Slashdot Mirror
Whole Disk Encryption For Vista?
Q7U writes "After reading about several laptop thefts and losses, my boss wants me to set up whole disk encryption for her Vista travel laptop. After doing some research, it seems she has three options: Bitlocker (part of Vista Ultimate), PGP Whole Disk Encryption, and TrueCrypt. My main problem now is choosing one. I can't find any comparitive reviews of these products to determine which will be the best choice, so I was hoping the Slashdot crowd could suggest which product they would go with and tell us what they liked about their choice."
You could always, you know, type it into Google.
There's a fourth option: SafeBoot. I recently got the basic Administrator training for the product, and it is very nice. Integrates well with enterprise directory services like AD and LDAP, for central deployment of configs, uses decent well-documented standard crypto algorithms and key exchange protocols, and is very transparent in use. All that you see of the encryption is a password entry on boot, everything else is completely transparent.
Mart
"I know I will be modded down for this": where's the option '-1, Asking for it'?
Hardware based encryption - have IT put in an FDE Drive. While software based encryption options are good, and most certainly better than nothing, the only really secure way to go is Hardware based.
Prediction: The real iPhone killer is going to be sex robots from Japan. Think about it.
Didn't you hear? They found the laptop in the same locked room where they thought it was missing from. So there's really nothing to worry about.
then Bitlocker will work fine. Otherwise you won't have it.
In fact, on a active directory, you can configure bitlocker for your entire network to automatically encrypt volumes and backup the TPM recovery information to the Active Directory if you so desire - http://technet.microsoft.com/en-us/library/cc766015.aspx
Other than that, TrueCrypt works just as well for standalone machines.
throw new NoSignatureException();
Hibernation would leave stuff that is in memory open to inspection.
They offer total 256bit AES disk encryption with DriveCrypt Plus Pack. It requires pre-boot authetication before you can do anything. It also comes with stronger container encryption, like 1344bit triple blowfish.
... do nothing and wait till your boss forgets about it or decides it doesn't need doing.
If the Laptop has a TPM chip (many Lenovo Systems do and some Dell's I beleive) Go with something that takes advantage of that hardware. Bitlocker and PGP support it. I'm not too sure about Truecrypt.
Also, if the Hard drive and laptop supports setting a password (Almost all modern drives do. Most laptops do as well) Set a password. Especially if the Drive itself supports native encryption. This adds an extra layer of protection over software Data encryption. Also keep in mind that Native Hard drive encryption is OS agnostic and is usually faster and better overall than many software encryption packages.
Although keep in mind that every protection layer adds more complexity and reduces speed. This is especially true when it comes to data recovery. Make sure your boss understands that if something happens to the laptop, especially Hard Drive damage, The Data on the drive should be considered unsalvagable. Keeping a backup in a secure location (Say a Safe in the Main office also encrypted) is a very good idea.
In Soviet Russia, Trojan exploits YOU!
In the last decade? Try in the last week. I regularly deal with people with that kind of connection (often CDPD with a high-gain antenna). Far north conservation officers, for example.
upon the advice of my lawyer, i have no sig at this time
I use all three, PGP Whole Disk Encryption on one machine, TrueCrypt on another, and one server has a TPM, so it, and its RAID arrays are BitLocker protected.
Each addresses slightly different security concerns. If you want to encrypt your disk with a password, and that's all you need, any of these will do the trick. If you want a hardware cryptographic token, so a thief can't obtain your encryption key by brute force, go with PGP Whole Disk Encryption, or BitLocker that supports a TPM with PIN functionality.
BitLocker is probably the easiest to implement, as you just install it, run software to check and partition the root disk. Then, save the recovery key on a USB flash drive (well away from the laptop). You can also save the recovery key on a TrueCrypt volume too. Once Bitlocker is enabled, the security of the machine will be the user passwords (especially any user with Administrator rights.) Make sure you have a decently long (16 characters, preferably more than 20) password to log on with. If you use BitLocker with a PIN and the TPM, you can get away with shorter user passwords if you hibernate or shut down.
Disadvantage of BitLocker -- Requires a TPM for decently secure functionality. TPM enabled laptops are rare, and desktops are rarer still, unless you explicitly buy a motherboard with one, or a "corporate" desktop.
TrueCrypt is a very good solution. It is licensed at no charge (donations are recommended), and is very secure. However, its intended for a single user machine. Using multiple passwords with it is kludgy at best. However for a single user, its very secure once enabled, and you burn a TC recovery CD.
PGP Whole Disk Encryption is the most versatile. It can use a TPM, USB flash drive, smart card, eToken, or none of the above, and use multiple ones in a list to authenticate for a hard disk to work. For example, my laptop has an eToken for hardware security, but as an emergency, I have a very long recovery passphrase if the eToken gets lost or someone locks it by too many guesses. Another example is a friend of mine who has a TPM on his laptop, but if that fails for some reason, he has two eToken keys as backup. PGP Whole Disk has a very good reputation, and is by far best solution for a business IT environment.
You can't go wrong with any of the three listed.
Just truecrypt the saved data.
Because there are too many "gotchas" to not do FDE these days. Did you configure all your applications to only cache/auto-save/etc to the "secure" area of the drive? Did that last update to application Y override those changes? What about hibernation mode? The pagefile?
I have useful experience with three products.
SecureDoc from WinMagic is the software solution we use at my big TLA. As administration headaches go, this one isn't so bad. The recovery processes are workable but not (that I can see) hackable by any thief. The way we have it set up, users get 15 shots at screwing up their machine before IT has to get involved, thus allowing most bozos to eventually get it right while not giving infinite opportunites to thieves. It's administrable over the network (in some ways) and, thus, suitable for big organizations.
At home, I still have one Windows machine and it's secured with PGP. I've never used it in a big networked environment so I can't comment on how easy it is to administer. It has one feature that I think is neat, though. You can hit TAB before typing in your passphrase and it will be displayed in clear text. (Normally your pass isn't echoed on screen.) Scoff if you will but on those bad days when I've had little sleep and am, perhaps, a bit hung over, my 59-character passphrase can sometimes be just one hurdle too far. Seeing the text on-screen can be a big help for those times when my head just isn't in the game.
Finally, hardware encryption is better. When my Windows machine was my primary (I now am almost entirely migrated to an Ubuntu installation that I installed from the alternate CD, enabling full disk encryption from the beginning) computer, I relied happily on Flagstone drives. I still have one of their USB Freedom drives for backups. The login schtick is more severe; you get few chances and your data goes bye-bye if you screw up. However, I like the fact that they are a real product, not vaporware like some of the encrypted drives from major manufacturers. You can call them up, give them a credit card number, and actually get the hardware. If you talk to the home office in England, you'll converse with smart, helpful, courteous people. All in all, they're a joy to deal with. Downsides? Prices are high and capacities low, but that's part of the deal when it comes to certified hardware such as they sell. Truly irritating downsides? The documentation, unless they've revised it recently, is not all that it should be. Still, I don't hesitate to recommend them.
Riiiiiiiiight. Because your solution works really well on airplanes, client-sites w/o internet access, or anywhere else where network access may not be available.
Good job on coming up with novel solutions to difficult problems. Are you in middle-management by chance?
When evaluating these products it's very important to remember that while one of your laptops MIGHT get stolen, MANY of your users WILL forget the password for their laptop and WILL get locked out. So key recovery is BY FAR the most important feature of these products. This really can't be stressed enough.
Which is why I'll tentatively recommend Bitlocker, since it's got the best data recovery capabilities (keys are automatically backed up to the AD server, etc.).
Wow, it amazes me that people are so quick to be dicks to each other. What the fuck is wrong with the world? Couldn't you have said the same thing but without the venom? Oh yeah, fuck you.