Question: A law firm I've been in contact with has recently been broken into 3 times in the past 4 months. In spite of a number of laptops and other equipment containing sensitive information being stolen, the tech support company occasionally doing work for them has done nothing to safeguard against future theft. I proposed installing anti-theft software (such as Prey) and later considered establishing one system as an information-gathering honeypot with hidden keyloggers sending information to a number of email addresses. 

All physical security best practices aside, what other measures could possibly be implemented here? These are all Windows systems. I don't doubt the separate incidents are linked and being carried out by connected if not the same criminals. 

The firm has already been in contact with the local authorities. However due to a lack of documentation on the stolen items, there are no serial numbers or additional helpful information on the missing devices besides make and model, so recovery seems a dead end but at the least they're aware of the incidents.

Answer: 
[Bios Level Passwords](http://www.howtogeek.com/186235/how-to-secure-your-computer-with-a-bios-or-uefi-password/) prevents anyone from even turning on the computer without a password, but this doesn't prevent them from putting the hard drive into an extrenal enclosure.

[Bitlocker full drive encryption](http://windows.microsoft.com/en-us/windows-vista/bitlocker-drive-encryption-overview) built into windows prevents them from reading the information entirely unless it is in that computer.

Even with/(out) all of this encryption private, harmful, and secret information should still be stored in an [encrypted & password protected folder](http://www.pcworld.com/article/2858642/you-can-encrypt-your-hard-drive-but-the-protection-may-not-be-worth-the-hassle.html).

At this point if a person steals the laptop, good luck EVER getting data off of it. Of course this also runs into the problem that now if someone forgets the passwords you up a creek, and so you need to run an in house password and username lookup system that is secure and safe. But that's the nature of security. The more secure you are, the less useable it is.

> 
> The most secure computers are buried six feet underground, have no network access, are turned off, and destroyed.
> 
> 
> 

Of course if Bitlocker is overkill, the are other options for [encrypting anything](http://www.pcworld.com/article/2025462/how-to-encrypt-almost-anything.html).

Another route to go is the thin client architecture that would mean no sensitive data would be stored on the laptop at all. This however requires a server to log into and store files on, and client and server setups, and VPNs that need to be encrypted as well.
As others have mentioned, I think you need to consider the physical security first. At the end of each day you collect the laptops back and lock them in a filing cabinet in a locked room.

I would set up an asset register to log the makes, models and serial numbers of the laptops and other IT equipment. This doesn't need to be anything fancier than a spreadsheet. This would give you something to hand over to the insurance company and police in the event of theft.

A seperate spreadsheet could be used to log the users of the laptops. They come to you and request a laptop, you enter their name in the sheet with a datestamp. If the laptop doesn't come back you know who to go and shout at.

If the laptop needs to leave the premise (to go to the courtroom in this instance) make sure the user is aware that they are financial responsible for it if it gets damaged, lost or stolen. People are a lot more careful with equipment if they know they might have to pay to repair/replace it.

When I worked for a tech support company several of our customers were solicitors. They got round the potential data loss issue by having a terminal server and their remote workers could only access email and client information through that. The laptops effectively became dumb terminals. This also meant that all the heavy processing was done on the server so cheaper laptops could be purchased.

Once the physical security is dealt with they can start to consider drive encryption and geo-tracking of laptops. We had great success with services like [AirWatch](http://www.air-watch.com/solutions/laptop-management). We only ever had one device go missing with AirWatch installed on it and the field engineer was able to retrieve it with our guidance via GPS. I felt like a spy, it was great! :)