Bah.
If anybody has physical access to your computer, you lose by default. Encrypting drives isn't worth the hassle.
IMHO the only software/hardware based security worth paying attention to is protection from network attacks, that will keep anybody more then occupied for life.
For physical access I prefer to do the same thing that serious gun collectors do. (if I worried about it, which I don't).
Pick a nice smallish room in the basement. Tear out the inside walls of the room, put weilded/bolted steel plate in there instead of drywall. Maybe reinforce that with concrete.
Don't forget the ceiling and the floors. Don't want to spend all that time and effort and have somebody go in thru the kitchen floor or your bosses office with a crowbar, do you?
Put a safe door in place. Several inches thick steel.
something like this
Make it so mind boggling difficult to break into that nobody will even want to try. That's the goal.
If you need to access your restricted data from a remote location do it thru the internet or lan. That's what it's there for.
Keep your final server inside the reinforced room, keep the logon server in their too. With the firewall.
Have the internet go in, go thru a firewall and into the logon server. The only way to access the information is to establish a encrypted tunnel thru the firewall and into the logon server. Logon thru that and establish a second tunnel into your secure data server. Make it so a hacker would have to break your firewall, your logon server and then your final secure server in order to gain access to it. Print out a copy of your logs to hardcopy so that they can't be altered after the fact.
And whala, your data is secure and nobody will ever find your gay nun porno stash.
The main advantage this has over encrypted files is that if (when) your computer F-s up, then you still have access to your data. If you have encrypted harddrive then your data can be gone forever, which is most of the time worse then getting a copy stolen.
There is a reason that Windows/Linux/OS X/etc etc allow you to reset passwords and stuff. It's not because of a flaw in design, it is out of nessecity.
Ever see what happens to a high end server that is built on 100% secure hardware defenses.
Forget our mistype your root password in a password change-over and you can kiss you high dollar server goodbye. It's happened to more then a few people, and it's very costly to have a guy come out a resolder a new chip to reset it into your motherboard.
Facebook
Twitter