Slashdot Mirror
Only 27% of Organizations Use Encryption
An anonymous reader writes "According to a Check Point survey of 224 IT and security administrators, over 40% of businesses in the last year have more remote users connecting to the corporate network from home or when traveling, compared to 2008. The clear majority (77%) of businesses have up to a quarter of their total workforce consisting of regular remote users. Yet, regardless of the growth in remote users, just 27% of respondents say their companies currently use hard disk encryption to protect sensitive data on corporate endpoints. In addition, only 9% of businesses surveyed use encryption for removable storage devices, such as USB flash drives. A more mobile workforce carrying large amounts of data on portable devices leaves confidential corporate data vulnerable to loss, theft and interception."
We would do it if we werent undermanned, underfunded, and had competent users.
Support for things is already maxing many people out, now you want to add this?
Please.
I telecommute and all my work is stored on the server I remote into.
As I have no work stored locally there is no encryption (aside from the VPN into the server).
Yeah, blame the users, that will always make up for the fact that they depend on you to take care of these things for them.
There are corporate docs using Office 2003 DRM where I work. I'm literally the only person in a multi-national company that can read the docs because I'm the only one who applied the hotfix for the expired certificate.
IT can't or won't do it through the domain.
I'm a consultant. I have honestly NEVER encountered any user at any company encrypting disk/usb/cd/dvd/email.
Exactly where does this BS stat come from again?
I have to wonder how much of this data that most people deal with in a work from home, telecommuter lifestyle is really that confidential. It seems to me even those with cut throat rival competitors where corporate espionage is the accept norm would find little value in much of the information they could gain by sifting through the virtual in boxes of these people. After all its not like your likely to find the super secret plans for the new product, instead you are likely to find random puzzle pieces that give no clue as to the big picture. Some email exchange about being mis-billed for janitorial supplies here, someone talking about the revising the employee lunch schedule, and then a bit of gold, a 23 page spreadsheet file projecting the cost vehicle fleet utilization.
Using encryption has its drawbacks: .vs. ipsec) doesn't work well with encryption
* you must provide a meaningful key management
* you lose speed of your machines for number crunching
* you can easily lose data in the event of hardware corruption
* access to data is a bit harder even for legitimate purposes
* many systems (for example Active Directory domain controller
* skills of your systems management must be higher
As a road warrior I should be using encryption, right? I would be a perfect candidate for it? And yet there is no way I will encrypt my laptop when I travel. The risk of losing access to the data when something goes wrong is far too dangerous to risk it. I have had problems on the road already, yet I have always managed to recover my data either from my laptop or from backups, but what happens when the decryption mechanism or the OS crashes? Carry another laptop? Carry bootable USB-based decryption tools? Sorry, too many variables, too much potential for trouble.
It all comes down to a simple calculation - what is the mathematical probability of someone stealing my drive vs. my OS or disk crashing?(1) Anyone who has traveled knows the second far outweighs the first.
(1) As long as it is unencrypted, you can still recover it relatively easily.
End anonymous moderation and posting on
The two Global IT outsourcers I worked for had us encrypt for Lotus Notes and Outlook, remote VPN connections, and when we connected to network devices on shared or owned customer space it was always SSH or SFTP.
That said, for much of the older legacy stuff that was deep inside each company's infrastructure it wasn't so much required.
"Beer is proof that God loves us and wants us to be happy - Benjamin Franklin"
At some point, organizations will realize they actually were vulnerable, and will swarm to adopt new security policies.
A lack of security, in this case, ends up creating security... job security.
Someone flopped a steamer in the gene pool.
That is a larger percentage then I expected. I wonder if the statistics were collected by asking people if they used it, and the percentages were more the amount of people who knew they should be.
So long as you don't work for Equifax, Choicepoint, the IRS, FBI or any other organization that's going to have my SSN on your Laptop. :)
"Beer is proof that God loves us and wants us to be happy - Benjamin Franklin"
Heh-heh. Which ones?
100% Agree. The simple fact is if I encrypt it here I can't un-encrypt it there. Translation. My hard disk uses version 1.5.3.6.3.222.43..56666.333 of software BLOTZO.supersafe.org and nothing else I own does. My HD goes cactus I'm screwed.
I simply can't trust that I can recover from a failure. Even if I carry the magic secret key to the encryption.
It'll cost "me" more to recover than to have stolen.
P.S. I will go down on assault charges the next time some moron un-plugs my usb drive without safely ejecting it.
So long as you don't work for Equifax, Choicepoint, the IRS, FBI or any other organization that's going to have my SSN on your Laptop. :)
That's another problem altogether - that kind of information should never be carried on one's laptop, period. It should only be accessed through a secure tunnel, and it should reside at HQ. There it should be encrypted.
End anonymous moderation and posting on
It depends on your job. If you're, say, a marketing consultant, encryption probably isn't all that important. If you work for a credit card processing company (I previously worked in the IT department for one) you absolutely should be using encryption.
we geeks haven't made it easier to use.
expandfairuse.org
Am I the only one who read that initially as: 27% of Orangutans? I thought that was a pretty good number for an ape.
There is no way it is that high.
It all comes down to a simple calculation - what is the mathematical probability of someone stealing my drive vs. my OS or disk crashing?(1) Anyone who has traveled knows the second far outweighs the first.
I would go even further - What is the mathematical probability of someone stealing my [laptop] AND be interested enough in the data on the disk to bother trying to get access to it.
Even without encryption, getting access to the data on a laptop which uses OS password authentication requires some time and knowledge. I would argue that most people who steal laptops would reinstall as soon as they see a login screen. In other words, the hardware is more valuable to them than the data.
Be sure, I'm not saying the risk is zero, but it's pretty low.
Orlando
-= This is a self-referential sig =-
100% Agree. The simple fact is if I encrypt it here I can't un-encrypt it there. Translation. My hard disk uses version 1.5.3.6.3.222.43..56666.333 of software BLOTZO.supersafe.org and nothing else I own does. My HD goes cactus I'm screwed.
I simply can't trust that I can recover from a failure. Even if I carry the magic secret key to the encryption.
It'll cost "me" more to recover than to have stolen.
P.S. I will go down on assault charges the next time some moron un-plugs my usb drive without safely ejecting it.
Which is why the correct response to "Oh dear my OS has failed and I now can't recover any of the encrypted data that was on the hard disk" is NOT "I'll have to crack out the bootable USB rescue disk that has never been properly tested and cannot possibly work in all circumstances".
The correct response is "Oh well, that's what the backup is there for".
(How easy it is to enforce your users not storing data on their laptops - or if they must do so guaranteeing they have a working backup facility in place - is another issue altogether).
There's one use for encryption people don't generally discuss: tech service.
I've been running a home server for a long time. Such systems over time accumulate years worth of mail, which will contain private data, website passwords, and so on. I personally feel uncomfortable with sending a disk containing years worth of data to a tech support department when I want to say, get it replaced under warranty. There have been a few stories about underpaid techs looking for music and porn on customers' hard drives. And if the disk is broken I can hardly erase it properly.
So my solution:
For servers, encrypt the disk, and keep the key in an USB drive always plugged into the server. If a disk breaks, I remove the disk, and send it for warranty replacement without worrying about the data.
For laptops, I use Ubuntu's disk encryption. It's even better there as laptops usually don't have RAID, and may break for multiple reasons that I can't personally fix.
If you run a cleaning company or you're a group of plumbers or perhaps you have a fairly large landscape gardening company then your data just is not that important or a target. So this survey is really quite useless, so what is Agnes Cleaners do not encrypt their thumb drives with their cleaning rota on it? Nobody cares. So whilst all organisations should encrypt just because it is sensible, not all organisations really need to bother because the likelihood of anything happening to their data is so small that it's just not worth the effort of sorting out the idiots who call up the part-time IT admin guy because they have forgotten their encryption key (again).
I'm not exactly sure I'd call "throw a Linux Live disk" or "unscrew the HDD compartment, remove the disk and hook it up to a desktop" things that require much time or very much knowledge.
Chances are that thefts probably are to sell it and that they aren't interested in the data, but companies still shouldn't want to risk it (particularly if they work in a more sensitive environment with customers other than the standard commercial players).
And if your OS fails to boot, you will need to carry bootable media with you in any case.
There are also hardware encrypted drives, OS independent, no performance hit, no software to become corrupted... The only thing that would stop you getting at your data is a hardware failure, and a hardware failure will break an unencrypted drive just as badly.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
There do exist packages that can handle the encryption of at least fixed disks without the user needing to do anything more than the usual login. BitLocker for one (and BitLocker can plug into Active Directory easily)
With the right software, it is possible to protect the fixed disks of all PCs in the enterprise (including laptops that may only connect to the network through a VPN or may be used in places where there is no network access at all such as airplanes) and the only thing the users have to do is to log in just like they normally do. Mobile devices like Blackberries and Windows Mobile devices also have options for encryption that IT can enable. Even email can be encrypted without the users doing anything special using modern versions of Exchange (at least from what I read with Google)
How about Agnes Cleaners' contact database, containing all their customer records?
I also use a laptop often. However, I use TrueCrypt or BitLocker on Windows, and PGP WDE on my Mac. Why? Because if my laptop was stolen, I'd rather have it be "just" a hardware theft that I can get a police report, file a claim on my insurance, and replace my hardware. Without encryption, I would have not just a hardware theft, but a possible theft of:
* License keys to the OS and apps. A volume license key for a popular app is a boon for pirates.
* Personal Documents on the hard disk which can be used for ID theft, or used in combination with burglars to make finely targeted violent crime.
* Work documents. You would be surprised who has extremely company confidential material on personal machines because they need it for a remote presentation to a client. It could be something as simple as a roadmap of unreleased products that a prospective customer wants, but in the hands of competition, it would mean a major competitive loss.
* Passwords stored in a password manager, either the Web browser or another utility. I use different passwords for every Web site I go to, so if one site doesn't get compromised, it won't mean anything else does.
* Cached files. You can glean a lot of information even from deleted files about someone, the people they associate with, their job, and such.
* Identity. How many people put their Quicken files on a protected disk image or TrueCrypt partition, and make sure to unmount it when done balancing the checkbook?
* VPN settings. Even if someone doesn't know my VPN password, they will have account information, IP, and port number, and from this, they could try at the very minimum a brute force attack which either will work, or will have the account get denied. This would look very bad as an employee.
* Identity in another sense. A criminal can take a laptop and then masquerade as another individual to give the police someone to target and arrest.
On the road, I also take measures to contain data loss. I have a custom U3 USB flash drive that has a BartPE image on the CD part. I then have another USB flash drive with two TrueCrypt volumes on it. The first holds an OS image that I made before going on the trip. The second TC volume holds backup copies of my documents. Finally, I use a cloud computing backup service (using a keyfile so the documents leave my machine encrypted), so I am assured of fairly recent backups automatically. For maximum security, I keep a smart card on my keyring which can be used with PGP or TrueCrypt to ensure that if I have the smart card with me, no attacker is going to be able to mount those volumes.
USB flash drives are small, easily encrypted if you use known good software like TrueCrypt, Apple's Disk Image utility, LUKS, or EncFS, and easy to put in some sort of case (even a Ziplock bag) so they don't get lost in a laptop case.
a hardware failure will break an unencrypted drive just as badly.
I have found myself in a situation where my laptop was field-unrecoverable. Yet, since I carry a fairly common model of a Thinkpad, I was able to borrow one from the site I was visiting, and a simple drive swap solved the problem.
End anonymous moderation and posting on
As someone else pointed out, as you move up in the size of business, you're more likely to encounter encryption and more stringent security policies. There are definitely many exceptions though on both ends of the spectrum.
I'm also a consultant, and personally all the user information on my laptop is encrypted. I don't want to ever have to explain to a client that my laptop was stolen with any of their sensitive data available on it.
www.clarke.ca
Does Agnes Cleaners work for anyone with a medical condition that requires a cleaning support staff? That service may even be paid for in whole or part by a public (Medicare) or private health insurer.
HIPAA!
Companies massively use emails, even for very sensitive business information. While I was still sysadmin, I was amazed to see all this mass of unencrypted and even unsigned emails passing through! I did try to make people sensitive to the issue (I wasn't in charge of the outsourced mail part), but only making the white collar people understand the advantages of using something like PGP was a hell... Encrypting stuff on the hard drive is all very nice, but as long as their emails will be transiting in clear form, I'm pretty sure no one will even bother trying to get into their hard drive...
mono = evil
I would go even further - What is the mathematical probability of someone stealing my [laptop] AND be interested enough in the data on the disk to bother trying to get access to it.
Two words you might want to consider...
"industrial" and "espionage"
Software installed and versions for further hacking attempts on the rest of the infrastructure.
Sales, marketing, pricing information. Release timing information.
Source code in products.
You name it.
The information is almost certainly far more valuable than the hardware, to the right people.
Deleted
If you have sensitive customer data on your computer, by law you may be required to notify those customers if the data is lost. Or, you may decide that morally it is the right thing to do. Therefore, you also have to balance the potential bad press your company's announcement will generate based on you losing your laptop, whether or not you know that the people who stole it are going to access the data.
Risk management is more than just the likelihood of your laptop being stolen and your data being accessed by criminals. It's about the significance of each risk as well. Given that for many people, having a laptop stolen and having to disclose that fact is a huge negative, having encryption can mitigate or eliminate that risk.
www.clarke.ca
With the right software, it is possible to protect the fixed disks of all PCs in the enterprise
Unless of course you actually want to use your computer. Then you discover how painfully slow it is. How it happily encrypts your USB drive too, rendering it useless. You take a power point presentation with you and look like a fool in front of your customers because it's encrypted and they can't display it on the projector from you thumb drive.
Seriously, the windows software-based hard disk encryption solutions right now are total POS.
Moderating "-1, Disagree" is simple censorship. Have the guts to post your opinion.
but what happens when the decryption mechanism or the OS crashes? [...]
It all comes down to a simple calculation - what is the mathematical probability of someone stealing my drive vs. my OS or disk crashing?(1) Anyone who has traveled knows the second far outweighs the first.
(1) As long as it is unencrypted, you can still recover it relatively easily.
Well, I'm not sure what encryption solution you might have tried. I for one have been using first TrueCrypt and then LUKS on a laptop. It traveled far and its hard disk drive already had to be replaced twice. There never were any particular pains with encryption.
First and most important of all, backups and encryption do not interfere. So you obviously DO backup such a laptop that may get stolen, lost, or break completely. Certainly, if you use encryption, you want to have the software needed to decrypt an encrypted partition it on your backup or a live DVD, but that's nothing that's hard to get.
Even filewise recovery and forensics is possible on an encrypted partition, too - as long as you have the master encryption header (or similar) backed up, there's little chance for additional problems introduced by having encryption in case of a recovery.
Who really cares about contact databases? They're just a bunch of public info - stuff in business cards. Unless Agnes Cleaners is a CIA front company it'll be no big deal.
It's likely that their customers already list themselves on the "Agnes Cleaners Facebook fan page" and post stuff like "hey I'm going to Florida, but I've changed the locks - stupid lock broke, so you can find the key under the doormat".
Most people don't care about secrecy. And in most cases it doesn't matter, because fortunately most people don't pick a _petty_crook_ career (the smart amoral/evil people pick careers which allow them to _legally_ take lots of money from stupid people).
If the contact databases got destroyed or became inaccessible it could affect their business. Agnes Cleaners might care about that. But they don't need crypto for that - just decent backups.
If all encryption software are like those from checkpoint, i understand those numbers...
Does BitLocker have the limitations you refer to?
Good point, Sheila's Cleaners may get their contact database and steal all their business. This is why we should all hire a "Independent Mac and iPhone contractor, specialising in security issues." to make sure that we don't get pwned like this.
Now I have tried Sheila's cleaners and they are just not as good. For one, they didn't clean the table under the tablecloth and then they didn't iron my boxers.
Bitlocker is as far as I can tell not available for windows XP which makes it unavailable to most corporate users.
With the slow speed of migration from windows xp bitlocker is hardly something available to most.
I have no idea if this is at all a best-practice (nost likely not), but I still feel like sharing how encryption is used in our 2-person office.
I set up disk encryption (with dm-crypt) for the linux server data drives and their backup drives only. The (Windows) desktop clients are dumb machines in the sense that no data stored localy, except installed applications. All work is done on files on the server directly.
My main worry is that someone walks away with the server machine and/or the backup drives and has access to all company relevant data of the past 20 years.
The server is unlocked with a keyfile stored on a USB flash drive, which is stored in a safe. The only time it is needed is when the server gets rebooted (practically never). The keyfiles for the external backup drives are stored on the local encrypted server partion. They get read every time the backup drives are switched and mounted. All drives aditionally share a common master keyphrase, in case the USB flash drive dies.
I am aware that this scheme has it's holes, unencrypted temporary data on the Windows host being the most obvious. What worries me most though is unencryped e-mail transfer and no tamper-safe documents formats. PDF would be great as common all-purpose distributable document format, but it's protection is a joke. I'll be happy to hear comments on how to improve my setup, but keep in mind we are small shop and won't be investing in dedicated appliances or any of that nature.
RDP supports 128bit encryption. you fail.
If you mod me down, I will become more powerful than you can imagine....
Seriously, what makes you think there would be any corporate data on my home computer when I work from home? Allowing anything like that is just insane. No sane organisation would ever allow that. (Obviously the UK government is no sane organisation by that definition).
While Bitlocker certainly slows down my laptop a bit (i did benchmarks, about 10%), i can't complain about it being slow.
ThinkPad W500, 4GB RAM, Windows 7 Enterprise x64, OCZ Vertex 120GB with TRIM Firmware.
Our end users mostly have ThinkPads T500, 4GB RAM, Windows 7 Enterprise x64 with the normal 7200 RPM hard drives. They also don't complain about their laptop is slow.
For USB sticks, we do not mandate them to be encrypted. This, of course, shifts all the blame in case of data loss to the end user. Which is fine by me.
thousands of businesses are using plain FTP and email to throw unencrypted files around to & from other companies daily.
In fact, RDP since Windows XP/2003 can use SSL/TLS, but i believe it default to a 56bit RC5 cipher without configuration and/or group policies in effect.
SSL/TLS was made the default with WS08/Vista.
I've seen disk encryption set ups where you never have to supply an outside key or password to start up the computer--it's all self contained. Meaning that all the information necessary for decryption is being kept on the disk. Yeah, that's secure.
I'm not exactly sure I'd call "throw a Linux Live disk" or "unscrew the HDD compartment, remove the disk and hook it up to a desktop" things that require much time or very much knowledge.
You wouldn't call it much knowledge, but you're reading Slashdot, right? The vast majority of laptop thieves wouldn't know or care how to do this.
-= This is a self-referential sig =-
No, it's kept in the TPM.
While this isn't perfect, such a scheme will prevent anyone except targeted industrial espionage from accessing the information. If you're a small company with no special IP, this is a good-enough approach that keeps support costs low.
The clear majority (77%) of businesses have up to a quarter of their total workforce consisting of regular remote users.
And my left arm is made of up to 75% cheese.
Is it just me, or is that line a little misleading?
Brain surgery - it's not rocket science!
The amount of data in typical business documents and email now vastly exceeds the amount of data you need to push out to a thin client to provide a good user experience. Why not leave the hard drive and all of the data they contain in your home office and only take home the keyboard and screen to display it with (which DOES use an encrypted channel back to the data center). That's what my company does and if a Sun Ray thin client or Gobi laptop ever goes missing, so be it, pull another one off the shelf and keep typing where you left off.
So, your data is so important that you cannot deal with losing access to it, but not so important that you won't encrypt it.
You must be in sales. Why are you reading slashdot?
"in the consulting space"
Sorry, I didnt read anything after that.
But they might know a fence who does.
There's always the possibility (remote, but not zero) of someone "stealing to order" if they're targeting a specific organization.
Confucius say, "Find worm in apple - bad. Find half a worm - worse."
Ncvxm fmnwo octef gaiwv gwrsl s
My other signature is a car
Wow, glad to see you've actually used it before making up stuff about it. We use BitLocker on all of our corporate machines (where legal - we still have a couple of countries where we can't legally turn it on yet). It doesn't actually encrypt USB drives the way you say. The Vista version can't encrypt thumb drives (although it can encrypt spinning disk removable drives - you just have to force it to as it won't do it automatically). The Windows 7 version will encrypt thumb drives if you tell it to or if your policy requires it. There is also a reader app right on the key to get access to the files from Windows XP and up. So the drive isn't useless. Now, before you say "I can't read the power point on my customer's Linux machine" - how is that Microsoft's fault? You encrypted it, you hopefully knew the software requirements of the reader.
As another said below - it isn't slow either. It's right in the ballpark for competing solutions and typically comes in at about 5% to 10% (10% is on disks spinning at 5,400 RPM on older notebooks - we spec'ed all of our notebooks with 7,200 RPM drives and you don't get a 10% hit with those).
No, it doesn't, he's either an idiot or a troll.
BitLocker's ecnrypt/decrypt delay is almost entirely hidden in disk latency. The CPU can do encryption far faster than the disk can do I/O, so unless another program was heavily leaning on the CPU while you're accessing the disk, you won't even notice the slowdown.
BitLocker in Windows 7 or Server 2008 R2 supports encryption of removable drives, but doesn't make it mandatory and certainly doesn't do it automatically. You (IT) *can* make it mandatory using Group Policy, but even then you don't have to use the encryption - un-encrypted volumes are simply mounted read-only, so you're not going to be encrypting your client's presentation by accident just because you plug it into your computer. However, one of the coolest tricks is BitLocker To Go, where when a removable drive is encrypted, BitLocker creates a small second partition on the device that is *not* encrypted, and stores there a Windows binary capable of decrypting the drive (on versions of Windows that don't support BitLocker). Obviously you need a key, which depending on how the drive was encrypted in the first place might require that the computer be currently connected to a domain (or it might require a password, or smart card, or any of a number of other things).
In any case, accidentally encrypting a flashdrive requires such a phenomenal degree of stupidity that I'd be amazed such a person could plug a flashdrive in correctly. A lot of people don't even see it since it's only avaialble on higher-end editions of Windows, but BitLocker in Win7 is extremely user-friendly and the interface is not at all ambiguous.
There's no place I could be, since I've found Serenity...
This is true, although many businesses are upgrading to Win7 and some already upgraded to Vista, both of which support BitLocker (7 moreso than Vista). What's more, a laptop that is intended to carry sensitive data and leave the premises may well have a higher edition of Windows installed specifically to enable BitLocker, even if it also then needs a virtual XP install in order to access some horribly legacy IE6-only ActiveX corporate intranet site.
There's no place I could be, since I've found Serenity...
California (and possibly other jurisdictions) have burdensome disclosure and remediation requirements when unencrypted data is lost. If the data is encrypted, most of these regulations have exemptions that assume nobody can break the encryption. This will be fine, until somebody Googles Joanna Rutkowska "evil maid".
I work for an employer who has nearly nothing sensitive on anyone's PC, but we encrypt hard drives anyway. We take advantage of the disclosure loopholes, cheerfully ignoring the possibility of USB sticks. I honesty think the whole thing is an attempt to stop somebody from booting a Linux livecd and gutting Windows security entirely.
I work in a place where we have to encrypt anything that leaves the front door. We used a third-party encryption tool which I won't name. There was a noticeable slowdown after performing the encryption on our laptop drives, and the interface to encrypt removable media was painful... But it did work for XP.
Now that we've got some work done on the Windows 7 front, BitLocker makes much less of an impact performance wise... I assumed that it was because the TPM was involved because I didn't even notice the 5% hit that's being reported here. There is one thing to worry about:
If your users know what they're doing, and they have administrative permissions, policies are only a registry key away from being broken. Make sure you're keeping on eye on their "compliance."
that kind of information should never be carried on one's laptop, period.
I completely agree with you, which is why I think this article is bunk. It shouldn't matter if your company uses encryption on laptops or not, because if your data is too valuable to lose then it's too valuable to be stored on a laptop.
VPN -> Citrix -> Data.
I went to eat some animal crackers and the box said, "Do not eat if seal is broken." I opened the box and sure enough..
but what happens when the decryption mechanism or the OS crashes?
It sounds like you haven't tried it and don't really understand the mechanisms (understandable).
The answer is you carry a rescue disc/USB, same as always if you want to be able to deal with eventualities on the road. /boot needs to be unencrypted anyway, so you can keep a rescue kit there as well.
I don't think I've ever heard of anybody losing their data because LUKS failed. The filesystems you put on top of the encryption layer, sure, they're as fragile or stable as ever, but the encryption is transparent to them. Layers are useful sometimes.
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
I have a bad experiences with encryption software - safeboot.
One of my user's laptop have a corrupted windows system file that prevent windows from booting up. I tried to recover using windows xp recovery CD but the recovery console cannot recognise the hard disk because it is encrypted. I tried to use safeboot recovery CD but after getting past the safeboot login screen, the system freeze because the windows system file is corrupted.
The only solution is to reformat the hard disk.
Personally, I feel that encrypting the folder that contains the confidential data is OK. However, encrypting the whole hard disk is stupid idea.
Just like more persons know a secret, the more chances that the secret will be leak. There shouldn't be any backup copies of confidential data because the risk of information leak increase when the number of copies increase.
I work in a medium sized technology company. A couple of years back, the company decided to implement whole disk encryption in all laptops for people who travel. The encryption key was stored in the BIOS on the Dell Latitudes we used. Looking back, it was a pretty big disaster on a several points:
1. Many people lost work stored on their laptops when the disk became unreadable because the encryption could not be "unlocked", probably because a bit got flipped in a sensitive area of the disk. Of course they should have had backups, but the disk had not failed; it was rendered unreadable by the encryption itself not because the disk itself was trashed or damaged. In several cases the persons were traveling when this happened and they were left without a working laptop until they returned home.
2. Most of the laptops were equipped with small, fairly slow hard drives and modest single-core CPU's. Encrypting/decrypting all data to/from the hard disk just added overheard and the machines were even slower than before the encryption was installed. Of course, faster drives and CPU's could have been used but like everything in the modern IT world they were bought "on a limited budget".
3. As I remember, there was no way to easily recover data if the laptop itself failed and the drive was installed into a different laptop, because the encryption key to unlock the encryption was in the BIOS of the dead laptop. Maybe there was a proper recovery solution but at least our IT department didn't know how to do it. Several people lost weeks or months worth of data due to this.
I was one of the lucky ones as a pilot user for workstation-class laptops, and mine was delivered before they started encrypting the laptops. Every time IT asked for the laptop to install the encryption software, I told them I was too busy to surrender the laptop for several hours. In the end, I never got it installed. In the mean time as laptops have been replaced more recently, they are not encrypted. I have a USB hard drive with a TrueCrypt folder on it for sensitive documents/files that I carry with me always. If for some reason, I can't access to my TrueCrypt folder, then at least I still have my laptop for email/web/vpn and I can continue with basic work. I travel a lot and if I were to lose use of my laptop during a business trip it would be a disaster.
What's the cost in losses from lost data that resides on lost disks? It's not as if the threat agent that steals the laptop from the backseat of my car is going around looking for data. I'm thinking they're going to sell that shit and buy some crack. They certainly aren't going to sit around and sift through looking for data regarding Mergers and Acquisitions for Fortune 50 companies, and even if they did, how the hell is a thieving underachiever going to turn that into crack? I bet the losses from lost data (that would be protected through encryption) aren't even close to the losses from key management, password resets, accidental encryption and the cost of the software itself.
I wonder what percent of them wrote their password on a post-it note attached to their laptop.
Why? You storing sensitive information on a laptop? Thats just retarded. You should know better having worked for a credit card processing company IT department. (aka desktop support since obviously you aren't security minded)
I work at a Fortune 100 company and we recently (1 year ago) deployed disk encryption to all laptops. It sucks honestly. You can't do image backups anymore, not to mention backups are questionable because you don't always know how the backup is being done (low level copy, file copy, etc.). Furthermore, it SLOWS compiles, etc. way way down. When you are hitting the disk a ton to compile, the encryption takes a huge toll. And finally, if something does wrong on the disk, well your data it at the hands of an IT guy they hired last week. Even worse, they won't give IT-contractors the keys to fix encryption issues, so only a limited staff can deal with disk encryption issues encountered.
thousands of businesses are using plain FTP and email to throw unencrypted files around to & from other companies daily.
I'd be curious to see the results of a survey to see how many SMTP servers are advertising STARTTLS.
$WORK uses MessageLabs for spam filtering et al. and their servers advertise STARTTLS; then our corporate relays also advertise it, so all mail for $WORK is "safe" for a good portion of it's travel over the public Internet.
Sadly none of the 'big three' e-mail providers advertise STARTTLS on their MX hosts: Gmail, Hotmail, Yahoo.com.
There's always the possibility..
Indeed, see my previous post. It then comes down to probability that the laptop is stolen compared to the hassle of encrypting the drive. And in most cases, it is not worth the hassle.
-= This is a self-referential sig =-
27% might actually use encryption someplace. Probably it is more like 1% that use encryption properly.
I don't know how many times I will see a laptop sitting on a desk, all encrypted up, all tight and secure and shit, and happily backing up to an external unencrypted hard drive each night that is sitting right next to it on the desk.
Perfect example of how statistic lie, and how IT policy is so easily circumvented. It also shows how much stupid/silly IT policy is created, that only marginally does what it is designed to do because it was created in a vacuum.
I beg to differ.
We use PGP whole disk encryption and let me tell you, you notice the difference between two machines, one with crypto, one without. That said, it's the company's machine. If they want it to be slower but more secure that's their call.
Also, on normal tasks this difference may be nominal, but if you're doing a backup and/or virus scan, and doing something else that requires CPU you will bog badly.
-nB
whois gawk date unzip strip find touch finger mount join nice man top fsck grep eject more yes exit umount sleep dump
I work in a company where encryption is standard on all laptops. One day someone in IT that worked out of a remote office pushed a change to the encryption server. He thought he was testing a change in DEV. He was very, very wrong. The change he made prevented all the laptops from booting up. This affected everyone with a laptop worldwide. Talk about a cluster fuck. Everyone in IT from the Help Desk reps to Developers were dispatched to fix every single laptop in the company. It took almost a week to get everyone back to normal.
Now, there is of course about a million and one things that could have been done to prevent this - better admin controls, better configuration of the encryption server and a better change management process just to name a few. Unfortunately the fact of the matter is this great system that was supposed to protect the corporation brought it to its knees for days.
I’m not saying encryption is a bad thing, But this was slapped it in placed by an arbitrary “mandatory deadline” without understanding the first thing about how to deploy this correctly. If they had taken the time to understand it first this probably wouldn’t have happened.
We still use it. Users still complain about it. Nothing has been done to prevent this from happening again other than the guy that mistakenly pushed the change getting canned.
In many cases, the real risk of someone accessing data is much less than the risk of losing encrypted data because you lose the means to decrypt it. I've seen users who've encrypted their own disks go to support when they forget the passphrase and insist that support decrypt it for them... er, no, sorry, you're screwed.
Or let's say you get a hard drive failure and lose data that isn't backed up (it happens, even if you think you're careful). With an unencrypted disk, depending on the failure, you have an outside chance of retrieving files because even a partial file might be usable. With an encrypted drive, you're screwed again. It's going to be all or nothing - at least at the file level, and possibly the entire drive.
Taking the balance of risk, performance and all the rest (sensitive data should only be stored centrally anyway), encrypting local drives seems like overkill.
Sigs are so 1990s. No way would I be seen dead with one.
I don't know how many times I will see a laptop sitting on a desk, all encrypted up, all tight and secure and shit, and happily backing up to an external unencrypted hard drive each night that is sitting right next to it on the desk.
This isn't necessarily unreasonable if the main threat by far is theft of laptop in transit/out of the office (I beleive that accounts for about 98% of laptop thefts in my company). As long as the backupo drive stays in the office.
Our company has a really cool product that we sell to our customers for recovering data in the case of a drive failure. It's called a "backup".
;-)
It's been in the papers, you should check it out.
-B-
No backups of confidential data? You're kidding, right?
Since confidential data tends to be among the most mission-critical data (in most organizations) I'd argue that it's the data MOST in need of backing up. The backups can (and should) be encrypted and stored in a physically secure location. But backups are essential.
If you don't back it up then you don't deserve to have it.
-B-
Anybody else notice the irony of having a thread about how few people encrypt their mobile devices just a couple of stories below a story about the government seizing laptops?
-B-
Hear hear. I've already had problems with corrupted Keychains on my Mac (OS 10.5) twice in the last year. The only way I was able to recover my encrypted list of passwords was by restoring from backup. There are few things more annoying than trying to access a deliberately-encrypted file and getting nothing but a notification window that reports "Access to this file is restricted". In light of this, there's no way I'm going to trust FileVault.
Computer/network ops, actually.
Yes, it is retarded, but you can't easily keep people (especially people who have to handle that kind of data) from doing it anyway.
I don't know. Is BitLocker the one in use at the US EPA? Because that one has had a crippling effect on the portion of their scientists and managers that actually use the computers. Or at least used to...
Moderating "-1, Disagree" is simple censorship. Have the guts to post your opinion.
This is the same argument made a decade ago by the "road warrior" who prefers paper over a PC. They could be heard saying something like this:
"The risk of losing access to the data when something goes wrong is far too dangerous to risk it. I have had problems on the road already, yet I have always managed to recover my data either from my file cabinet or from photocopies, but what happens when the software or the OS crashes? Carry another laptop? Carry bootable USB-based software tools? Sorry, too many variables, too much potential for trouble." ...and then conclude with...
"This is why I only bring paper with me when I travel and not a laptop."
I guess what I am saying is that your argument against doing what you know you should... is ignorance. You just don't know what to do because you haven't used it before. If you subscribe to that view, then what are you doing on a PC anyways? And why are you using the Internet for Cripes Sake?
Sadly in my case it has very little to do with legacy applications.
It has to do with anal IT Security staff that want to have 100% control over everything. Even when it breaks stuff and prevents us from doing our job.
For instance using network printers is against corporate IT Security policy unless the printer is owned by the company. So when we visit customer sites and are connected to their network we cant print due to firewall blocks on our laptops that we cant lift... So we must copy files to usb sticks and print from other machines.. yay
If only things made sense it wouldnt be so hard to swallow :-p
There do exist packages that can handle the encryption of at least fixed disks without the user needing to do anything more than the usual login. BitLocker for one (and BitLocker can plug into Active Directory easily)
With the right software, it is possible to protect the fixed disks of all PCs in the enterprise (including laptops that may only connect to the network through a VPN or may be used in places where there is no network access at all such as airplanes) and the only thing the users have to do is to log in just like they normally do. Mobile devices like Blackberries and Windows Mobile devices also have options for encryption that IT can enable. Even email can be encrypted without the users doing anything special using modern versions of Exchange (at least from what I read with Google)
One company I worked for rolled out hard drive encryption on all laptops. Help Desk then got overwhelmed because 50% of the laptops failed to take, resulting in an unbootable computer. If you didn't have everything on the computer backed up, then you lost it all b/c they had to reformat the disk. That typical issue was the Master FAT record of the NTFS getting corrupted. I think it took the tech 3 or 4 tries (at about 5-6 hours each) to finally get it working on my laptop - meaning I was without the laptop for several days, and unable to do my work (since I didn't have a desktop to fall back on).
Also, Hard Drive encryption doesn't stop anyone with access to the hard drive except the casual thief. If they really want the data, they'll image the drive and brute force the encryption to get access. (So no, it doesn't stop espionage, just some random Joe who got a stolen laptop from seeing the data.)
Truth is like the sun. You can shut it out for a time, but it ain't goin' away. - Elvis Presley (source: imdb.com)
That is starting to go away though. Our last VAN transition required us to move from vanilla FTP to FTPS. Anything that falls under HIPAA, 835 remittance advice for example, can't be legally transmitted unencrypted either.
thousands of businesses are using plain FTP and email to throw unencrypted files around to & from other companies daily.
Entirely true and usually the information is just simple things like lists of customer names and addresses. Payment information is pretty much always encrypted due to PCI compliance reasons but simple customer information is not. And really unless you have a very exclusive clientele it really doesn't matter, after all who cares about the name of generic redneck #46576876 living in an apartment somewhere who happened to place an order for product XYZ?
.... presumably "anonymous coward" works for ckeckpoint's marketing department? there are so many issues that compromise security without letting checkpoint trouser your money.
like sending unencrypted tapes of customer details around. and letting outsourcers sell servers with hard drives containing your customer details.
the list goes on and on, and will not stop going on. the truth is corporate greed will always end up with processes being compromised because there is the possibility of turning a profit
Last company my wife worked for fielded a sales force with laptops. their "office" was their home. They sold advertisements. There was no data security.
These sales people knew their territories, knew their jobs and knew how to generate revenue. And they were in New England, where a friend is hard won but, once won, a friend for life. The company, based in Virginia, gave no thought to relationships. They operated under the mistaken impression that their product was king.
So they put my wife out like the cat. Didn't give her severance. She's suing.
And they fired all of their sales staff. One by one. Told them they were not meeting their quotas.
There were no corporate financials on the salespeoples' laptops. There was no sensitive information, save addresses and phone numbers of the advertisers and email addresses of the company yes-men that went along with this deal.
One of the salespeople, who had been with the company some 30 years went to all of his clients and started a new publication and started selling space in it. He has been growing and gaining clients because he treats them right and has a good ad production department. He has the old advertisers he used to have and has new ones who want in. And he's growing in New England.
Oh, and the original company? They're looking for a New England regional sales manager to replace my wife now. They want one with a complete sales team and solid contacts in the market.
Data security? We backed up my wife's entire drive onto our own external hard drive because they wouldn't buy her a backup drive (too cheap). We kept that drive. And at the initial hearing for her lawsuit, the company was repeatedly shocked by the content of their own emails coming back to haunt them.
So in this day and age of corporations firing people for being female, pregnant "too old" or "too unwhite" and getting away with it most of the time, why do they think they need data security again?
Gods don't kill people, people with gods kill people.
Encrypting the hard disk is not the only kind of encryption a remote user can use. There's another encryption technology, called VPN - do you think there'd be a few more companies using this form?
So the title claiming "Only 27% of organisations use encryption" is misleading, even a lie.
BTW: like a number of other remote users, I've VPNed into a corporate system, then connected to virtual machine and worked there - no hard disk encryption used, but the VM's hard drive is a piece of a corporate SAN - I'd rate that as comparatively secure. The only thing that would be protected by any putative HD encryption on the laptop would be the OS and the VPN software.
Between VPNs and the number of employees who take laptops home, but don't have access to sensitive data because they don't work on anything sensitive, I'm willing to bet 70% of corporate laptops don't have sensitive data on their hard drive, and the 3% don't have competent IT departments. Not every corporate laptop needs to be encrypted.
For those occasions where you need to protect what you share or store online, try ThreadThat.com at https://www.threadthat.com./