On my work laptop, I have the following (because it's simply harder to do development remotely than it is locally):
- Populated onboarding documents, containing everything you would need to steal my identity. These represent my copy of these contracts.
- A local checkout of our code
- Network passwords (encrypted in the repo, but decrypted locally since I need them to deploy). Working to remove these, but they exist now.
- Complete topology to the entire corporate network.
- Logged in email access with a jucy number of archived emails.
- Logged in to various corporate assets from bug trackers to CMS systems, to git frontends...
Now then, an attacker could certainly grab my open laptop out of my hands, and outrun me, all while keeping the laptop from going into screensaver mode. Not too hard for your average federal arrest, but a lot harder for your average opportunist.
If they get my laptop while the lid is closed, or screensaver active, they get nothing but the laptop. Without FDE, they get everything.
It's all about limiting your attack surface.
> since the connection dropped
SSH connections don't magically terminate, by the way: it requires the server to be configured with connection timeouts, and for your client to be inactive long enough to trigger the timeout.
Otherwise, you can change connections, your computer can go to sleep, you can run on mobile with a terrible connection... all while keeping the same open session.
This means your setup just as vulnerable to pickup-and-run attacks as one protected by FDE, with the added downside of their ability to capture data out of your application caches even if they go the with the opportunistic route.
I agree that while VPNs are painful to setup, the results are worth it and can really simplify access to protected systems, such as not even exposing services like SSH to the public network. Commercial hardware VPN routers have a very good track record--avoid software VPNs if you can (or use dd-wrt if cost is an issue). What's more is AWS also supports connecting to a VPN router. It may be worth it to co-lo a VPN router and access protected assets (including AWS) via a VPN router (you can of course serve public facing traffic directly from AWS).
2/fde is nice when you leave the laptop powered off and unattended, which happens generally every night and during travel, obviously doesnt save you if you get it stolen from your bare hands...
Also, this allows for easy bastion hosts. While some tutorials still miss it, ssh has -W for 5+ years now and it makes creating bastion hosts even easier than when you needed nc in there. Hire a cheap physical server, put OpenBSD on it, run OpenSSH and absolutely nothing else. Firewall off everything from the sensitive servers except this server and there you go. Of course the bastion host does not have any credentials on it, agent forwarding is your friend.
Put your SSH key on a Yubikey NEO, the NEO on your keychain and never ever ever depart with it. Make it a habit not to be plugged into your laptop more than for the few seconds when actually log into a server. Stealing your laptop is pointless now.
If you work remotely then the exposure to social engineering is bigger as all chat facilities become an attack surface. Practice. Create a Skype account with a disturbingly similar screen name to your own Skype account and try to coax passwords out of your colleagues. If there are no static passwords to be had then you automatically win.
To me, full disk encryption was always of dubious value. You are sitting in a cafe someone walks in and suddenly grabs the laptop and runs out the door. What's good your FDE? Instead, have nothing stored locally and work over SSH. Now at worst what the brazen attacker has is the files open in your IDE but can't open any other files since the connection dropped and the yubikey is still with you. Also, when at the border you are not facing any issues since there are no passwords to be revealed (I do not want to get into a legal debate with anyone whether I can be forced to reveal a password. It's easier to not have the issue.). Your laptop boots, runs etc. Just there's nothing interesting on it.
I like the Yubikey as 2FA better than having some sort of 2FA on my phone because the keychain and the Yubikey is a much lower profile target than a phone. You probably have your keychain affixed to your belt/pocket by a carabiner or similar solutions so ordinary pickpockets, casual coffee shop thieves won't easily walk away with it and honestly don't want too much it either -- phones and laptops are too easy a target. (I do not wear it on a neck chain when showering but you can since it's waterproof. Pick your level of paranoia freely.)