[ams6110]

That's true, but it's what encrypted filesystems are supposed to prevent. The lesson is that sleep/low power modes are not enough. You should be powering-off or hibernating any time the computer is not in use.

Unfortunately this is against many enterprise policies for desktops, because they like to apply updates during off-hours and need the computers to be on (or at least able to wake up from sleep) to do that.

For laptops, you should configure them to hibernate when the lid is closed, not just sleep.

[snaky]

If their slides are correct, then disabling boot from USB is enough. But then they state

> Using a simple tool, Olle and Pasi learned how to rewrite the non-volatile memory chip that contains these settings, disable memory overwriting, and enable booting from external devices

The phrasing is confusing in that had they find a way to switch 'boot from USB' BIOS setting 'using a simple tool'.