Laptop po'o Meafaigaluega Saogalemu Ki Gaoi i le Fale Kafe po'o le Malae Va'alele: Fa'amateina le Sauniga¶

Ave'esea lau komepiuta feavea'i mai le laulau kofe, kesi faigaluega, po'o le nofoa nofoa i le malaeva'alele a'o ala le lau ma tatala, po'o le iloa o se gaoi na savali ese ma lau ato komepiuta a'o lau FIDO2 hardware security key (YubiKey) sa fa'apipi'i pea i le uafu USB-C, o le fa'alavelave fa'afuase'i fa'afuase'i fa'aletino-i-numera fa'alavelave fa'afuase'i e mafai ona feagai ma se tagata faigaluega mamao po'o se inisinia software. E le pei o se komepiuta feaveai ua gaoia mai se potu faletalimalo (lea e loka ai le disk atoa e pei o FileVault poʻo BitLocker), o le tatala komepiuta mafanafana e tuʻuina atu i le tagata gaoi lau RAM decrypted, tatala password manager (1Password / Bitwarden), ola kuki fa'amaonia su'esu'e, fa'agaoioi AWS / GCP / Azure CLI faʻamaonia, ma le faʻamaonia -/.ssh ki patino i luga o se ipu siliva.

Afai o le gaoi-ma-puʻe e aofia ai le faaoolima faaletino, faomea, poʻo le faʻamataʻu o auupega, alu vave i se nofoaga saogalemu ma valaau lau numera faʻafuaseʻi i le lotoifale (911 i le Iunaite Setete ma Kanata, 112 i le isi itu o le Iuni a Europa, 999 i le Malo Tele; vaai numera fa'afuase'i) ma toe iloilo a matou faomea ma faoa le ola taiala. Aua ne'i tulia se gaoi komepiuta feaveai ua faaauupegaina pe sola i totonu o se auala poo se taavale. Nai lo lena, toso mai lau telefoni mai lau taga i totonu o le muamua 60 sekone ma faatino le faasologa tonu lea o le sauniga-fasiotia ma meafaigaluega-loka le faasologa aʻo felafolafoaʻi. galue komepiuta feaveai gaoia pe malepe a'o faimalaga: MDM loka ma leai-downtime toe faaleleia, fa'afuase'i gaosiga fa'amaumauga fa'amaumauga, git secret leak, ma fa'alavelave fa'alavelave, ma fa'alavelave fa'afuase'i saogalemu galuega mamao ma fa'amaumauga fa'alilolilo.

Fai nei loa¶

1. AUA LE TUA LE GAOI; toso i fafo lau telefoni i totonu ole 15 sekone ma fa'aoso se Loka Meafaigaluega Mamao (Find My / Find My Device / Corporate MDM) AO LEʻI tuʻuina e le gaoi le komepiuta feaveaʻi i totonu o se ato Faraday pe tape le Wi-Fi. A seʻi e se gaoi se komepiuta feaveaʻi o loʻo tatala mai le laulau cafe, e tumau le fesoʻotaʻiga o le komepiuta i le Wi-Fi a le cafe (poʻo le hotspot a lau telefoni) mo le taimi muamua. 30 to 90 seconds a o latou taufetuli i lalo o le poloka:
   • MacBook (iPhone Find My App): Tatala Su'e La'u -> Meafaigaluega -> [Lau MacBook] -> Fa'ailoga Ua Leiloa (Activate) ma fa'aofi se PIN loka 4-i-6-numera. O le taimi lava e taia ai e lena poloaiga le MacBook i luga o le Wi-Fi, e faʻamutaina e le macOS le faʻaogaina o le tagata faʻaoga, faʻamalosia le loka firmware / OS, ma manaʻomia FileVault faʻailoga faʻailoga e toe ulufale ai.
   • Windows 11 Laptop: I luga o lau sailiga telefoni, tatala account.microsoft.com/devices -> filifili lau komepiuta -> tap Su'e la'u masini -> Loka.
2. Afai na feso'ota'i lau komepiuta feavea'i i le Personal Hotspot a lau telefonipoto, AUA LE tapeina lau vevela mo le 60 sekone muamua SE'IA e kilikiina le "Mark As Lost / Remote Lock", ona motusia loa lea pe a mae'a. Afai o le gaoi o lo'o i totonu o le 15 mita (50 futu) mai ia te oe i fafo atu o le cafe, o lau telefoni feavea'i Wi-Fi atonu o le na'o lau initaneti Mark As Lost fasioti le poloaiga i le komepiuta feaveai matala. Faatali mo le 30 sekone mo le loka e faʻasalalau, ona sui lea Personal Hotspot OFF ma le Bluetooth OFF (lea e faʻaoso ai macOS/Windows Dynamic Lock pe a faʻapipiʻi).
3. Valaau le IT Security / SOC Hotline a lau kamupani i lau telefoni (0 to 3 minutes) e fa'ate'a se Global IdP Session Revocation (Okta / Microsoft Entra ID / Google Workspace) MA se MDM Va'aiga Mamao (Jamf / Intune / Kandji). E tusa lava pe fafagu e le gaoi le lau komepiuta feaveai e ala i le jiggling le trackpad ma tape le Wi-Fi, soloia lau Single Sign-On (SSO) refresh and access tokens i luga o le cloud server e mautinoa ai o le taimi lava e toe fesootai ai e le gaoi le komepiuta i soo se initaneti e maua ai le Slack, Gmail, GitHub, po o le AWS, ua mate uma (corporation web, po o le AWS).401 Unauthorized).
4. ** Afai o lau Fa'atonu Pule (1Password, Bitwarden, LastPass, Dashlane, Apple Passwords) na tatala i luga o le komepiuta, DEAUTHORIZE le masini gaoia mai lau telefoni feaveaʻi vave.** Tatala 1Password poʻo Bitwarden i lau telefoni feʻaveaʻi, alu i le Manage Account / Web Vault -> Active Sessions / Authorised Devices, ma kiliki ** Deauthorize / Revoke** i luga o le komepiuta na gaoia, ona sui lea o lau Master Password pe a iai se faʻamaumauga manino.
5. Afai e iai se Key Security Key (YubiKey 5C Nano / Titan Key) na tu'u fa'apipi'i i totonu o le USB port (po'o fa'apipi'i i se ki ua gaoia), saini i totonu o au fa'amatalaga mai lau telefoni e fa'aoga ai lau Ki Backup po'o le Passkey ma TA'E le fa'ailoga patino FIDO2. E ui e mana'omia e le FIDO2 hardware se FIDO2 PIN (4 to 63 characters) mo passwordless resident-key logins, pe a faʻaaogaina e fai ma mea lona lua (U2F / WebAuthn non-discoverable) i luga o se komepiuta feavea'i lea ua uma ona fa'asaoina e lau su'esu'ega lou igoa fa'aigoa ma le fa'aupuga, so'o se tasi e pa'i i le feso'ota'iga capacitive auro i le YubiKey e pasi le 2FA e aunoa ma se PIN.
6. ** Toe soloia ma fesuia'i fa'amaumauga a le au atina'e fa'apitonu'u uma o lo'o teuina i totonu o lau pusa fale (-/.ssh/id_ed25519, -/.gnupg, -/.aws/credentials, -/.kube/config, .env faila, ma le GitHub/GitLab Personal Access Tokens).** E tusa lava pe ua oti le SSO o le ao, o le tagata osofaʻi na te fafagu se komepiuta e le tatalaina le ala e maua ai le avanoa faila faila i soʻo se SSH e leʻi faʻailogaina ma faʻailoga API ao o loʻo nofo i lau tala faʻasolopito (-/.zsh_history / -/.bash_history).

Laau fa'ai'uga: Tatala le komipiuta snatch vs. meafaigaluega saogalemu ki gaoi vs. tau'au fa'ase'e¶

Mulimuli i lenei siata fa'ata'ita'iga fa'ata'ita'iga maualuga i le 15 minute muamua pe a mae'a se fale'aiga, avanoa faigaluega, po'o se fa'alavelave saogalemu i malae va'alele.

flowchart TD
    A["Saogalemu mo Galuega Lautele mo Faalavelave Tutupu Faafuasei (Kafe, Nofoaga e galulue faatasi ai, Malae Vaalele, nofoaafi)"] --> B{"O le a tonu le mea na tupu?"}
    B -->|"Pu'e le komepiuta a'o TALA/Tatala"| C["0-60s: I luga o lau telefoni, fa'aoso Apple Saili La'u 'Mark As Lost' po'o le Microsoft 'Lock Device' -> Vala'au Corporate IT SOC mo MDM Loka/Tape + Global SSO Session Kill"]
    B -->|"Laptop na Gaoi A'o Loka / Tapuni / Tapuni / Pepe"| D["E puipuia e le FileVault / BitLocker le disk i le malologa -> Trigger Su'e La'u / MDM Mamao Tape -> Su'e le upu faataga SSO & soloia sauniga ao malosi"]
    B -->|"Meafaigaluega Saogalemu Ki (YubiKey) Gaoi (Na'o ia pe fa'apipi'i ile komepiuta)"| E["Ulufale i totonu o le IdP (Okta/Entra/Google), GitHub, AWS, ma le Password Manager mai lau telefoni e faʻaaoga ai le Backup Key/Paskey -> Aveese le resitara YubiKey gaoia"]
    B -->|"Fa'ase'e Tau'au / Na pu'eina e se Tasi Lau Mata po'o Lau Keyboard"| F["Loka vave le mata (Cmd+Ctrl+Q / Win+L) -> Alu i le nofoaga tumaoti -> Suʻe le upu faʻamaonia patino / PIN lolomi + soʻo se API ki e iloa i luga o le mata"]
    C --> G["Taofi le faatagaga na gaoia komepiuta feaveai i totonu ole 1Password / Bitwarden Web Vault -> Fa'amuta uma Google / Microsoft / Okta / Slack / GitHub web sessions"]
    E --> G
    G --> H{"Na i ai i le komepiuta komepiuta ki fa'apitonu'u (fale .ssh, .aws, .gnupg, Git PATs, Docker/K8s fa'ailoga)?"}
    H -->|"IOE: Inisinia / Pule / Fa'avae Laptop"| I["Ave'ese .ssh ki lautele mai le GitHub/GitLab & fa'aumau o le gaosiga (`authorized_keys`) -> Ta'e le AWS IAM ki i le Console -> Aveese le GPG key"]
    H -->|"LEAI: Pisinisi masani / Tagata Su'esu'e"| J["Fa'amaonia le feso'ota'iga o su'esu'ega ('Chrome/Edge/iCloud Keychain`) o lo'o saini mamao -> Fa'aulu i le lotoifale Lipoti a Leoleo & Talosaga fa'asao CCTV."]
    I --> J

Vaega 1: Le 5-Minute "Kill Chain" mo se komepiuta feaveai gaoia (Platform-by-platform commands)¶

Pe a se'e se komepiuta feavea'i a'o tatala, aua le faatali se'i e savali i le fale pe faatau sau komepiuta fou e amata ai ona soloia le avanoa. So'o se tasi lava o fa'atonuga fa'aletonu o lo'o i lalo e mafai ona fa'atino sa'o mai lau iPhone po'o le Android telefoni a'o tu i totonu o le fale kofe.

Laasaga 1: Fa'amalosi-loka le faiga fa'aoga mamao (0 to 60 seconds)¶

1. Apple MacBook (macOS):
   • Tatala le Find My app i luga o lau iPhone (pe saini i totonu icloud.com/find i luga o soʻo se telefoni feaveaʻi, lea e pasia le 2FA ina ia mafai ona e faʻaogaina e tusa lava pe na gaoia foi lau telefoni).
   • Tap Measini -> [Lau MacBook] -> Faailoga Ua Leiloa -> Faagaoio.
   • Ae faapefea pe a tape loa e le gaoi le Wi-Fi pe tapuni le tapuni? O le Mark As Lost pe Erase This Device fa'atonu laina i luga o 'au'aunaga APN a Apple ma fa'amu le vaelua-lua le MacBook e soso'o atu i so'o se feso'otaiga Wi-Fi (po'o ala i le Su'e La'u feso'ota'iga). O le tapuni o le tapuni o le MacBook e otometi foi ona lokaina le lau pe afai ** Manaomia le upu faʻamaonia pe a uma le moe poʻo le faʻapolopolo mata e amata ** e mafai.
2. Windows 10 / Windows 11 Laptop:
   • I luga o lau su'esu'ega telefoni, tatala account.microsoft.com/devices, filifili lau komepiuta feaveai, ma tap Su'e la'u masini -> Loka.
   • Afai o se komepiuta komepiuta a Windows e pulea e Microsoft Intune, saini i totonu o le Intune Company Portal (portal.manage.microsoft.com) i luga o lau telefoni -> filifili lau komepiuta feaveaʻi -> tap Gaioiga -> Loka Mamao poʻo le Reset Passcode / Solo.

Laasaga 2: Fa'aoti uma ao fa'ailoga Tasi-I luga (SSO) ma su'esu'ega vasega (1 to 3 minutes)¶

E tusa lava pe fa'agata e le gaoi le Wi-Fi i luga o le komepiuta e su'esu'e ai lau kiliva malo fa'apitonu'u tuusa'o, e i'u lava ina latou fa'afeso'ota'i le komepiuta feavea'i i se pu'upu'u feavea'i po'o le kopiina o lau su'ega. Cookies ma Local Storage SQLite faila i luga o se isi masini e faoa ai au faʻasalalauga i luga ole laiga. Faaleaogaina na faailoga o sauniga i le itu o le server i le taimi nei mai lau telefoni:

Vaega 2: Ae faapefea pe afai na gaoia lou YubiKey po o Meafaigaluega Saogalemu Key?¶

O le tele o tagata faigaluega mamao latou te tuua se igoa maualalo YubiKey 5C Nano fa'apipi'i tumau i le itu USB-C uafu o la latou komepiuta feavea'i, pe ave se YubiKey 5 NFC i luga o se lanyard e se'e ma latou ato komepiuta. E masani ona tupu le fefe: "E mafai e le gaoi ona faʻaoga laʻu YubiKey e ulufale ai i aʻu teugatupe uma? Ma faʻafefea ona ou alu i totonu o aʻu teugatupe e aunoa ma laʻu YubiKey?"

1. Malamalama i le mea e MAFAI ma E LE MAFAI ona faia e se gaoi i lau YubiKey gaoia¶

O se ki fa'aonaponei mo le puipuiga o meafaigaluega (YubiKey 5 Series, Google Titan, Token2, Nitrokey) e lagolagoina fa fa'amaoniga fa'amaonia ma'oti, e tofu ma se fa'amatalaga fa'alavelave e ese pe a gaoia fa'aletino:

1. FIDO2 Fa'ailoga e Maua Mai (Passkeys / Fa'aoga e leai se fa'amatalaga):
   • ** Puipuia e lau PIN FIDO2 (4 to 63 alphanumeric characters).** Afai e fa'apipi'i e se gaoi lau YubiKey na gaoia i totonu o lana lava komepiuta ma taumafai e fa'aoga se FIDO2 Passkey e leai se password, e mana'omia e le YubiKey hardware chip lau PIN FIDO2. A mae'a le 8 matematega sese o le PIN, ona loka tumau lea o piliki a le FIDO2 i le YubiKey ** ma piliki (Factory Reset Required)**, tape uma fa'amaoniga.
2. FIDO U2F / WebAuthn Second-Factor (Username + Password + Touch YubiKey):
   • LEAI SE PIN E MANAʻIA E LE DEFAULT i luga o le tele o upega tafaʻilagi. Afai na gaoia e le gaoi lau YubiKey mai le taga o lou peleue (ma e le o iai lau komepiuta feaveaʻi poʻo lau passwords), e leai se aoga o le YubiKey ia i latou ona e le faʻaalia e le U2F ki poʻo fea uepisaite o loʻo lesitala ai.
   • TATAU MATA'IA IF STOLEN PLUGGED I LOU LAPTOP LE LOCKED: Afai na gaoia e le gaoi lau tatala komepiuta feavea'i WITH le YubiKey plugged i le itu, lou browser's autofill po o password manager ua uma ona tuuina atu le username ma le upu faataga, ma na o le gaoi e tatau ona ** pa'i lona tamatamailima i le auro uamea faamau i luga o le Yubi2Key .
3. YubiKey OpenPGP (gpg SmartCard) & PIV (X.509 Tusi Faamaonia) Applets:
   • Puipuia e se meafaigaluega User PIN (default 123456 pe afai e te le'i suia lava) ma Admin PIN (default 12345678) lena loka ina ua mavae 3 taumafaiga sese. (Afai na e tuua le OpenPGP PIN i le fale gaosi oloa 123456, fa'apea o le ki PGP o lo'o i luga o lena YubiKey o lo'o fa'afefe ma fa'ate'a vave.)
4. YubiKey Static Password / Yubico OTP (Long 44-karacter ccccc... manoa fa'ao'o pe a pa'i):
   • Afai na e fa'atulagaina le Slot 1 po'o le Slot 2 o lau YubiKey e lolomi ai se upu fa'amautu po'o le Yubico OTP i so'o se taimi e pa'i ai le pa auro mo le 1 i le 3 sekone, so'o se tasi o lo'o umia le ki e mafai ona tatala Notepad, tago i le ki, ma faitau lena manoa fa'amau.

2. Laasaga taʻitasi taʻiala e faʻateʻaina se YubiKey gaoia i le 5 minute¶

1. ** Uu mai lau Kisi Puipuiga o Meafaigaluega Fa'asao (pe fa'aoga lau iPhone/Android Passkey / Authenticator App / Backup Codes):**
   • Fa'ata'ita'iga sili (fa'atonuina e le NIST SP 800-63B) o le resitalaina pea a itiiti ifo ma le lua ki fa'aletino fa'aletino (tasi i luga o lau ki/laptop, tasi o lo'o loka i totonu o se sefe po'o atopa'u malaga) fa'atasi ai ma se masini Passkey i lau telefoni.
2. ** Ulufale i totonu o au tala fa'amuamua ma tape NA'O le YubiKey na gaoia i lona Igoa:**
   • Google / Gmail (myaccount.google.com/signinoptions/two-step-verification): Tap Passkeys and security key -> su'e le ki ua gaoia -> tap le Tole Trash icon e aveese ai.
   • Microsoft / Entra ID (mysignins.microsoft.com/security-info): Su'e le Security key na gaoia -> tap Delete.
   • Apple ID (Settings -> [Your Name] -> Sign-In & Security -> Two-Factor Authentication -> Security Keys): Tap le ki ua gaoia -> Aveese Ki.
   • GitHub (github.com/settings/security): I lalo o Passkeys ma Two-factor method -> Security key, kiliki Delete i tafatafa o le ki ua gaoia.
   • AWS Root / IAM (IAM Console -> Users -> Security credentials -> Multi-factor authentication): Filifili le ki saogalemu FIDO gaoia ma kiliki ** Aveese **.
   • 1Password / Bitwarden / Cloudflare / Coinbase / Kraken: Tatala le 2FA tulaga taitasi o auaunaga ma tape le resitalaina o faailoga meafaigaluega na gaoia.

Vaega 3: Fa'atupuina, DevOps, ma SSH/GPG ki suiga (O le -/.ssh ma -/.aws fa'alavelave)¶

Afai o oe o se enisinia software, DevOps/SRE pule, su'esu'e fa'amatalaga, po'o le fa'avae amata na gaoia lana komepiuta tapuni, o le soloia o kuki su'esu'e e na'o le afa o le taua. O se gaoi na te lafoa'i lau lisi o fale e mafai ona maua i so'o se ki fa'ata'ita'iga umi ma fa'ailoga CLI o lo'o teuina o ni tusitusiga manino i lau SSD.

Fa'atino lenei 5-Step Developer Credential Purge mai se telefoni feavea'i po'o le komepiuta feavea'i a le au i totonu o le 15 minute muamua:

1. SSH Ki (-/.ssh/id_ed25519 / -/.ssh/id_rsa): Tusa lava pe puipuia upusii, fa'apea so'o se ki SSH o lo'o uta i totonu ssh-agent i le RAM i luga o se komepiuta e le tatalaina ua faʻafefe. Alu i github.com/settings/keys ma gitlab.com/-/user_settings/ssh_keys ma tape loa le SSH public key a le komepiuta, ma fai i se tasi o au e aveese lau ki lautele mai -/.ssh/authorized_keys i luga o gaosiga uma Linux servers ma bastion hosts.
2. Cloud CLI Fa'amatalaga (-/.aws/credentials, -/.config/gcloud, -/.azure): Tatala le AWS IAM Console -> Tagata fa'aoga -> [Oe] -> Fa'ailoga Puipuiga ma kiliki ** Deactivate / Delete** i luga uma Access Keys (AKIA...). Soloia le Google Cloud gcloud auth OAuth toe fa'afouina fa'ailoga e ala i lau Google Account Tolu-Tolu Itulau Feso'ota'iga (Google Cloud SDK).
3. GitHub, GitLab, npm, PyPI, ma Docker Personal Access Tokens: Alu i github.com/settings/tokens ma kiliki Se'e uma i luga o PAT Fine-Grained ma Classic ghp_... faailoga. Soloia -/.npmrc fa'ailoga (npmjs.com) ma -/.pypirc faailoga.
4. Kubernetes (-/.kube/config) & Terraform (-/.terraform.d): Su'e tusipasi a le tagata o tausia Kubeconfig po'o fa'ailoga OIDC ma soloia fa'ailoga Terraform Cloud API (app.terraform.io).
5. GPG / PGP Saini Ki (-/.gnupg): Fa'asalalau lau Tusi Fa'ailo GPG na mua'i faia (gpg --import revoke.asc ma gpg --keyserver keys.openpgp.org --send-keys [KeyID]) ma tape le ki GPG mai GitHub.

Vaega 4: Tali i le "Shoulder Surfing" (Na pu'eina e se tasi pe matamata lau lau i se cafe / vaalele)¶

Ae fa'afefea pe a leai se tasi na gaoia lau komepiuta feavea'i, ae a'o e faigaluega i le faitoto'a o le malaeva'alele, i luga o se va'alele, po'o totonu o se cafe, e te pu'ea le tagata o lo'o nofo i ou tua po'o le nofoa lata ane ** pu'eina lau lau mata po'o lau piano i lana telefoni feavea'i** (pe sioa sa'o i le avanoa .env faila, fa'amatalaga fa'amatalaga, po'o le fa'ase'ese fa'alilolilo)?

1. Loka vave lau lau i se ki e tasi fa'afoliga:
   • macOS: Lolomi Cmd + Ctrl + Q (loka vave le mata e aunoa ma le tapunia o polokalama).
   • Pupuni: Oomi Win + L.
   • Linux: Lomi Super + L po o Ctrl + Alt + L.
2. Aua ne'i amataina se misa faaletino: Fa'anofo filemu lau komepiuta feavea'i, alu i lou nofoa fa'atasi ma lou tua e fa'asaga i se puipui malo, ma toe iloilo mea na va'aia i luga o lau lau pe lolomi i lau piano i le 10 minute talu ai.
3. Tili mealilo uma na emo i luga o le lau:
   • Afai na e taina lau laupepa login password po'o le password manager Master Password a'o va'aia e se tasi ou tamatamailima, sui vave lena uputatala mai se nofoaga patino.
   • Afai o se faamalama faaiu, .env faila, ulutala Postman, poʻo le faʻamafanafanaga ao na iloa i luga o le lau, faʻapea soʻo se iuga maualuga 4K mea pu'eata atamai i totonu o le 3 mita (10 futu) na pu'eina se ata ma'oti, e mafai ona so'osao o au ki API, ma fa'asolo loa na ki (va'ai fa'afuase'i Zoom po'o Teams fa'asoa mata'i liki).

Le 6-Point "Kafe & Malae Va'alele Fa'amaonia" Lisi Fa'ama'a'i komepiuta (Fa'atonu Aso)¶

Fa'atulaga nei masini ma fa'aoga OS e ono i le taimi nei e tusa lava pe se'i e se gaoi lau komepiuta feavea'i matala mai le laulau a taeao, ** loka le komepiuta a'o le'i oo atu le gaoi i le faitotoa o le fale kofe**:

• 1. Fa'agaoioi le Bluetooth Latalata Loka Auto-Loka (Dynamic Lock luga o Windows / Near Lock poʻo le Apple Watch Auto-Lock i le Mac):
  • Windows 11: Fa'atasi lau iPhone po'o le telefoni feavea'i i lau komepiuta feavea'i e ala i le Bluetooth, ona alu lea i le Seti -> Fa'amatalaga -> Fa'ailoga saini -> Loka Dynamic ma siaki "Fa'ataga Windows e loka otometi lau masini pe a e alu ese". O le taimi lava e tamoe ai le gaoi i le 10 mita (33 futu) le mamao mai le laulau ma lau komepiuta feaveai (pe e te tapeina le Bluetooth i lau telefoni i totonu o lau taga), otometi lava ona loka e Windows le lau.
• 2. Seti se "Su'ega Vevela" ma le 60-Second Battery Idle Screen-Lock Timer:
  • I luga o macOS (System Settings -> Lock Screen) ma Windows (Settings -> System -> Power & battery -> Screen and sleep), seti Tape le faʻaaliga / Manaʻomia le faʻaupuga i luga o le maa i le 1 pe 2 minute pe a faigaluega i nofoaga faitele.
• 3. Fa'atulaga le 1Password/Bitwarden e Loka Vave Pe a Loka le System po'o le mae'a o le 1 Minute Fa'aoga:
  • I le 1Password -> Seti -> Saogalemu, seti ** Loka pe a uma le komepiuta mo 1 minute**, siaki Loka i le moe, ma fa'agaoioi le Touch ID / Windows Hello ina ia aua ne'i e lolomi lau Matai Fa'amatalaga fa'atasi ma fa'amau ki i luma o tagata lautele.
• 4. Manaomia se Meafaigaluega Pa'i MA Fa'amatalaga Fa'amatalaga mo Ta'itasi ssh ma git Fa'agaioiga (1Password SSH Agent pe FIDO2 ed25519-sk Ki):
  • Nai lo le tu'u fa'alilolilo -/.ssh/id_ed25519 faila i luga o lau kesi malo, teu au ki SSH i totonu o le 1Password SSH Agent (lea e manaʻomia ai le faʻamaonia ID ID biometric i soʻo se tasi. git push pe ssh feso'ota'iga) PO'O le fa'atupuina o mea fa'apipi'i ssh-keygen -t ed25519-sk -O verify-required ki e le mafai ona kopiina mai lau YubiKey ma manaʻomia lau PIN FIDO2 i soʻo se faʻaoga.
• 5. Fa'apipi'i i taimi uma se maneta 60-Degree Micro-Louver Privacy Screen Filter (3M / Kensington) i le lautele:
  • E fa'apouliuligia lau fa'aaliga ile lanu uliuli mo so'o se tasi e va'ai mai se tulimanu e sili atu nai lo le 30 tikeri i fafo-totonu, fa'ase'e tauau tauau i le isi va'alele po'o nofoa cafe.
• 6. Aua le tu'ua se komepiuta feavea'i e le'i vaaia mo "Na'o le 30 Sekona" e 'ai ai se kofe pe fa'aoga le Faleta'ele:
  • Ua uma 70 percent O gaoiga o le faleaiga ma le malaevaalele e tupu pe a tuua e le tagata faigaluega lana komepiuta i luga o le laulau mo le 45 sekone e piki se latte i le fata pe fesili i se tagata ese "E mafai ona e matamata i aʻu mea?" Tuu i taimi uma le komepiuta i totonu o lau ato ma ave ma oe, pe faʻapipiʻi se Kensington NanoSaver Steel Cable Lock faataamilo i se faʻavaa laulau faʻamau.

Numera fa'aitulagi o fa'alavelave fa'afuase'i ma fa'atonuga a le lala sooupu¶

A mae'a ona e lokaina le komepiuta feavea'i gaoia ma fa'ate'aina le fa'agaoioiga o le ao (le 5 minute muamua), lipoti le gaoi fa'aletino i pulega fa'apitonu'u ma fa'asao ata CCTV o le cafe/va'alele a'o le'i toe fa'asolo (o le tele o fale'aiga e suitulaga le CCTV i le 24 i le 72 itula):

Iunaite Setete ma Kanata¶

• Fa'atonu Leoleo Fa'afuase'i (Faomea/Suspect i le Va'aiga): Valaau 911. (Afai e i totonu o le malaevaalele, fa'afeso'ota'i le Airport Police / Port Authority Police i le podium pito lata ane ina ia mafai e leoleo ona vavao le gaoi a'o le'i ulufafo i fafo pe oso i se nofoaafi).
• Lipoti a Leoleo e le o ni fa'alavelave fa'afuase'i (Mana'omia mo Inisiua Autasi & Kava Fa'aaitalafu): Valaau 311 po'o le laina e le o fa'alavelave fa'afuase'i a leoleo a le taulaga e maua ai le Numera o Lipoti o Fa'alavelave a Leoleo.
• Federal Cyber/Gaoi Autasi Lipoti: Afai e gaoia se masini a le kamupani ua le tatalaina e iu ai i le osofa'i po o le faoa faamalosi, lipoti i le FBI Internet Crime Complaint Center (ic3.gov) ma CISA (cisa.gov/report) i le US, poʻo le Canadian Center for Cyber Security (cyber.gc.ca) i Kanata.

Peretania¶

• Fa'atonu Leoleo Fa'afuase'i (Faomea/Gaoi o lo'o iai pea): Valaau 999.
• Lipoti a Leoleo e le o Faalavelave Faafuasei & Pulega o nofoaafi/Male Vaalele:
  • I fale'aiga po'o nofoaga o auala: Valaau 101 (pe faila i luga ole laiga ma leoleo i le lotoifale) e maua ai se Numera Fa'asinomaga o Soligatulafono (CRN) vave.
  • I luga o nofoaafi po'o totonu o nofoaafi/Tube stations: Text British Transport Police (BTP) ile 61016 pe telefoni 0800 40 50 40.
• Su'esu'ega o Fa'amaumauga (UK GDPR): Afai na se'e le komepiuta a'o tatala ma o lo'o i ai fa'amatalaga patino a tagata po'o tagata faigaluega e le'i fa'asalaina, logo lau Ofisa Puipuiga Fa'amatalaga (DPO) vave e iloilo pe o se 72-itula UK ICO soli lipoti (ico.org.uk) e mana'omia.

Iuni a Europa¶

• Pan-European Numera Faalavelave: Valaau 112 mo se fesoasoani vave leoleo i totonu o setete uma o le EU.
• Lipoti a Leoleo (Procès-Verbal / Strafanzeige / Denuncia): Asiasi i le ofisa o leoleo lata ane (Commissariat de Police, Polizeiwache, Comisaría de Policía, Questura) e maua mai ai se lipoti tusitusia o le gaoi, ma logo lau kamupani DPO vave i lalo o GDPR Article 33 pe afai na tatala le masini i le taimi o le gaoi.

Ausetalia ma Niu Sila¶

• Fa'alavelave Fa'afuase'i: Valaau 000 i Ausetalia po'o le 111 i Niu Sila.
• Lipoti a Leoleo e le o ni Faalavelave Faafuasei: Valaau 131 444 (Laina Fesoasoani a Leoleo i Ausetalia) po o le 105 (O Leoleo a Niu Sila e le o ni faalavelave faafuasei) e maua mai ai se Numera o Leoleo, ma lipoti le maliega a kamupani e ala i le cyber.gov.au (ACSC) poʻo CERT NZ (cert.govt.nz).

Initia ma Asia ma le Pasefika¶

• Initia: Valaau 112 (Fa'alavelave) po'o le 100 (Leoleo), ma faila vave le e-FIR / Lost Article Report e ala i le faitoto'a o sitiseni leoleo a le setete ina ia iai sau pepa aloaia mo le tapeina o aseta a le MDM ma le CERT-In tausisia.
• Singapore & Japan: I Sigapoa, vala'au 999 (Fa'alavelave) pe faila se lipoti i luga ole laiga ile Singapore Police Force e-Services Portal (police.gov.sg). I Iapani, lipoti vave ile Koban (Pusa Leoleo) po o le ofisa o Leoleo Malae Vaalele e maua ai le Tounan-Todoke (Numera o Lipoti Gaoi).

Fesili e fai soo¶

E tatau ona ou kiliki "Tapeina Lenei Masini" (Tape Mamao) poʻo le "Faailoga Ua Leiloa" (Loka Mamao) muamua pe a gaoia laʻu komepiuta MacBook poʻo Windows e tatala?¶

Fa'aoso i taimi uma **Fa'ailoga Ua Leiloa / Loka Mamao MUA**, ma fa'atali se'i fa'amauina le loka (pe fa'amaopoopo ma lau 'au IT) a'o le'i fa'aosoina se Tape / Ta'i'ese atoa, mo ni mafua'aga taua e lua. Muamua, a `Remote Lock` e la'ititi ma fa'atino vave le microsecond e o'o atu i le komepiuta feavea'i i luga o le Wi-Fi, fa'amutaina le fa'agaoioiga o le laulau ma tapuni le lau i tua o le FileVault po'o le BitLocker encryption a'o fa'asaoina le gafatia o le komepiuta e fa'ailoa lona nofoaga GPS/Wi-Fi i tua e Su'e A'u. Lona lua, afai e te kiliki "Aveese Mai Faʻamatalaga" (e ese mai le tape), e te faʻafuaseʻi ona tape le Loka Faʻagaoioiga, faʻatagaina le gaoi e solo ma toe faʻatau le MacBook mama. Aua lava nei kiliki "Aveese le masini" mai Su'e a'u.

Afai o la'u komepiuta feavea'i na kilia le FileVault (Mac) po'o le BitLocker (Windows), e le puipuia ea a'u faila e tusa lava pe na gaoia a'o matala le lau?¶

Fa'amatalaga fa'amaufa'ailoga atoa (FileVault 2 ma BitLocker) e puipuia fa'amaumauga **i le malologa** (pe a pe le komepiuta feavea'i, moe moe, pe loka i le mata o le mua'i boot/login). Ae ui i lea, a'o e saini i totonu o lau komepiuta ma le mata e tatalaina, o le faʻailoga matai ki o loʻo nofo i le faʻaogaina o le RAM ina ia mafai ai e lau masini faʻaogaina ma polokalama ona faitau ma tusi faila. Afai e se'e e se gaoi lau komepiuta feavea'i a'o ala le lau ma tata'i le trackpad ina ia aua ne'i loka le lau, FileVault ma BitLocker e le taofia i latou mai le kopiina o au faila, o le mea lea e matua taua ai le auina atu o se loka mamao mamao mai lau telefoni ma soloia sauniga ao i le 60 sekone muamua.

Ae faʻapefea pe a faʻapipiʻi uma laʻu iPhone MA laʻu MacBook ua tatalaina i le laulau e tasi: faʻafefea ona ou lokaina e aunoa ma laʻu telefoni mo le 2FA?¶

Na fausia e Apple se faʻalavelave faʻafuaseʻi faʻafuaseʻi mo lenei faʻataʻitaʻiga saʻo: nono se telefoni a le tagata faigaluega cafe, telefoni a se tagata ese, poʻo se komepiuta komepiuta a se uo ma tatala **`icloud.com/find`** tuusao (matauina le `/find` i le pito o le URL). E le pei o le autu `icloud.com` faitotoa, **`icloud.com/find` e mafai ai ona e ulufale i totonu na'o lau Apple ID imeli ma upu fa'aulu e aunoa ma le mana'omia o se numera 6-numera Fa'amaoniga Fa'amaonia**. O le taimi lava i totonu `icloud.com/find`, e mafai ona e tu'u vave uma lau iPhone ma lau MacBook ile **Lost Mode**, loka uma lau ma fa'amalo Apple Pay i lalo ole 30 sekone.

E mafai e se gaoi ona aveese mai a'u ki patino SSH po'o upu tatala mai se YubiKey 5C Nano na gaoia?¶

Leai. O se YubiKey moni e teuina uma ki fa'apitoa FIDO2, U2F, PIV, ma OpenPGP i totonu o se pu'upu'u meafaigaluega a le Secure Element (`EAL6+` fa'amaonia). E le mafai i le tino ma le matematika ona kopi, auina atu i fafo, pe faitau se ki patino *i fafo* o se YubiKey i luga o se komepiuta. Pau lava le tulaga lamatia i se YubiKey gaoia o se tasi e umia faaletino le ki e mafai ona faʻapipiʻi i totonu ma paʻi i le ki auro e * faʻaoga * seia e ulufale i totonu o au tala (GitHub, Google, AWS, SSH `authorized_keys`) ma tape le resitalaina lautele a le YubiKey.

E saogalemu le tuʻu o laʻu komepiuta i luga o le laulau kofe mo le 60 sekone e faʻaoga ai le faletaele pe a ou lokaina le lau (Cmd+Ctrl+Q / Win+L) muamua?¶

Leai. A'o loka lau lau i `Cmd + Ctrl + Q` pe `Win + L` puipuia au faʻamatalaga numera i tua o FileVault poʻo BitLocker, e leai se mea e taofia ai se gaoi mai le savali i fafo o le faitotoa ma lau `$2,500` komepiuta feaveai faaletino i le 4 sekone. O le tu'ua o se komepiuta tapuni e le'i va'aia i luga o le laulau e fa'aalia ai fo'i i le fa'aogaina o masini fa'aletino (e pei o se tagata osofa'i leaga o lo'o fa'aofiina se O.MG Cable, USB Rubber Ducky, po'o le keylogger hardware i totonu o lau uafu USB-C a'o e i totonu o le faleta'ele). Se'i i taimi uma lau komepiuta feaveai i totonu o lau ato faafafa ma ave i totonu o le faleta'ele ma oe i taimi uma.

Punavai ma ta'iala aloa'ia¶

• ** National Institute of Standards and Technology (NIST, United States):** NIST SP 800-46 Rev. 2 Guide to Enterprise Telework, Avanoa Mamao, ma Aumai Lau Lava Meafaigaluega (BYOD) Saogalemu * ma * NIST SP 800-63B Taiala Faʻamatalaga Faʻamatalaga (Multi-Factor Hardware Authenticator Loss and Revocation Requirements).
• Saogalemu Sipi ma Atina'e Saogalemu Ofisa (CISA, United States) & UK National Cyber Security Center (NCSC): Saogalemu Meafaigaluega i luga o le Fegasoloaiga (Loka o Sauniga Faaletino, Loka Latalata Bluetooth, Fa'aitiitia Fa'ase'ega Tau'au, ma Polokalama Solo MDM Mamao).
• Yubico AB: O le a le mea e fai pe a e leiloa lau YubiKey (support.yubico.com) (FIDO2 8-Attempt PIN Lockout, U2F Second-Factor Risk Model, OpenPGP 3-Attempt PIN Lock, and Backup Key Architecture).
• Apple Inc. & Microsoft Corporation: Apple Platform Security Guide (FileVault Volume Enclave, T2 / Apple Silicon Secure Enclave, ma icloud.com/find Leai-2FA Lost Mode Architecture) ma Microsoft Windows 11 BitLocker DMA Puipuiga & Dynamic Lock Technical Documentation.
• Komiti Puipuia Fa'amatalaga a Europa (EDPB): Ta'iala 9/2022 i Fa'amatalaga Fa'alilolilo Fa'amatalaga Patino i lalo ole GDPR (Distinguishing Encrypted-at-Rest Locked Device Gaoi vs. Unlocked Active-Session Device Gaoi).

Taiala fa'atatau¶

• Galuega komepiuta feaveai gaoia pe malepe a'o faimalaga: loka MDM ma leai se taimi malolo toe faaleleia
• Fa'afuase'i gaosiga fa'amaumauga o fa'amaumauga, git secret leak, ma fa'alavelave fa'alavelave
• Fa'alavelave fa'afuase'i saogalemu galuega mamao ma fa'amatalaga fa'alilolilo
• Galue mamao mai se faletalimalo po'o se avanoa le tumau
• Faomea ma le ola faomea
• Numera fa'alavelave