Question: A law firm I've been in contact with has recently been broken into 3 times in the past 4 months. In spite of a number of laptops and other equipment containing sensitive information being stolen, the tech support company occasionally doing work for them has done nothing to safeguard against future theft. I proposed installing anti-theft software (such as Prey) and later considered establishing one system as an information-gathering honeypot with hidden keyloggers sending information to a number of email addresses. 

All physical security best practices aside, what other measures could possibly be implemented here? These are all Windows systems. I don't doubt the separate incidents are linked and being carried out by connected if not the same criminals. 

The firm has already been in contact with the local authorities. However due to a lack of documentation on the stolen items, there are no serial numbers or additional helpful information on the missing devices besides make and model, so recovery seems a dead end but at the least they're aware of the incidents.

Answer: 
Firstly encrypt the hard disks to protect the information on the laptops.

You need to make it easier for the police to find the people and easier for put them in jail.

There are modifications to the bios of laptops that make then ping an IP address whenever they connect to a network. You can then look at the source address on the pocket and get a court order for the given ISP to tell you where the laptop is. www.absolute.com is one company that sells such a system that allows an device to be remotely disabled as well as tracked.

I would also think about having alarm that activate a [smart water spray](http://www.smartwater.com/forensic-spray) when it goes off, that way it is easy to prove that someone was in the building at the time the alarm went off.

> 
> Upon activation the SmartWater Forensic Spray System sprays intruders
>  with an invisible liquid, marking their skin and clothing. The liquid
>  can only be seen under UV light, remaining on skin for weeks and
>  indefinitely on clothing. It can be used to link a criminal to a
>  particular crime scene, remaining detectable long after the crime has
>  been committed.
> 
> 
> 

I would be incline to do the above without putting up any warning notices with as few people knowing about it as possible. *It is better to put people in jail, then just get them to rob the next office instead of yours.*
What measures to take depends on which of the inconveniences from the theft you want to protect against:

* **Loss of data**: Keep backups. Data which exists only on the laptop can of course not be avoided while the laptop is offline. But as soon as it is online with a decent connection the data need to be backed up.
* **Leaks of data**: Encrypt the entire disk. If the encryption solution is unable to wipe the keys from memory when the screen is locked or the laptop is suspended, then shut it down completely instead.
* **Financial loss**: Losing the hardware means a financial loss. The way to protect against that is by having an insurance.
* **Make it less attractive to steal**: There are two approaches to this. Increase the chance of getting caught by tracking the device. Make the hardware unusable to the thief. Making the hardware unusable is something which cannot be done with just software, it requires certain protections built into the hardware itself. My recommended way to measure the value of any measure to make the hardware less attractive to steal is: how much of a discount is the insurance company willing to give you.

One nice to have feature which doesn't fit into the above list is backups that works after the laptop was stolen. While the laptop is working offline and cannot backup immediately, it is possible to create incremental backups which are encrypted and signed, and then store those on the disk. This can be done in such a way that the encrypted and signed incremental backup can be send to a server without needing the disk encryption key to be provided. This is however a fairly complicated feature because it spans areas that are usually kept separate, so I wouldn't put it high on the priority list. In particular there is a significant risk of messing up the security of the disk encryption while adding such a feature.