There are certainly other defenses. I patched my kernel with TRESOR, so the key for my full disk encryption lives in the debug registers of my CPU and stays ou

There are certainly other defenses. I patched my kernel with TRESOR, so the key for my full disk encryption lives in the debug registers of my CPU and stays out of RAM. The encryption operations are all performed directly on the CPU utilising its AES-NI instructions. So even if you manage to read my RAM, you wont get my full disk encryption key. I wrote up how I did this (and loads of other things) at https://grepular.com/Protecting_a_Laptop_from_Simple_and_Sophisticated_Attacks https://grepular.com/Protecting_a_Laptop_from_Simple_and_Sop... EDIT: Of course, my RAM may contain other compromising data than my encryption key. So yes, I do shut it down when it's not attended, and have disabled firewire etc. Lots of details about other things I've done are at that blog post.