From stolen laptop to inside the company network
The first step is to actually encrypt your drives.  Far too few people and places even do this step.<p>Either use the OS-provided solution (Like LUKS, FileVault, or BitLocker), or use a cross-OS solution like Veracrypt <<a href="https://veracrypt.fr/" rel="nofollow">https://veracrypt.fr/</a>>.<p>Secondly, to avoid the problem in this article, you should have an external password necessary to unlock the drive; not a TPM.  This is, of course, not what most people do, since typing in passwords is tedious.<p>However, if you mostly need to boot up the laptop when connected to a specific network (e.g. on company premises), and it’s acceptable to require a manually typed password when the laptop is <i>not</i> present at that location, <i>and</i> if you use a Debian-based OS, there is a solution!  Shameless plug: <a href="https://www.recompile.se/mandos" rel="nofollow">https://www.recompile.se/mandos</a>