From stolen laptop to inside the company network
The first step is to actually encrypt your drives.  Far too few people and places even do this step.Either use the OS-provided solution (Like LUKS, FileVault, or BitLocker), or use a cross-OS solution like Veracrypt https://veracrypt.fr/>.Secondly, to avoid the problem in this article, you should have an external password necessary to unlock the drive; not a TPM.  This is, of course, not what most people do, since typing in passwords is tedious.However, if you mostly need to boot up the laptop when connected to a specific network (e.g. on company premises), and it’s acceptable to require a manually typed password when the laptop is not present at that location, and if you use a Debian-based OS, there is a solution!  Shameless plug: https://www.recompile.se/mandos