Slashdot Mirror
Whole Disk Encryption For Vista?
Q7U writes "After reading about several laptop thefts and losses, my boss wants me to set up whole disk encryption for her Vista travel laptop. After doing some research, it seems she has three options: Bitlocker (part of Vista Ultimate), PGP Whole Disk Encryption, and TrueCrypt. My main problem now is choosing one. I can't find any comparitive reviews of these products to determine which will be the best choice, so I was hoping the Slashdot crowd could suggest which product they would go with and tell us what they liked about their choice."
You could always, you know, type it into Google.
There's a fourth option: SafeBoot. I recently got the basic Administrator training for the product, and it is very nice. Integrates well with enterprise directory services like AD and LDAP, for central deployment of configs, uses decent well-documented standard crypto algorithms and key exchange protocols, and is very transparent in use. All that you see of the encryption is a password entry on boot, everything else is completely transparent.
Mart
"I know I will be modded down for this": where's the option '-1, Asking for it'?
Just truecrypt the saved data.
Beer is proof that God loves us and wants us to be happy.
Hardware based encryption - have IT put in an FDE Drive. While software based encryption options are good, and most certainly better than nothing, the only really secure way to go is Hardware based.
Prediction: The real iPhone killer is going to be sex robots from Japan. Think about it.
Didn't you hear? They found the laptop in the same locked room where they thought it was missing from. So there's really nothing to worry about.
then Bitlocker will work fine. Otherwise you won't have it.
In fact, on a active directory, you can configure bitlocker for your entire network to automatically encrypt volumes and backup the TPM recovery information to the Active Directory if you so desire - http://technet.microsoft.com/en-us/library/cc766015.aspx
Other than that, TrueCrypt works just as well for standalone machines.
throw new NoSignatureException();
They offer total 256bit AES disk encryption with DriveCrypt Plus Pack. It requires pre-boot authetication before you can do anything. It also comes with stronger container encryption, like 1344bit triple blowfish.
... do nothing and wait till your boss forgets about it or decides it doesn't need doing.
I've been happy with Truecrypt. It is easy to use and the performance impact seems to be not that bad. I just make sure to never use sleep mode or anything like that. Just power off and on anytime I use it. I also setup my windows login to automatically log me in. I got tired of typing in one password and waiting for the next password. I figure if someone is good enough to break my truecrypt password then my windows password wouldn't stand a chance, especially if they had decrypted the data.
:wq
One of my previous jobs used thinkpads, and they had stuff built in for security so needed 2 passwords just to get the laptops to start booting up. one secured the bios, the other did the hard drive I believe...
so maybe get your boss to get all new laptops... security is expensive, but it's worth it to get a new PC...
Back when I was a kid, we used KoH and we liked it!
If the Laptop has a TPM chip (many Lenovo Systems do and some Dell's I beleive) Go with something that takes advantage of that hardware. Bitlocker and PGP support it. I'm not too sure about Truecrypt.
Also, if the Hard drive and laptop supports setting a password (Almost all modern drives do. Most laptops do as well) Set a password. Especially if the Drive itself supports native encryption. This adds an extra layer of protection over software Data encryption. Also keep in mind that Native Hard drive encryption is OS agnostic and is usually faster and better overall than many software encryption packages.
Although keep in mind that every protection layer adds more complexity and reduces speed. This is especially true when it comes to data recovery. Make sure your boss understands that if something happens to the laptop, especially Hard Drive damage, The Data on the drive should be considered unsalvagable. Keeping a backup in a secure location (Say a Safe in the Main office also encrypted) is a very good idea.
In Soviet Russia, Trojan exploits YOU!
Comment removed based on user account deletion
Many options are available in addition to the 3 you've mentioned. The "best" choice depends on many factors, such as scalability, cost, and risk. TrueCrypt is free, but really isn't ready for enterprise use. As someone mentioned already, hardware-based FDE (like Seagate's Momentus drive) may very well be the most secure, but requires additional hardware acquisition and a time investment. BitLocker is an option, but requires upgrading to Enterprise or Ultimate (which can be done in-place, without a significant time investment, if I'm not mistaken).
Many other software-based products are out there, such as (off the top of my head) PGP WDE, Secude, WinMagic/SecureDoc, etc. The best option for your boss and your organization depends on multiple factors, factors that Slashdot readers are not privy to.
You may consider Checkpoint Full Disk Encryption (formerly Pointsec).
http://www.checkpoint.com/products/datasecurity/pc/index.html
http://www.ce-infosys.com/english/products/free_compusec.html
Does she even fly at all?
Customs, at least, has been known to demand the keys to a laptop, and having it obviously encrypted could delay travel significantly.
Also, there are significant problems with at least some FDE products, currently -- the "cold boot" cracks, in particular. Does she shut her laptop down every time, or only leave it on standby? Does the software actually purge the key from RAM on shutdown?
Other than that, well, do your own damned homework.
I'd suggest BitLocker, mostly because it's built-in -- kind of like, "What would you suggest for unzipping files in Windows XP?" Well, probably the "Compressed Folder" feature, right?
Under other circumstances, I'd recommend Truecrypt or dm_crypt, because you really should be using open source software for anything sensitive -- but you specifically asked for Vista, so that's fairly moot.
But I haven't done my homework.
Don't thank God, thank a doctor!
I use all three, PGP Whole Disk Encryption on one machine, TrueCrypt on another, and one server has a TPM, so it, and its RAID arrays are BitLocker protected.
Each addresses slightly different security concerns. If you want to encrypt your disk with a password, and that's all you need, any of these will do the trick. If you want a hardware cryptographic token, so a thief can't obtain your encryption key by brute force, go with PGP Whole Disk Encryption, or BitLocker that supports a TPM with PIN functionality.
BitLocker is probably the easiest to implement, as you just install it, run software to check and partition the root disk. Then, save the recovery key on a USB flash drive (well away from the laptop). You can also save the recovery key on a TrueCrypt volume too. Once Bitlocker is enabled, the security of the machine will be the user passwords (especially any user with Administrator rights.) Make sure you have a decently long (16 characters, preferably more than 20) password to log on with. If you use BitLocker with a PIN and the TPM, you can get away with shorter user passwords if you hibernate or shut down.
Disadvantage of BitLocker -- Requires a TPM for decently secure functionality. TPM enabled laptops are rare, and desktops are rarer still, unless you explicitly buy a motherboard with one, or a "corporate" desktop.
TrueCrypt is a very good solution. It is licensed at no charge (donations are recommended), and is very secure. However, its intended for a single user machine. Using multiple passwords with it is kludgy at best. However for a single user, its very secure once enabled, and you burn a TC recovery CD.
PGP Whole Disk Encryption is the most versatile. It can use a TPM, USB flash drive, smart card, eToken, or none of the above, and use multiple ones in a list to authenticate for a hard disk to work. For example, my laptop has an eToken for hardware security, but as an emergency, I have a very long recovery passphrase if the eToken gets lost or someone locks it by too many guesses. Another example is a friend of mine who has a TPM on his laptop, but if that fails for some reason, he has two eToken keys as backup. PGP Whole Disk has a very good reputation, and is by far best solution for a business IT environment.
You can't go wrong with any of the three listed.
I have used it in the past in the banking industry and it works well.
I have useful experience with three products.
SecureDoc from WinMagic is the software solution we use at my big TLA. As administration headaches go, this one isn't so bad. The recovery processes are workable but not (that I can see) hackable by any thief. The way we have it set up, users get 15 shots at screwing up their machine before IT has to get involved, thus allowing most bozos to eventually get it right while not giving infinite opportunites to thieves. It's administrable over the network (in some ways) and, thus, suitable for big organizations.
At home, I still have one Windows machine and it's secured with PGP. I've never used it in a big networked environment so I can't comment on how easy it is to administer. It has one feature that I think is neat, though. You can hit TAB before typing in your passphrase and it will be displayed in clear text. (Normally your pass isn't echoed on screen.) Scoff if you will but on those bad days when I've had little sleep and am, perhaps, a bit hung over, my 59-character passphrase can sometimes be just one hurdle too far. Seeing the text on-screen can be a big help for those times when my head just isn't in the game.
Finally, hardware encryption is better. When my Windows machine was my primary (I now am almost entirely migrated to an Ubuntu installation that I installed from the alternate CD, enabling full disk encryption from the beginning) computer, I relied happily on Flagstone drives. I still have one of their USB Freedom drives for backups. The login schtick is more severe; you get few chances and your data goes bye-bye if you screw up. However, I like the fact that they are a real product, not vaporware like some of the encrypted drives from major manufacturers. You can call them up, give them a credit card number, and actually get the hardware. If you talk to the home office in England, you'll converse with smart, helpful, courteous people. All in all, they're a joy to deal with. Downsides? Prices are high and capacities low, but that's part of the deal when it comes to certified hardware such as they sell. Truly irritating downsides? The documentation, unless they've revised it recently, is not all that it should be. Still, I don't hesitate to recommend them.
At least WinVista and WinXP users have several full disk encryption options, including the opensource TrueCrypt.
But Mac users are out of luck, since no opensource full disk encryption exists for the MacOSX. Neither TrueCrypt or Apple's FileVault support full disk encryption on MacOSX. The only option is the closed source Check Point Full Disk Encryption product.
But if it is not opensource, then I personally would not trust it not to have back doors, especially since multinational corporations left-right-and-center have been falling all over themselves to help the US and other governments spy on the general population.
I will praise the forth option.
I have had a lot of experience personally with using Safeboot in an enterprise (banking) environment for all laptops that we release.
It is integrates very well into an AD environment and is very admin friendly.
On an encryption level we use 512 AES, but you can choose much stronger for the more paranoid among us.
After reviewing the costs of most commercial software for a mid size deployment we decided we could hack it out with truecrypt. I wrote a small database application that stores the recovery iso and the password for each machine (in case IT needs to get into the machine). So far truecrypt has worked great and is easy to install, we just drop an image then start the encryption process. Then we supply the end users with the password needed to unlock their machines (dynamically generated). We don't have to worry about them changing the password because they are not administrators on their computers.
Now if we can just figure out how to prevent them from keeping the password written on a sticky note.
Implements a pre-boot authentication which means the TrueCrypt password has to be entered before the OS boots and can be installed and encrypt of the fly the current OS install and disk.
More info here: http://www.truecrypt.org/docs/?s=system-encryption
But remember, your boss must not be afraid of remembering a strong password and must never write it down.
Did you ever wake up in the morning, with a Zombie Woof behind your eyes? -- FZ
When evaluating these products it's very important to remember that while one of your laptops MIGHT get stolen, MANY of your users WILL forget the password for their laptop and WILL get locked out. So key recovery is BY FAR the most important feature of these products. This really can't be stressed enough.
Which is why I'll tentatively recommend Bitlocker, since it's got the best data recovery capabilities (keys are automatically backed up to the AD server, etc.).
Pointsec was and still is the leader in FDE -- Gartner Magic Quadrant 7 years straight. Check Point bought them in December of '06, and has maintained (read BOLSTERED) the product since the acquisition. P4PC Works VERY well, is fast, and is ridiculously easy to manage.
My team and I conducted a head-to-head with Safeboot, PGP, Truecrypt, Pointsec, and Utimaco about 6 months ago. Pointsec clearly came out on top. In spite of that, management opted to go with PGP (something about a Golf outing???). It was a nightmare! After hours and hours of challenges (and plenty of consultant bills), management ended up canning PGP and went instead with Pointsec.
Deployment of P4PC was a dream. A few things that are nice is that the initial encryption process will run in the background, and can be interrupted (power loss, shutdown, etc). Decryption / forensics / recovery are all well documented and easy to do. Authentication can be done with password, SmartCard, and / or tokens (must be the dynamic kind). There's a helpdesk feature in the event that password resets or one-time passwords are needed.
AT&T recently threw out Safeboot and deployed 600K seats of P4PC.
Oh... Did I mention Linux (RedHat and SuSE) and Mac OSX support?
I switched all my PCs to Vista for the security features (address layout randomization, UAC, protected mode browser, bitlocker) My PCs don't have TPMs so I use the flash drive method (and print out a copy of the recovery password, as well as back the password file up to several other disks). Bitlocker was cake to set up. I did my laptop last night. I had one big partition, vista took care of splitting it into 2 partitions and encrypting. First it tested that my laptop could access the flash drive before booting, and then it encrypted the volume in the background so I could keep watching SageTV. Good show.
http://it.slashdot.org/article.pl?sid=08/07/30/204241&from=rss Just reading that would make me gravitate towards PGP or TrueCrypt.
Fear the penguin.
You work for CheckPoint, don't you? C'mon, you can tell us. It'll be our little secret...
I had such experience of making choice between FDE solutions half a year ago. TrueCrypt 5 had sucked on several Dell laptops. Vista just didn't boot normally, safe mode only. We stopped at PointSec, it's deployed very easily and performs perfect AD integration. But if you are planning to rovide PGP messaging services at the same time, then maybe PGP Desktop would be the better choice. Good luck!
Haha.
You sir, are an ass.
Door is to your left, GTFO.
3laws: No freebies, no backsies, GTFO.
You could try Compusec. Works for me. Takes a while to encrypt the disk the first time though. See here: http://www.ce-infosys.com/english/downloads/free_compusec/index.html
www.jiggedyjoo.com
Bruce Schneier and gang aren't impressed by truecrypts product .
Also gotta look at this from a risk point of view - and as previous mentioned don't forget those border guards in the US!
TrueCrypt is a good idea if this is essentially a one-off standalone machine. Just remember that, given you're talking about Vista, take care during the TrueCrypt installation: it will default to switching the swap file off, which is a good idea in many circumstances (although unnecessary for full-disk encryption) but will kill any Vista system with 1GB RAM.
You can tell this happened to me, can't you? The Vista laptop I tried it on took about 30 minutes to boot with "only" 1GB of RAM and no swap file. ;-)
"If you think the problem is bad now, just wait until we've solved it." --- Arthur Kasspe
Vista Bitlocker is good, but has some issues, as it uses Windows authentication, and not pre-boot. Its two-factor system is kinda weak. If you're a small business worried primarily about casual theft, it's a good solution.
TrueCrypt has pre-boot authentication, which is much more secure. But its encryption implementation is not necessarily FIPS certified, and to my knowledge the system doesn't have common criteria certification. For a business user, the ability to recover a key/password is minimal... so use with caution.
PGP/SafeBoot/Pointsec/WinMagic are all commercial FDE applications that work well, but have specific features that matter moer to some people. PGP is nice because its universal server can provide other services like email encryption as well. SafeBoot has robust management, particularly if you are a McAffee AV customer. Pointsec was the only solution that allowed you to force pre-boot authentication after hibernating the PC. They also have a (very expensive) small business option that doesn't require a server. WinMagic has excellent smart-card integration, and integrates well with PKI solutions.
Conformity is the jailer of freedom and enemy of growth. -JFK
At my work (a large fortune 500 company) we use Pointsec and it works pretty well. I haven't had any problems with it, but I don't know how much it costs, etc.
I've seen this eluded to earlier in the thread, but personally I think it worth looking at HD's that support native FDE instead of a software solution. You don't have the same OS limitations, performance hits, or potential incompatibilities. Nearly all drive manufacturers have announced some sort of native encryption and some are already shipping. We are using Seagate drives today in our Dell systems and its incredibly painless.
http://www.seagate.com/www/en-us/products/laptops/momentus/momentus_5400_fde.2/
And that means she could run VMWare on a Mac, which is only a grillion times more secure for starters. Plus, it's sexier, and accessorizing is everything... Running VMOSX on a screaming AMD and VMXP on a Mac.
While this is tinfoil hat paranoia in the extreme, there is some basis for taking a little heed to it's direction. And that said, I'd like to hear the options that probably cannot be circumvented by various government entities and the worst case is you are handing them a brick.
Being a spelling & grammar Nazi is a sign you do not poses the intelligence to contribute to the conversation
There are several factors to consider such as key management, removable media protection, cost, multiple user logons, and reporting/auditing. Do you want to deal with the VP that changed the pre-boot password so no one else could get their data, then forgot it the next day? If you are using Truecrypt your answer is "did you back it up?". Will you really regret a solution that does not address removable media if that same VP has her sensitive stuff backed up on a USB drive that isn't encrypted inside the laptop bag that gets stolen with the laptop in it. This is a very complex issue; a simple google search can't give you that answer.
I attended a SANS "What Works, Mobile Device Encryption" last year as part of my organizations search for a FDE solution. There are a number of solutions that I didn't see mentioned here. Some googlefu should get you a large selection of products that can meet the minimum criteria. We ultimately went with Utimaco Safeguard Enterprise. It was definitely the best choice for our organization. It even assists with key management for Bit Locker for data recovery. Depending on your needs you may even want to consider Credant which is a file based over whole disk encryption. It does meet most organizations' requirements for protection and streamlines support. The real question you should ask is how do I develop the criteria for selecting a product?
Depending on the number of computers you are concerned with protecting you may want to just move with Truecrypt as a CYA and then reconsider as time permits. It is paramount that you educate your users about their data as part of the process. Otherwise your efforts are futile.
VMWare in an ACE environment is just as secure on Windows as it is on any client down to Windows CE or SUSE Enterprise Desktop, that's the beauty of it. Run whatever you want on whatever base OS you want. The security is the same as you still have your AES or blowfish or whatever encryption method of choice protecting the VM image.
All you need after that is two factor authentication and you're pretty damned secure and you dont have to worry about the host OS as much regardless of your platform of choice.
more info on hardware based encryption... http://www.scmagazineus.com/Crypto-chip-How-the-TPM-bolsters-enterprise-security/article/111865/ IMO best choice FDE drive, they come from Seagate, fujitsu and hitachi. Seagate has best "out of box" solution. FDE is faster, cheaper, easiest to use, easiest to manage. http://www.seagate.com/www/en-us/products/laptops/momentus/momentus_5400_fde.2/ (Since your not managing large numbers you don't need the servers...if you did manage 10-100,000, the servers would be a must, and well worth it) Dell and Lenovo now sell laptops with the choice of FDE drives. check out vendor www.wave.com, awesome customer service (these guys know what they're doing)
I'd suggest going with TrueCrypt.
BitLocker might also be good, but I can't use it on my laptop, as it doesn't have a TPM in it. However, it appears pretty sound, and for laptops with a TPM it comes down to whether or not the user considers the T to stand for trusted or treacherous.
TrueCrypt, on the other hand, doesn't require any particular hardware to work. It does its job completely in software, which could also make for easier recovery if the laptop itself gets damaged -- simply pop the HDD into another machine, type in the same password as usual, and there you go! (Of course, that might also be seen as a security hole.)
I'm not even considering the PGP product as I've never actually encountered it.
Christopher S. 'coldacid' Charabaruk -- coldacid.net
I recommend SafeBoot. It is extensively deployed on all laptops in my client's company and it works great.
If you want a hardware cryptographic token, so a thief can't obtain your encryption key by brute force, go with PGP Whole Disk Encryption, or BitLocker that supports a TPM with PIN functionality.
If the thief can bruteforce any of them, you have sucessfully made contact with a superior alien civilisation and have greater things to worry about. Or it could be the NSA, and then you really should start hoping for the aliens instead.
Seriously, somebody bruteforcing the key is the last thing to you to consider.
I'm surprised that no one so far has made this comparison:
Bitlocker (part of Vista Ultimate) - closed source
PGP Whole Disk Encryption - closed source
TrueCrypt - open source
Write your own Choose Your Own Adventure. http://www.freegameengines.org/gamebook-engine/