Laptop and USB Encryption for a Mobile Sales Team
A 25-person sales team uses Windows laptops and 16 GB USB sticks to carry pricing spreadsheets and customer contracts. In the past year two laptops and one USB stick were left on trains. None of the lost devices was encrypted. The sales director wants full-disk encryption on all laptops and password-protected ZIP files on USB sticks. The company has no central key escrow, one IT generalist, and a legal requirement to report any confirmed exposure of customer contract terms within 72 hours. Laptops are replaced every four years and some are five years old with no TPM 2.0. Sales staff often work offline on planes and need local files. A proposed alternative is to move all files to a cloud drive with per-user login and MFA, but the sales team says offline access is essential. Budget allows either an endpoint encryption tool with escrow or a cloud migration, not both this quarter.
1. Compare full-disk encryption with key escrow and the cloud-drive alternative. Which should be funded this quarter, and why?
Read the worked answer
Full-disk encryption directly addresses the known loss events: if a laptop is stolen, contract terms and pricing data are unreadable without the key. Key escrow is essential because otherwise a lost or corrupted device can become a permanent data loss and a support nightmare. The old laptops without TPM 2.0 can use software encryption with a pre-boot password, or be replaced or restricted to non-sensitive work; do not assume TPM is present. Encrypted USB containers, not ZIP files, should carry offline files. The cloud drive with MFA improves access control and central revocation, but it depends on connectivity and user sync behavior. Sales staff working offline may keep local copies anyway, so the cloud alone does not guarantee confidentiality on a lost laptop. This quarter I would fund endpoint encryption with escrow, plus encrypted USB containers, because the immediate risk is lost devices. Plan the cloud migration as the next project, and use it to reduce the number of files stored locally over time. The answer changes only if the company can enforce no local storage and provide reliable offline cloud sync.
2. Design the key-recovery and 72-hour breach-assessment workflow. Include who holds recovery keys and how you decide whether to report.
Read the worked answer
Create an asset inventory that maps each laptop and USB container to a named user. Escrow recovery keys in a secure vault, not in a spreadsheet on the file server. Use split knowledge: two authorized people are needed to retrieve a key, and every retrieval is logged with a ticket number and reason. The IT generalist can perform recovery, but a manager must approve it. Test one recovery per quarter. When a device is lost, start the clock when the company becomes aware. Remote-wipe if possible, revoke the user's sessions, and check the last sync or login. Determine whether the device was powered off, whether encryption was active, and whether there is evidence of tampering or credential theft. If encryption was active and the passphrase was strong and not stored with the device, the risk of data exposure is low, but legal still documents the decision. If encryption was inactive, the passphrase was written down, or the device was unlocked, treat it as a potential breach and escalate for notification assessment within 72 hours. Record the facts, decision, and timestamps.
3. Why is a password-protected ZIP file on a USB stick not adequate for contract terms?
Read the worked answer
A ZIP password is often weak, reused, or shared in the same email as the file. Offline attackers can brute-force it at high speed, and some ZIP tools do not encrypt file names, so contract names may still leak. There is no central key management or audit trail, and no way to revoke access after the USB stick is lost. Users also forget passwords and may store them on a sticky note or in plain text. For contract terms, use a properly encrypted container or hardware-encrypted USB device with a strong passphrase, managed by policy. Better still, avoid USB sticks for sensitive files and use an approved secure file-sharing service with access expiry. Encryption is only as strong as the key handling around it.