I've never considered Tor as a beacon of security, I believe it to be anonymity. If this is secure stuff, you probably want to VPN into a known good host using a hardware token device. Since this is a work thing, they should most likely host the VPN device in their server room with appropriate access to their file servers and intranet.
I've seen several variants of secure laptops. First one is no boot on the disk at all, just a full disk encryption and a bootable CD.
The alternative is generally just full disk encryption.
If you have a super secure laptop that your post leads me to believe you want, you don't want to write to USB ever. This is how data leaks if you ever have the laptop stolen. Instead, enable read-only on the USB ports (you can do this in Windows via regedit, haven't had to do a Linux laptop).
For traveling with secure devices, simply don't travel with the assembled device. Ship the laptop ahead of you, and only travel with the hard drive, which has the sensitive data. The laptop sans drive is mostly useless, and you're acting as the physical courier for the data. The Dell business laptops that only need 1 or 2 screws removed to take out the hard-drive work well for this.
Also use a SSD for FDE, it's just too painful on 5400 rpm.
Think of it this way, when you have a normal system, your write is flushed out to the disk as fast as possible. When you add in full disk encryption, you're going to have to encrypt on write. Your write won't be acknowledged until it's physically on the disk, so the faster your disk is, the faster your write will be acknowledged. Same thing with reads, the faster you can read, the sooner you can decrypt and return the data to the application.
So SSD is definitely the way to go if you want to encrypt the whole disk. If that's too expensive, get a 7200rpm laptop drive.
The amount of time and overhead you have when encrypting on write or decrypting on read is the same for an SSD or HDD. So you're adding the same time lag and CPU overhead in either case. Only with an SSD the time lag is a greater proportion of the total time lag. Also, encrypting a sector means that SSD firmware can't compress it, which some would do. The argument you gave just says... that SSD's are faster. That is not news.
Also, the SSD firmware stores much more metadata about access patterns, which could revert your efforts at keeping your doings private.
Comments
I've never considered Tor as a beacon of security, I believe it to be anonymity. If this is secure stuff, you probably want to VPN into a known good host using a hardware token device. Since this is a work thing, they should most likely host the VPN device in their server room with appropriate access to their file servers and intranet.
I've seen several variants of secure laptops. First one is no boot on the disk at all, just a full disk encryption and a bootable CD.
The alternative is generally just full disk encryption.
If you have a super secure laptop that your post leads me to believe you want, you don't want to write to USB ever. This is how data leaks if you ever have the laptop stolen. Instead, enable read-only on the USB ports (you can do this in Windows via regedit, haven't had to do a Linux laptop).
For traveling with secure devices, simply don't travel with the assembled device. Ship the laptop ahead of you, and only travel with the hard drive, which has the sensitive data. The laptop sans drive is mostly useless, and you're acting as the physical courier for the data. The Dell business laptops that only need 1 or 2 screws removed to take out the hard-drive work well for this.
Also use a SSD for FDE, it's just too painful on 5400 rpm.
How would FDE affect the SSD/HDD decision (in any way that could favor an SSD)?
Think of it this way, when you have a normal system, your write is flushed out to the disk as fast as possible. When you add in full disk encryption, you're going to have to encrypt on write. Your write won't be acknowledged until it's physically on the disk, so the faster your disk is, the faster your write will be acknowledged. Same thing with reads, the faster you can read, the sooner you can decrypt and return the data to the application.
So SSD is definitely the way to go if you want to encrypt the whole disk. If that's too expensive, get a 7200rpm laptop drive.
The amount of time and overhead you have when encrypting on write or decrypting on read is the same for an SSD or HDD. So you're adding the same time lag and CPU overhead in either case. Only with an SSD the time lag is a greater proportion of the total time lag. Also, encrypting a sector means that SSD firmware can't compress it, which some would do. The argument you gave just says... that SSD's are faster. That is not news.
Also, the SSD firmware stores much more metadata about access patterns, which could revert your efforts at keeping your doings private.