What do you do to protect company-confidential data on laptops?

Solution 1:

We use TrueCrypt. For laptops we insist on a BIOS password as well.

Solution 2:

Whole disk encryption.

There are quite a few methods for doing this.

I've personally used TrueCrypt, but there are many more options on this wikipedia page.

I also used to work for an accounting company that rolled out PointSec (Now Check Point). Their solution seemed far more complete that truecrypt, but of course, that comes at a price.

Solution 3:

I've used a product called SafeGuard Easy from Utimaco. You couldn't boot the laptop w/o first entering a password. It also encrypted the entire drive. If someone tried hacking the password it progressively increased the timeout between attempts (something like 3X the timeout each attempt, so it would have a crazy-long delay even after only a few incorrect attempts). It had some nice tools for remotely allowing a log-in if someone got locked out via a generated key and it let you set an expiration policy on users.

They had some command line tools so you could push down these changes inside of a config file, which was nice since we could automate that through the primary application they ran on the notebook. If the notebook went missing we knew the user/password would be expiring within a week (even if they knew the password) they'd eventually be locked out.