What's the best way to secure information on Windows XP laptops from the standpoint of confidentiality and availability (i.e., not losing information if the laptop is destroyed, lost, or stolen)?
You can combine native Windows technologies by using offline files support with the Encrypting File System (EFS). The offline files feature, available since Windows 2000, allows mobile users to access cached copies of file server folders when away from the office. XP introduced the ability to encrypt the local cache of offline files.
Offline files support is fairly transparent to users. Even when not connected to the network, users can access file server folders as if they were connected. When users' computers are connected to the network, they automatically synchronize files between the server and the workstation cache. Users do tend to get bugged a good bit about synchronizing even when they aren't connected to the network, but they get used to it. Train users to log off before leaving the office; Windows syncs at logon and logoff automatically. If you redirect users' My Documents folder to a file server, make the folder available offline, and specify that offline files should be encrypted, users' files will be available on their laptop, safely encrypted if the laptop is stolen, and regularly backed up to the server.
Note that when you encrypt offline files, the encryption is based on the local system's account rather than the user's account, which introduces some arcane vulnerabilities that aren't a problem when a user encrypts regular files with a strong password. Nevertheless, EFS-protected offline files offer reasonable security for small-to-midsized businesses (SMBs) and better security than what you'll find on most Fortune 500Âcompany laptops.
