RE: Whole disk encryption

When we were researching encryption for our laptops, we initially looked
at folder/partition style encryption, but settled on whole disk
encryption for a couple of reasons.

Large part of it is our environment. We house all documents stored in
My Documents on our servers, and use folder redirection with caching so
that the users can have access to their documents while off campus. So
for us, saving documents to a encrypted folder and then copying them to
a unencrypted folder so they could use it at their desktop just wouldn't
work.

Another reason we shied away from it is not all sensitive data is stored
in a single location. Auto-save's from programs write temp files all
over the drive which can be extracted later on. Saved passwords in
browsers for accessing applications (whether it's internal or external)
also are a problem. Using Outlook 2003 in cached mode? Now you have a
OST file to worry about. Moving the uses profile directories to the
encrypted partition is an option yes, but now you have a administration
nightmare to contend with.

For our environment, we found it's much easier for end users and
ourselves to have whole disk encryption.

Mike
-----Original Message-----
From: Erik Anderson [mailto:eanders@xxxxxxxxx]
Sent: Thursday, August 24, 2006 2:07 PM
To: focus-ms@xxxxxxxxxxxxxxxxx
Subject: RE: Whole disk encryption

-----Original Message-----
From: Sarah [mailto:sfelske@xxxxxxxx]
Sent: Thursday, August 24, 2006 11:48 AM
To: focus-ms@xxxxxxxxxxxxxxxxx
Subject: Whole disk encryption



What is the consensus of the group on the use of whole disk encryption
in
an enterprise environment?

Why? You only need to protect the data not the whole OS. It causes too
many
problems. I don't recommend creating a headache for yourself when you
only
need to protect some data.

I recommend creating an encrypted partition and mounting an encrypted
file
system on that partition.

In addition there are plenty of 3rd party software packages out there
that
have encrypted filter drivers or will allow you to create an encrypted
virtual disk. You use that disk just as any secondary disk. The
encryption
becomes transparent to you.

Make sure to backup the keys somewhere or you will permanently loose
everything if something happens to the key.

Erik Anderson


------------------------------------------------------------------------
---
------------------------------------------------------------------------
---


---------------------------------------------------------------------------
---------------------------------------------------------------------------

Relevant Pages

  • REPOST: Re: TrueCrypt 4.0 Out
    ... The product stands on its own as one of the best disk encryption ... There are other products that will encrypt the entire disk including ... TrueCrypt product is a decent and trustworthy piece of software. ... Most of the reasons are technically-based. ...
    (sci.crypt)
  • Re: TrueCrypt 4.0 Out
    ... >> They just have a different paradigm for writing software than most of ... The product stands on its own as one of the best disk encryption ... There are other products that will encrypt the entire disk including ... Most of the reasons are technically-based. ...
    (sci.crypt)
  • Attack Scenarios against PGPs Whole Disk Encryption (WDE)
    ... Attack Scenarios against PGP's Whole Disk Encryption ... PGP's Whole Disk Encryption for Microsoft Windows encrypts all the ... As long as standard PC hardware and BIOS is used, the boot code of the disk ...
    (comp.security.pgp.tech)
  • Re: folder prorection
    ... works a bit differently than a folder in that it mounts an encrypted ... this virtual disk is encrypted. ... encryption. ... A freeware OTFE product called "Truecrypt" is ...
    (microsoft.public.win2000.general)
  • RE: [Full-Disclosure] harddisk encryption
    ... If the encryptor encrypts your boot disk, it has to be involved early in the ... boot process and may be broken by anything that changes the system boot sequence. ... normally when the encryption keys had been entered. ... registry controls that allow the swap file to be wiped on shutdown. ...
    (Full-Disclosure)
Quantcast