do so yourself under controlled circumstances than leave it to be surpise when someone else does.

progandy · 2018-03-06 08:10:15

Are you able to swap the ssd/hdd in your laptop? Then do that and when you need your personal data, swap the drives again.

faultylee · 2018-03-07 00:55:53

progandy wrote:

Are you able to swap the ssd/hdd in your laptop? Then do that and when you need your personal data, swap the drives again.

Hmm, that's actually a very good advise.

Trilby wrote:

Wouldn't you rather do so yourself under controlled circumstances than leave it to be surpise when someone else does.

Very true, lol.

ngoonee wrote:

Move all personal data to an external disc and bring that along with you. Don't bring it to the course itself.
Assume you will be penetrated (I'm quite certain you will be), and prepare some nice easter eggs for the other participants. Some ideas:-
1. Download a bunch of cat videos, corrupt them by randomly overwriting certain sections, and then label them provocatively (e.g. 'Latest Evidence for Russian Hacking')
2. Create fake (un-used) ssh/gpg authentication certs, with identifiers such as 'Mickey Mouse'.
3. Have a 100-level deep set of folders in your home directory which contains random text files. Label the root folder 'code breaker'. For extra points, have the only readable text file say "I'm really quite boring"

Nice idea, I did thought about setting up honeypot to draw away the attention. I find the example a bit too obvious that it's a fake, hehe. Btw, nice to bump into fellow Malaysian here, active ones some more

Arch Linux

#1 2018-03-06 01:13:06

[SOLVED] Securing Laptop for SANS training

#2 2018-03-06 01:20:10

Re: [SOLVED] Securing Laptop for SANS training

#3 2018-03-06 01:44:47

Re: [SOLVED] Securing Laptop for SANS training

#4 2018-03-06 02:13:01

Re: [SOLVED] Securing Laptop for SANS training

#5 2018-03-06 02:22:31

Re: [SOLVED] Securing Laptop for SANS training

#6 2018-03-06 02:32:46

Re: [SOLVED] Securing Laptop for SANS training

#7 2018-03-06 08:10:15

Re: [SOLVED] Securing Laptop for SANS training

#8 2018-03-07 00:55:53

Re: [SOLVED] Securing Laptop for SANS training

Board footer