Wow... necro-posting because this is the first I've seen of this thread, and you might still be looking for help.
You are very practical to consider the things you have.
Firewall: YES (Not that it provides more than a first line of defense, but ya gotta start somewhere.) Close off any ports you don't actually use, and only open them at need.
DNS to open server: This is more a matter of portability than security. If you hop connections a lot, yeah, doing this will help make everything just work.
Sensible passwords: Define "sensible". Use strong, difficult-to-guess passwords. There's a good discussion on password entropy in the form of an amusing webcomic
here. (Yes, I loves me some XKCD...)
TrueCrypt: Oh, Heck Yes! Properly configured, this stuff baffles even the FBI (but I wouldn't bet against the NSA...) Read the docs, configure it to meet your needs, and you'll be good to go.
Decoy user account? Nah... that's called security through misdirection/obfuscation. It might keep out the curious and the kooky, but a determined data thief will blow right by that stuff. Remember that user accounts take up space and other resources.
BIOS Passwords, though, can be more trouble than they are worth unless you're dealing with truly sensitive and valuable data. If you set a BIOS password, test it and then put it on an index card in a safe somewhere. You don't want to have to deal with trying to bypass a BIOS password on certain machines. (Some are a lot easier than others, but there are a few notable ones for which BIOS password being lost means a trip back to the manufacturer and proving you own the machine.)
Your best protection measure will be to keep the machine out of sight behind a lockable compartment when not in use. Once an attacker has physical access, nothing short of TrueCrypt will keep them from obtaining your data.
Consider a lockable hard-shell case (e.g., Zero Case, SKB, or Pelican, just to name a few). They tend to be expensive, but will prove worth it first time someone drops it trying to "help you out".
Good to see someone else thinking about security - NASA lost another laptop last month so we're finally getting Data-At-Rest protection at work on all laptops. (I just wish they hadn't gone with Symantec...{grumble, grumble - proprietary crap}.)
Here's hoping you never
need all that security.
Later ON,
D
