NASA To Encrypt All of Its Laptops

pev writes "After losing another laptop containing personal information, NASA wants to have all of its laptops encrypted within a month's time with an intermediate ban on laptops containing sensitive information leaving its facilities. Between April 2009 and April 2011 it lost or had stolen 48 'mobile computing devices.' I wonder how long it will be before other large organizations start following suit as a sensible precaution?"

Comments

They waited this long because?

[Liquidretro]

They waited this long because? First?

Re:They waited this long because?

[baoru]

Obviously it took them this long because it's not rocket science.

Re:They waited this long because?

[jonnyj]

In the UK, the Information Commissioner has for many years routinely fined any company that loses an unencrypted laptop - even, in one famous case, where the laptop was stolen in a burglary at an employee's own home. It's unheard of for any large organisation over here to _not_ have encryption on all portable devices. I'm gobsmacked that NASA has been so slack.

Re:They waited this long because?

[Anonymous Coward]

No kidding. From the summary:

I wonder how it will be before other large organisations start following suit as a sensible precaution?

Oh, 8 or 9 years ago when California passed the law requiring disclosure. That's when it became cheaper for most large organizations to encrypt rather than deal with the fall out.

Re:They waited this long because?

[robot256]

They finished encrypting all the laptops at my center earlier this year. I was also amazed to learn that headquarters is behind the curve.

Re:They waited this long because?

[JosKarith]

I work for a financial services company and any portable device is encrypted as a matter of course. That's just a basic security measure, and I'm amazed NASA have waited so long.

Re:They waited this long because?

[Rootbear]

This is not a new policy. The implementation of full disk encryption has been underway for some time. We are doing laptops first, then desktops. The current fire drill is because a laptop with PII was stolen at NASA HQ and it was one that had not yet had full disk encryption installed.

NASA IT staff are as overworked and under appreciated as anywhere. If NASA had wanted full disk encryption done sooner, they could have added the resources to make it happen. And that would have taken resources from missions, like Curiosity and the James Webb telescope. It's all about priorities.

Re:They waited this long because?

[Culture20]

Resources == salaries. Do you pay two IT guys or an engineer/scientist?

Re:They waited this long because?

[NumenMaster]

Funny enough right? How is it not STANDARD practice? I work for a really small state agency and that's the FIRST thing we do after imaging our laptops. It's been our policy for years. I'm so awestruck at the news.

Re:They waited this long because?

[oneandoneis2]

Because the typical end user is stupid and forgets their password.

On a normal laptop, this means a bit of inconvenience.

On an encrypted laptop, this means a loss of all data.

You have to have solutions for this problem in place before you can roll it out.

Re:They waited this long because?

[jeffmeden]

Because management is under the impression that anyone on Earth can figure out how to get to the moon; I mean that was so 40 years ago amiright? Why encrypt it when Nasa can't copyright anything anyway?

Re:They waited this long because?

[Anonymous Coward]

They waited this long because?

First?

They're part of the US government. They first had to write a 1,200 page directive on how to do it.

Then, they had to decide what the standards for the decryption key should be. They decided that everyone should use "12345".

Re:They waited this long because?

[Patch86]

Came here to express the same surprise.

I wonder how it will be before other large organisations start following suit as a sensible precaution?

My company has been doing full hard-disk encryption since before I joined, and so does every one of our partners who I've asked (and we usually do; if you're going to have a sniff of any of our customer data, you need to take at least a basic interest in keeping it safe). Do many major organisations not encrypt at least MOST things these days?

Re:They waited this long because?

[Anonymous Coward]

Encryption has been our policy on notebooks since 2004 and on all machines (desktops included) since 2007. We operate globally, so theft isn't just notebooks. A couple of years ago one of our remote small offices in South Africa was broken into and 20 desktops were taken - an example of why encryption is used on everything. It is hard to believe some organizations haven't done this yet. I can understand home users not doing it if they aren't technically inclined but this is not hard for a large company / agency to do.

Re:They waited this long because?

[geekoid]

They have a finite pool of money. Putting something in IT takes money from the finite pool.
The poster is correct, ti's about priorities.
Since that vast majority of information NASA has is useless to anyone not in a space agency, it seems this was a good priority of limited funds.

Re:They waited this long because?

[mrchaotica]

That's amazing! I have the same combination on my luggage!

(Don't blame me; somebody had to say it!)

Re:They waited this long because?

[spagthorpe]

Meanwhile, the Chinese thank NASA for taking their time in implementing this.

Re:They waited this long because?

[QuantumRiff]

They thought they had it, but realized they were not converting the units correctly. One group was using MebiBytes, and the other was using MegaBytes..

Re:They waited this long because?

[Anonymous Coward]

Because encrypting data is like putting it in a black hole, from which it might never return. If you lose your password, THAT'S IT! GONE!

For a technically competant user base, like (i'd like to assume) NASA employees probably are, go for it!

But for people who struggle with Microsoft Word and basic e-mail? Well... uh... let's just say an organization might want to perform an analysis of how many times their employees call in for password resets. There will likely be a strong correlation between data loss and password resets.

Sure, the data might not fall into the wrong hands anymore, but with statistics for every lost laptop, add ON TOP OF THAT data that's effectively destroyed by users getting locked out of their own encryption. That could ALSO be very costly in terms of lost man-hours, and possibly an unnecessary risk depending on how much sesnsitive data you REALLY deal with.

Re:They waited this long because?

[ae1294]

Because the typical end user is stupid and forgets their password.

On a normal laptop, this means a bit of inconvenience.

On an encrypted laptop, this means a loss of all data.

You have to have solutions for this problem in place before you can roll it out.

No it doesn't. You add a second admin key to all the laptops.. It's not rocket science..

Re:They waited this long because?

[mk1004]

Because the typical end user is stupid and forgets their password.

On a normal laptop, this means a bit of inconvenience.

On an encrypted laptop, this means a loss of all data.

You have to have solutions for this problem in place before you can roll it out.

No, a real IT department will have an admin account so that they can get into the machine and reset the lost password. That technique is not rocket science either.

I suspect that most people don't encrypt their home computers because 1) They don't know that they should do it. 2) They don't know how to do it. 3) They probably wouldn't set up a back up admin account for a forgotten password. 4) Consumer versions of XP and Vista don't have encryption built-in. Not sure about Win 7 and 8.

Re:They waited this long because?

[Anonymous Coward]

Welcome to the real world, where you can't just shit money and hire everyone on Earth.

Re:They waited this long because?

[luis_a_espinal]

This is not a new policy. The implementation of full disk encryption has been underway for some time. We are doing laptops first, then desktops. The current fire drill is because a laptop with PII was stolen at NASA HQ and it was one that had not yet had full disk encryption installed.

NASA IT staff are as overworked and under appreciated as anywhere. If NASA had wanted full disk encryption done sooner, they could have added the resources to make it happen. And that would have taken resources from missions, like Curiosity and the James Webb telescope. It's all about priorities.

But therein lies the problem. It should not be underway for some time. It should have been in place as an iron-fist de-factor rule a long time ago.

I sympathize with you and the other IT folks. Underfunded and under appreciated IT and dev folks alike. It is shitty, and I know what it's like (been there, don't that.) But, to not have laptops encrypted? To furnish unencrypted laptops? There is some serious break-ups there man. Why? Because, however overworked your team might be, I have a hard time believing that IT will furnish an un-imaged laptop, as-is from the vendor/supplier, to the user. I'm sure IT images the laptops, so it stands to reason that the imaging will include encryption.

If the laptops are being furnished as-is from the vendors, that's a fuck-up.

If the laptops do get imaged, but do not get encryption, that's also a fuck-up.

Any government agency has some type of security and information assurance program and guidelines. And in them, encryption of laptops must be there somewhere. If that is the case, then it is a IT fuck-up. If it is not, then it is a IA fuck-up.

I'm not necessarily blaming you or any specific IT person, but this is a serious crap-o-lah that goes against what is pretty much standard practice with any agency or defense contractor (I work for one), or even for commercial companies. It's simply crazy.

Re:They waited this long because?

[Anonymous Coward]

They had nothing to hide.

Re:They waited this long because?

[Anonymous Coward]

Pretty much all of your concerns are made irrelevant simply by using a system that allows for multiple passwords. The user has one, your IT staff has another, and then a third works as a sort of one-time password for resetting the user's password. I don't know if any encryption schemes work like this currently, but here's how I'd picture it working.

1) User calls in about having forgot their password.
2) Support person verifies user identity.
3) User reads off a sticker on the bottom of their laptop, as well as a number on their screen.
4) Support guy inputs that string and number into a program, and out pops a reset password password.
5) User enters that password, the system key is decrypted, and the user is prompted to enter a new password. Once the user enters a new password, the system key is encrypted using that new password, and overwrites the user's former encrypted system key
6) To keep the reset password password from being a weak link, an algorithm is applied to the reset password password, the system key is encrypted with that new password, and overwrites the old reset password encrypted system key. And that number from step 3? That gets incremented by 1. This ensures that you will never encounter the issue of the user being given a reset password password, not entering it, and then being locked out because the computer is still on Password N, but the support system thinks it is on Password N+1.

Re:They waited this long because?

[FuegoFuerte]

The most common utility for full-disk encryption on workstations in enterprise/government is probably going to be bitlocker, since it's already included free with the OS most of them use. Bitlocker in the enterprise already has the "lost/forgotten password" issue solved quite nicely, in that on a domain-joined machine it backs it up to AD and a sufficiently-privileged helpdesk or admin person can recover things for a hapless forgetful user.

Some might argue that this is slightly less secure, but the average workstation/laptop thief isn't going to have access to an organization's AD infrastructure, and anyone who does have that access doesn't need to steal physical hardware to obtain sensitive data.

Re:They waited this long because?

[Concerned Onlooker]

Mebi. Mebi not.

Re:They waited this long because?

[Darinbob]

You make backups. A second password helps too, but first step is to make sure that data can be recovered.

Re:They waited this long because?

[Anonymous Coward]

That culture helps explain the ridiculous prices on everything in the UK.

Re:They waited this long because?

[Darinbob]

Well, many want to. There are some issues though that cause inertia. Not just issues with forgetting passwords.

- Older systems that may need upgrading before being able to have encryption, or they're able to encrypt files but not whole partitions, or they don't even run IT approved operating systems. Having some machines that don't fit into a global policy can often often slow down an IT policy to a crawl, especially when the management refuses to make an exception.

- Reliability. Sometimes this encryption is not very stable. Seriously. Our whole department stopped cold on encryption when many of the macbooks started dying and had to be replaced within a month of being encrypted (ie, second IT passwords don't help), with about a week of downtime before the user is back up and running full speed again. Put things on hold until Lion was released (which was it's own freigh train full of breakage, though at least the encryption worked).

- Performance. Maybe the average user doesn't care, or the exec with an expensive computer. But encryption really can slow things down tremendously. Compile times, email searches, etc, can all take a very noticeable hit, sometimes more than twice as long. Do this on an older computer or a production system and it really hurts.

- Scheduling and availability. Not everyone is able to come in and see IT at a moment's notice. Sales people may not even live in the same state or country, and they purchase and install their own computers. IT has a tendency to want to do encryptions or upgrades at exactly the same time as a major product release.

Re:They waited this long because?

[colinrichardday]

If it isn't rocket science, then how would NASA understand it?

Re:They waited this long because?

[cpm99352]

Ditto. I consult for a health care company and use one of their laptops. Full disk encryption using PGP. It works quite well - integrated with Windows Active Directory. Yeah, it slows things down, but no HIPAA worries.

Re:They waited this long because?

[cbhacking]

Win7 has BitLocker in Enterprise and Ultimate, and Encrypting File System in Pro (same as Vista, if you s/Pro/Business/).

Win8 has BitLocker and EFS in both Pro and Enterprise (there is no Ultimate).
Windows RT has BitLocker but not EFS.

Re:They waited this long because?

[Anonymous Coward]

That's when the users put a sticky note in their laptop with the password on it.

Re:They waited this long because?

[DriedClexler]

I just hope they extend this culture of carefulness to the rest of their operations.

Next up: double -- perhaps *triple* -- checking launch calculations. Or expressing quantities with units so that others don't wrongly guess inches versus meters.

Yes, NASA must remain the innovator in this area.

Re:They waited this long because?

[rtfa-troll]

The user has one, your IT staff has another, and then a third works as a sort of one-time password for resetting the user's password. I don't know if any encryption schemes work like this currently, but here's how I'd picture it working.

I don't want to endorse any particular proprietary solutions, however almost all of the commercially available Windows solutions have this implemented and it's also possible to implement this on Linux using the standard built in dm-crypt. There is no excuse for not doing it.

N.B. 1) In the procedure above step 2 must use two factor authentication and you want to consider whether the user may be acting under duress. Normally a user should be required to actually physically come to the office to have their decryption password changed.

N.B. 2) It's worth making this procedure more difficult and painful than a reinstall in order to teach users about the benefits of keeping backups.

Re:They waited this long because?

[painandgreed]

No it doesn't. You add a second admin key to all the laptops.. It's not rocket science..

No, the second key you add is the user's.

Re:They waited this long because?

[Anonymous Coward]

Or just use Microsoft BitLocker where the decryption key is automatically uploaded to Active Directory so that administrators can decrypt the disc offline.

(Or better yet, use backup tools. Hard drives fail and laptops get lost.)

Re:They waited this long because?

[Anonymous Coward]

The problem here currently is with contractors at NASA. Lockheed Martin controls ALL of the enterprise equipment at Goddard and NASA HQ. If Lockheed doesnt care, or rather, the contract requirement isnt written with encryption as a requirement, then you can bet your sweet ass that it's gonna either take the moving of a mountain or an awesomely expensive contract mod to get it done.

NASA doesn't own their own IT. Their vendor doesnt give a shit.

Re:They waited this long because?

[Anonymous Coward]

Funny enough right? How is it not STANDARD practice? I work for a really small state agency and that's the FIRST thing we do after imaging our laptops. It's been our policy for years. I'm so awestruck at the news.

A lot of folks are still stuck with Windows XP, and if you don't have extra budget for something like PGP, then you're SOL. There is Truecrypt, but without central management and key escrowing, it's a non-starter for larger organizations.

Once an organization however is on (say) Windows 7 across the board, then yes, might as well push FDE out as part of the standard image as you can still get at the data if something happens to the employee.

Re:They waited this long because?

[Anonymous Coward]

What if, for example, they let staff purchase their own laptops and support them themselves? If they've got users who have enough basic computer literacy to handle this (and I'm sure NASA has plenty of these), and there isn't any vitally sensitive data (is it a problem if some unprocessed Mars images get leaked to the public?), then they can save a lot of bureaucratic overhead. Many universities function this way, on the research side. It works.

It may not be a popular concept among people who work in IT, but in many cases, the services they provide aren't enough to justify the restrictions they impose.

Re:They waited this long because?

[Anonymous Coward]

If you have ever worked for NASA you would realize that NASA is a damn ghetto.

Re:They waited this long because?

[Anonymous Coward]

I work in IT and understanding that you work in computing for a defense contractor that specializes in computing, I think your view might be a little bit skewed. I have worked in IT for 5 years and I'm only this year completing my cycle for 200 computers. I upgrade 40 machines a year, so without increasing my budget, I would have at this point 80 computers with Windows XP due to be upgraded next year and the year after and 20 more machines due to be upgraded before the end of the year. Virtually half of my systems at this point aren't even feasible candidates for default encryption. So, if our policy were to encrypt systems where encryption was available in the OS I would still only have 50% coverage. Now I'm sure NASA has better resources and is generally a better environment than what I've got to deal with, but I don't think it's at all surprising to think they might have an XP or few Vista machines floating around without encryption.

Re:They waited this long because?

[Anonymous Coward]

those are stupid reasons, firstly if they lose the laptop they have lost all the data already so it was a "black hole" to begin with. secondly software like truecrypt creates a recovery method in case its lost or the volume is damaged where the password doesnt work.

so just stop making excuses for other people. its straight up stupid the government doesnt require this in the first place... END OF STORY.

Re:They waited this long because?

[luis_a_espinal]

The problem here currently is with contractors at NASA. Lockheed Martin controls ALL of the enterprise equipment at Goddard and NASA HQ. If Lockheed doesnt care, or rather, the contract requirement isnt written with encryption as a requirement, then you can bet your sweet ass that it's gonna either take the moving of a mountain or an awesomely expensive contract mod to get it done.

NASA doesn't own their own IT. Their vendor doesnt give a shit.

So there we have it, a double IA-fuck up, by NASA and LM (and if some of the information being handled has some type of security classification, explicit contract or not, their mutual fuck-ups are even greater, borderlining in federal offenses.)

Re:They waited this long because?

[luis_a_espinal]

What if, for example, they let staff purchase their own laptops and support them themselves?

No excuse. Every company I've worked for has a policy regarding privately own laptops connecting to an internal network. For a group like NASA to either not have one such policy, or having an ineffectual one, or having an effective one but without enforcement, it is a fuck-up no matter how you cut it.

This is NASA we are talking about, not some small shop or a plain-vanilla lab at a university. If a doctor's private practice has rules concerning who connects to their networks, you can bet your IT ass than NASA can or should have. It's a fuck-up no matter how we cut it.

Re:They waited this long because?

[luis_a_espinal]

I work in IT and understanding that you work in computing for a defense contractor that specializes in computing, I think your view might be a little bit skewed. I have worked in IT for 5 years and I'm only this year completing my cycle for 200 computers. I upgrade 40 machines a year, so without increasing my budget, I would have at this point 80 computers with Windows XP due to be upgraded next year and the year after and 20 more machines due to be upgraded before the end of the year. Virtually half of my systems at this point aren't even feasible candidates for default encryption. So, if our policy were to encrypt systems where encryption was available in the OS I would still only have 50% coverage. Now I'm sure NASA has better resources and is generally a better environment than what I've got to deal with, but I don't think it's at all surprising to think they might have an XP or few Vista machines floating around without encryption.

But herein lies the problem. It is not about having a few systems floating around. It is the fact that, apparently, they had no coherent encryption policy/program in place (and now they have to rush in to make sure to lock things down.)

Re:They waited this long because?

[Anonymous Coward]

Obviously it took them this long because it's not rocket science.

It is rocket science: http://en.wikipedia.org/wiki/Cold_boot_attack . If there are any real secrets at NASA, one would expect more than just company level of disc encryption.

Re:They waited this long because?

[Trep]

This can be easily remedied with a two key system, where the IT department maintains a key/password pair in addition to the user. I'm pretty sure PGP, for example, supports this.

Re:They waited this long because?

[Anonymous Coward]

This account makes it sound like the Apple ecosystem has some very, very crappy crypto utilities. Or, way more likely, some typical "IT Professional" decided to blame the spooky,mysterious crypto software for unrelated problems caused by their own ignorant incompetence. When devices with encrypted file systems on them fail, recovery is in a spectrum from "normal" to "impossible" with nothing in between - but the encryption itself does not affect the device in any way, it's all ones and zeroes at that level. An encrypted file system places no stress on any storage device. As far as performance hits go, encrypted file systems don't have them. Is all. Modern ciphers are exceptionally efficient algorithms, and a crypto driver occupy less than 1% of system memory on a typical modern computer. The only way file system encryption can possibly affect the speed of any computer is during read/write operations from/to encrypted media, where the performance hit against read/write speed is typically around 3%.

Re:They waited this long because?

[Anonymous Coward]

Have you never looked at enterprise encryption solutions?

Re:They waited this long because?

[Anonymous Coward]

Agree on the performance aspect - Symantec / Utimaco encryption took a build of a relative complex Java project (~600k LOC) from around 3 minutes to more than 25 minutes (deemed acceptable by the IT department). Using an SSD instead kept the build times to under 5 minutes (deemed acceptable by the developers, and thankfully the project funded SSDs for each machine). Caveat: I'm a developer.

Re: scheduling and availability - VPNs and something like Altiris deals with this. Your company laptops should not be connecting nakedly to the internet either; everything through the VPN, and only the VPN can make pure internet connections.

Re: older systems - running operating systems that IT do not approve (or are not prepared to issue a limited waiver after identifying and evaluating the risks) should not be anywhere the network, period.

Re:They waited this long because?

[RockDoctor]

N.B. 1) In the procedure above step 2 must use two factor authentication and you want to consider whether the user may be acting under duress. Normally a user should be required to actually physically come to the office to have their decryption password changed.

That would probably be ideal, but we both know that the one circumstance we can't predict is an unpredictable circumstance. Then again ... it's "personal" data that's at stake, which is most likely to be personnel or payroll data. So fuck it - if the system can't handle losing track of some data for a few hours ... then it's overly sensitive for bean-counters to be trusted with. So, people who do science work will have systems that they can bodge and fondle as appropriate in the timescale available (laptop fried ; pull hard drive and drop into another machine ; boot from USB and continue ?) while bean-countery stuff can wait until you get beck to the office.

Which also deals with point (2) of yours : bring it into IT and explain just what you did. Expect the Spanish Inquisition to be waiting for your tattered remains after the Nerdish Inquisition have had their fun.

i don't understand...

[wbr1]

Why is this not done already? Between truecrypt and (ack) bitlocker,it s relatively easy. Add in a robust backup system, which any organization should have already, and it is cheap and fairly easy to implement.

Re:i don't understand...

[Nos.]

Because there's no enterprise management behind Truecrypt, which pretty much eliminates it. I haven't looked at BitLocker for a while, but I seem to recall it had its share of issues as well. I've used Safeboot, and its not terrible.

Regardless, its not as simple as saying, "here, install this".

Re:i don't understand...

[Synerg1y]

Yep, you've got to have a documented practice to keep track of the recovery keys encryption programs generate. Also, my two cents is they were probably recommending encrypting the laptops, so anybody who wasn't a complete newb with computers did so, everybody else ignored it. Also, it's kind of hard to lose a laptop, I understand burglary is out of your control, but leaving it at a coffee shop is a testament to the lack of attention of the individual user.

Re:i don't understand...

[TechyImmigrant]

>Yep, you've got to have a documented practice to keep track of the recovery keys encryption programs generate.

No. I work in a big corp. If I die, my FDE password dies with me and the data is gone. Real data is held on servers and managed. A PC is just an access device.

Re:i don't understand...

[jader3rd]

No. I work in a big corp. If I die, my FDE password dies with me and the data is gone. Real data is held on servers and managed. A PC is just an access device.

I suspect that most corporations don't want their IP to die along with, or be held ransomed by, their employees.

Re:i don't understand...

[cigawoot]

My company uses Check Point FDE. Its good software, provides an easy way for the helpdesk to provide either a one time login or a password reset if needed in order to allow and end user into the system. OTLs and Password Resets can be audited, if needed.

Re:i don't understand...

[UnresolvedExternal]

I think you are missing the ACs point - the important data on the laptop should be in sync with the servers. All of the other stuff is probably crud anyway.

Or at least it should be....

Re:i don't understand...

[Anonymous Coward]

I suspect you failed to read his first line, third sentence.

Re:i don't understand...

[AMuse]

Wow, do you bring the servers with you when you go do field tests of your robot in the desert? Or on the plane when you're doing hurricane fly-through ops?

Wait, you don't have those kinds of complexities in your corp? Interesting.

I wonder if NASA is a really complicated and nuanced sort of place and how that might provide challenges for these sorts of seemingly trivial things.

Re:i don't understand...

[Enderandrew]

All my data is on servers as well, not on my laptop, though my laptop is encrypted. And so long as I can get a cell phone signal, I can convert that to wifi and VPN in to the data. I can even do that with free tools.

This is so complicated that NASA can't figure it out with a budget of billions and brilliant engineers?

Re:i don't understand...

[Anonymous Coward]

why is he an AC he has an account.

Re:i don't understand...

[jeffmeden]

Why is this not done already? Between truecrypt and (ack) bitlocker,it s relatively easy. Add in a robust backup system, which any organization should have already, and it is cheap and fairly easy to implement.

"Hello IT support? Yeah i forgot the password to the encryption doohickey you sent me. can you reset it please? I have a few things i need to finish before the next mars rover software update."

Re:i don't understand...

[UnresolvedExternal]

Antecedent

Re:i don't understand...

[thoth]

I realize people want to shit themselves in excitement railing on the incompetent government, but seriously, how many corporations fully encrypt ALL notebooks/laptops? Because private corps never lose data, right? Plus with this loss, it is only going to be NASA employee PII (not that that is better, but a lot more contained), not say a credit card or store breach where YOUR data might be lost.

Besides, implementing encryption involves handling passwords, keys, protecting the data-at-rest in the first place (servers/mainframes where it is better protected), securing access points like desktops and mobile devices (which it sounds like they are in the middle of doing).

Re:i don't understand...

[Anonymous Coward]

Corporate encryption is very easy anymore.

We use 3 different methods at work and we encrypt every single computer that we can. Yes, even the ones in people's offices.

My favorite so far is Microsoft's Bitlocker. All they keys are saved in Active Directory and you can add a master data recovery certificate. The encryption can be automaticly turned on and it encrypts in the background (Even allows reboots mid process). The major limitations of bitlocker is that its only supported on Windows 7/8. So we have to use other software for XP/OSX.

If you happen to be running a i3/i5/i7, it supports native AES and the disk impact is minimal.

Re:i don't understand...

[geekoid]

Yeah, there is a ton if good signals in a hurricane.
Or in the middle of no where.

And sometime the data is extremely large, making cell based network pretty useless.
Yes all the engineers or IT engineers and experts.
Protip: 'Engineer' covers MANY disciplines. I wouldn't want the engineer that works on robots building a bridge and visa versa.

The issue isn't NASA, it's your lack of experiences and over inflated ego.

Re:i don't understand...

[Anonymous Coward]

Name one FDE that works on Windows, Linux and Mac. Bonus Points if you name the universe you found it.

Re:i don't understand...

[Anonymous Coward]

Laptops aren't dumb terminals, you can actually have the data on there as well. The point is if it's not yet on the server it isn't safe. That's just a fact of life even without the possibility of losing encryption keys. If your laptop is the only container of any critical data, you're doing it wrong.

Or maybe you're just trolling. Oh well...

Re:i don't understand...

[Anonymous Coward]

CheckPoint seems to add a lot of overhead, though. Starting a certain über-enterprisey content management system took ~5min on my work laptop, and almost half an hour on a coworker's machine. Granted, machine specs and installed software are somewhat different, but nothing that should mean a factor 6.

I wonder why - the encryption itself shouldn't gobble up enough CPU, and the startup phase is largely I/O bound anyway. Perhaps the CP FDE driver negatively impacts readahead and write caching? TrueCrypt didn't add readahead support until May/2009.

Re:i don't understand...

[Anonymous Coward]

I work for government and we encrypt every single laptop. They also have firewall software actively blocking outgoing traffic unless explicitly allowed by an administrator. They also can't connect to untrusted wireless networks.

It's not rocket science, but I could see why NASA could have trouble with that. There is no good excuse. This is a prime example of doing security badly to fund something else, and then getting bit in the back by that decision, most likely costing more than properly doing your job in the first place.

Re:i don't understand...

[Enderandrew]

NASA engineers need employee data on an unencrypted laptop in the middle of a hurricane? In what scenario? And even in hurricane-affected areas, cell phone signals usually work. One of the laptops that was lost was carrying personnel data which should NEVER be on a laptop, especially an unencrypted laptop in any scenario. We're not talking about field data here.

LTE networks are faster than home broadband in many cases. And you're not transferring all the data across the network to your laptop, which is precisely what you don't want to do. The data needs to reside solely on the server. The laptop and VPN just needs to carry a low-bandwidth remote session. Cell phone networks are more than capable of that.

Your ignorance and insecurity is not the same as me having an ego.

It isn't that this is difficult or impossible for them to do, which is precisely why now that they'd made the decision they'll have it rolled out in a few months. The problem really here was apathy and poor security policies.

Re:i don't understand...

[jader3rd]

the important data on the laptop should be in sync with the servers.

I agree, that's the way it should be. But it's probably not that way in the majority of deployments. Even with good IT policies in place, enough IW's are going to try and do their own thing, resulting in the laptop having some additional valuable data.

Re:i don't understand...

[ryanov]

Why must it be one, exactly?

We use Credant here for Mac and Windows (and I hear it's DREADFUL -- awfully slow and other issues). I use the standard means in Ubuntu for Linux. I understand that that second one is probably not particularly manageable centrally, but certainly there is something else.

Re:i don't understand...

[Anonymous Coward]

If you happen to be running a i3/i5/i7, it supports native AES and the disk impact is minimal.

Not true, this depends on the particular CPU at least for the i7.

Re:i don't understand...

[Brian Feldman]

I suspect that most corporations use revision control and implement backups.

Re:i don't understand...

[deroby]

I was actually wondering about that. I have Win7 Pro, an i5 and TPM but can't quite believe it would be '100% transparent' ?!?

I do quite a bit of development on my machine. If anyone would "find" it, at worst they'd have access to my mail, documents, photos and a big bunch of code that is unlikely to be useful for anyone but me or my colleagues who have the same access to the repositories anyway.

None of that is going to be interesting to 99.999% of the population.
The ONLY thing that might be annoying is that they might be able to reverse engineer my passwords from the cache in FireFox etc.

I do quite bit of development in SQL and a bit in c#. The latter probably will not notice the presence of BitLocker working in the background, but I can't imagine the RDBMS not to suffer from it given the heavy dependence on I/O and throughput ?!? I might consider setting up a specific partition for the db's to get around that but I hate splitting disks into partitions if not strictly needed ... (I always end up with the need to store a 12Gb file and 7Gb free on one partition and 9Gb on the other)

Anyway, I HAVE considered running BitLocker but instead I actually had to remove it completely when I moved from my HDD to an SSD.
=> Doing an image copy from one disk to another (using RedoBackup, Ghost, ...) simply refused to boot until I removed the BitLocker partition entirely and then did the move. (BitLocker was not active, but it had this 'hidden' partition).
This makes me wary to try it again doubly so!
Given the way SSD's die I run an image backup of the disk every weekend. I now expect that restoring the image to a new disk will probably cause the same situation where the restored image (of gibberish) will refuse to boot. Heck, is RedoBackup even able to handle encrypted partitions ? Worse, let's assume that not just the disk is 'lost' but the entire machine; will I be able to restore the image on another machine ? (Even if it were the same model and specs?).

From my point of view the choice comes down to :
* do not encrypt the disk and have easy backups, a fair shot at recovering the latest information in case the FS goes mad, full performance
* do encrypt and know my not-very-important-data can't fall in 'the wrong hands' but backing up is suddenly more challenging, restoring might be even more so, in case the FS goes mad it's unlikely any forensic tools will be able to read anything useful and meanwhile the extra layers probably causes some degradation in performance.

Re:i don't understand...

[Minwee]

Do I have to?

Would you like to start backpedalling now, or should I just make up some extra caveats about enterprise management and vendor support contracts for you?

Re:i don't understand...

[Zed Pobre]

Just FYI, all maintainability issues aside, TrueCrypt doesn't have FIPS 140.2 compliance, which immediately disqualifies it as a mandatory NASA soltuion. See: http://www.truecrypt.org/docs/?s=compliance-with-standards

Re:i don't understand...

[TechyImmigrant]

There is danger in the period between generating content on the PC and committing the data to SVN (or git depending on the project). I'm not dead yet, and when I am, I will not care about the missing 1 day of work.

Re:i don't understand...

[dnahelicase]

Even with good IT policies in place, enough IW's are going to try and do their own thing, resulting in the laptop having some additional valuable data.

Good data? Additional data for sure, but probably only good data to the person who is using the laptop. I have this problem with people saving things to their local drives. I refuse to backup those personal folders. If they put it on the server it's backed up and managed correctly, but even if it hurts the business if their local data is lost, it's a good teaching tool to get people to save data where it should go. Local information is no good to the organization that cannot access it.

Re:i don't understand...

[Anonymous Coward]

I had a practice of having all server shares mapped as networked drives on my laptop, and using them to store all documents, which would get synchronized before I left. Nothing would be on my laptop, except for a shadow of the last work I did. If I continued working @ home, it would get updated the next day, unless I connected it to the VPN right there.

Re:i don't understand...

[Anonymous Coward]

>Yep, you've got to have a documented practice to keep track of the recovery keys encryption programs generate.

No. I work in a big corp. If I die, my FDE password dies with me and the data is gone. Real data is held on servers and managed. A PC is just an access device.

Which is great if you're a techy and know to sync your local data to the server, but Marge in Marketing, or Phil in Finance, may have important presentations or spreadsheets only on their laptop.

Re:i don't understand...

[Anonymous Coward]

Apathy? Of course, because they obviously haven't been doing anything else all these three years that full hard drive encryption has really been a viable option for a large, complicated operation. /sarcasm

Re:i don't understand...

[bware]

the important data on the laptop should be in sync with the servers. All of the other stuff is probably crud anyway.

I have many GB of data on my laptop (important to me, and no one else). The IT contractor charges a very expensive rate to store a GB of data, which comes out of project funds. So you can either do research, or pay IT real money to sync your data with the server (which is unreliable anyway. And we can't use cloud services due to ITAR issues). Which do you think the project implicitly encourages?

Everyone acts like FDE is some magic bullet. FDE only comes into action when you shut your laptop down, or log out. Which I have not done in months. What's the point of having a laptop if you can't open the lid and start working - if you have to reconstruct your work environment every time you put it sleep? At least that's how PGP FDE works, encrypt upon shutdown or logout. FDE would not have made this laptop loss less of an issue. FDE is a distraction from the the real problem here.

The real problem is that some HR idiot thought that it was ok to download a PII database onto their laptop and take it home. FDE won't fix idiocy.

Re:i don't understand...

[Anonymous Coward]

Personally I don't trust non-opensource security solutions, so I can't tell you much about bitlocker.

Re:i don't understand...

[TechyImmigrant]

Marge in Marketing gets Sharepoint. Engineers get linux, vnc, git and real management and tools.

If you haven't tried it, it is hard to understand how awful sharepoint is, but it is a way of getting the uneducated to put their ms office files somewhere other than their laptop.

truecrypt

[X0563511]

For the lazy it does the job well. No need spend budget on it.

Re:truecrypt

[Nkwe]

For the lazy it does the job well. No need spend budget on it.

There is a reason to spend budget if you are an enterprise or have a need for centralized key recovery. While you don't want to leak data if your laptop falls in the wrong hands, you also don't want to lose data if your employee forgets their decryption key (either by accident or as a malicious action.)

Re:truecrypt

[Krneki]

Easy to understand for someone with experience, totally impossible concept to grasp for people who never had this problem with larger networks.

Re:truecrypt

[X0563511]

True enough, but such things cost money. Something 'simple' like Truecrypt isn't a perfect fit but you can deploy it (at risk, as you state) without having to fork over cash.

I only state this because we should all be aware of the budget nightmare NASA has been living lately.

Re:truecrypt

[lister king of smeg]

easy fix make them save the encryption key to a text file on a key server at NASA when they forget simply ask the IT guy to go get they key. this computer should have NO network connection and all of the input ports (not counting the 1 for the keyboard) filled filled with epoxy. it should have its drive encrypted with several people who know they decryption key so there is no one person that can forget it and screw everyone.

Re:truecrypt

[Anonymous Coward]

Even better, from the TrueCrypt FAQ:

We use TrueCrypt in a corporate/enterprise environment. Is there a way for an administrator to reset a volume password or pre-boot authentication password when a user forgets it (or loses a keyfile)?

Yes. Note that there is no "backdoor" implemented in TrueCrypt. However, there is a way to "reset" volume passwords/keyfiles and pre-boot authentication passwords. After you create a volume, back up its header to a file (select Tools -> Backup Volume Header) before you allow a non-admin user to use the volume. Note that the volume header (which is encrypted with a header key derived from a password/keyfile) contains the master key with which the volume is encrypted. Then ask the user to choose a password, and set it for him/her (Volumes -> Change Volume Password); or generate a user keyfile for him/her. Then you can allow the user to use the volume and to change the password/keyfiles without your assistance/permission. In case he/she forgets his/her password or loses his/her keyfile, you can "reset" the volume password/keyfiles to your original admin password/keyfiles by restoring the volume header from the backup file (Tools -> Restore Volume Header).

Similarly, you can reset a pre-boot authentication password. To create a backup of the master key data (that will be stored on a TrueCrypt Rescue Disk and encrypted with your administrator password), select 'System' > 'Create Rescue Disk'. To set a user pre-boot authentication password, select 'System' > 'Change Password'. To restore your administrator password, boot the TrueCrypt Rescue Disk, select 'Repair Options' > 'Restore key data' and enter your administrator password.
Note: It is not required to burn each TrueCrypt Rescue Disk ISO image to a CD/DVD. You can maintain a central repository of ISO images for all workstations (rather than a repository of CDs/DVDs). For more information see the section Command Line Usage (option /noisocheck).

Re:truecrypt

[Nkwe]

easy fix make them save the encryption key to a text file on a key server at NASA when they forget simply ask the IT guy to go get they key. this computer should have NO network connection and all of the input ports (not counting the 1 for the keyboard) filled filled with epoxy. it should have its drive encrypted with several people who know they decryption key so there is no one person that can forget it and screw everyone.

Easy fix for a small deployment, but if you are talking about enterprise level deployments (tens of thousands of desktops) you would have to have several "IT guys" whose job is maintaining this database - both keeping it up to date and retrieving lost keys on a 24/7 basis. It is very hard to "make" tens of thousands of employees do anything, so unless your key escrow system is automated, it won't be reliable at that scale. Sure you could develop programs or scripts to manage all of this, but doing so has a cost and at enterprise scale you are going to want something that is tested and supported by a vendor.

Note that most enterprises running at this scale would be on a Microsoft Windows based infrastructure with Active Directory. These enterprises have already paid for BitLocker - it is included in your enterprise agreement with Microsoft. It amazes me how many companies who have already paid for disk level encryption (with managed key escrow) aren't using it.

Re:truecrypt

[geekoid]

Becasue they don't pay people to set it up? run it? maintain it?

Clue: Software is almost ALWAYS the cheapest part of a solution. Manpower is expensive. SO, yeah that software is free, and that's cute and all but that is a minor part of the cost.

Now they also need to learn good backup habbits

[Anonymous Coward]

I worked for a major technology vendor. A few years back they mandated full disk encryption on all laptops (Good idea right) Problem was they went with some company i never heard of and the stuff would randomly corrupt and all data would be lost. Certain people (executives) lost a lot of data because the only copy were on the laptops. This was all sorts of fun for the IT group.

Re:Now they also need to learn good backup habbits

[Anonymous Coward]

We had similar problems with McAfee Endpoint. Recovery tools would SOMETIMES resolve the issue. Everyone who gets a laptop signs off that all important documents must be saved to their home folder (synced across VPN). Because syncing a 200 MB contract or DB dump is SOOO easy at dsl speeds...

Local IT issued encrypted thumb drives for the higher-ups. That saved a few, but not all.

Now they are moving to BitLocker.

Space age?

[Defenestrar]

I'm quite close to a different national lab type of federal facility and all of their laptops have been encrypted for at least a few years now. The stuff here isn't any more sensitive than the stuff there - it's just under an actual cabinet position. Bureaucracy may sometimes be a headache - but enforcing common sense policies is one of it's strong suits. Besides - is NASA really benefiting in it's efficiency from it's "bureaucratic freedom"?

Re:Space age?

[Defenestrar]

I feel so ashamed - the apostrophe protection society is going to hunt me down.

Re:Space age?

[Anonymous Coward]

Defenestrar:

I feel so ashamed - the apostrophe protection society is going to hunt me down.

And we're going to throw you out the window.

Re:Space age?

[geekoid]

You may have made Geoffroy Tory turn over in his grave`

Re:Space age?

[colinrichardday]

Actually, the use of "it's" as a possessive is constitutional, as it literally occurs in the (US) Constitution.

Hammer to kill a swarm of flies

[Anonymous Coward]

Encrypting everything on a device just seems so stupid to me.

It slows down overall performance. It does provide greater security than just encrypting the sensitive files.

But really what's the need to have your OS and application files, which are going to be the same on every device, encrypted? It would seem that, if you can collect enough samples of encrypted disks that have enough of these files on them that would in and of itself provide an attack vector to decrypt the desired "sensitive" information.

Re:Hammer to kill a swarm of flies

[amiller2571]

It is not stupid by any means, the system stores information all over the place. It would be to hard to try and encrypt each one by itself. It is far easier to just encrypt the whole thing. You would be surprised how little of a hit you take in performance. I used TrueCrypt for a good while and I never notices any slow down at all. Encryption like AES are extremely fast.

System encryption provides the highest level of security and privacy, because all files, including any temporary files that Windows and applications create on the system partition (typically, without your knowledge or consent), hibernation files, swap files, etc., are always permanently encrypted (even when power supply is suddenly interrupted). Windows also records large amounts of potentially sensitive data, such as the names and locations of files you open, applications you run, etc. All such log files and registry entries are always permanently encrypted too.

http://www.truecrypt.org/docs/

Re:Hammer to kill a swarm of flies

[MightyMartian]

Chief reason is to encrypt the swap file. If the swap file is not encrypted, keys and data could be potentially retrieved.

We've done it

[Anonymous Coward]

For many years.

what about laptops on the ISS?

[Anonymous Coward]

will they encrypted?? will they be forced over to windows?

Re:what about laptops on the ISS?

[Tastecicles]

1. I don't think there will be much chance of a laptop being carelessly knocked off a window sash onboard the ISS any time soon.
2. If such a thing were to happen, solar radiation and cosmic rays on bare electronics would likely take care of any data.
3. If the laptop does survive that, it's unlikely to survive re-entry.
4. If it does survive re-entry, it'll likely still be travelling at several hundred miles per hour and be uncomfortably hot by the time it falls *through* the hands of some nefarious individual.

Re:what about laptops on the ISS?

[Anonymous Coward]

Laptops are already running Windows on the ISS. NASA is (usually) a pragmatic organization, it uses the tools that work for them.

Re:what about laptops on the ISS?

[somersault]

Why would they be forced to Windows? Any time I've installed a Linux distro recently, it's at least asked if I want to encrypt my home folder.

Re:what about laptops on the ISS?

[geekoid]

Do you now the send electronic signals to the Space Station? I know, amazing, right?
Did you know electronic signals can be used to get into a computer by a person who isn't even in the same room? I know,. shocking!

Re:what about laptops on the ISS?

[Eunuchswear]

Do you now the send electronic signals to the Space Station? I know, amazing, right?
Did you know electronic signals can be used to get into a computer by a person who isn't even in the same room? I know,. shocking!

Do you know that encrypting the disk is a way of protecting against getting data from machines that are turned off and provides no protection at all against being hacked by remote access?

Good job someone just invented encryption...

[M4n]

They must have been waiting years for something like this.

Large Company in Defense Sector

[Anonymous Coward]

This large company in the defense sector has been encrypting all laptops and desktops for a couple years now. It's pretty painless so far. Whatever you do, make your security transparent to the end user and life will be good.

Re:Large Company in Defense Sector

[Anonymous Coward]

open problem is remote admin requiring reboots now includes "wait for people to show up and type in their macafee passwords"

Re:Large Company in Defense Sector

[lister king of smeg]

Or could just go with someone other than Macrapy. Ubuntu I believe gives the option to encrypt the whole drive or just the home folder in the install wizard, and windows 7 enterprise has full disk encryption as a option if my memory serves me.

Re:Large Company in Defense Sector

[Ensign_Expendable]

Yep, they seem to be 90% Mac from what I see on the TV news. So I take it OS X's built-in FireVault won't do the trick. So what else is out there in the World of OS X security packages?

Re:Large Company in Defense Sector

[Atrox Canis]

That can be addressed via things like vpro.

Re:Large Company in Defense Sector

[MightyMartian]

That's the biggest suckage for us. We went to fully encrypted laptops and desktops this spring as a requirement of a government contract we won. Used Truecrypt, which is pretty painless, but it's pretty much killed remote work on our branch office machines. Now someone has to be there to fire it back up again.

Oh what I would give for Truecrypt to build in remote password entry like I can do with dmcrypt on *nix.

A bit of a misconception.

[sunking2]

NASA is a huge bureaucracy that is behind the curve in this aspect. The sad part is that they apparently have more laptops to lose with HR type information on them than they do ITAR. Which pretty much sums up NASA right now.

Re:A bit of a misconception.

[Anonymous Coward]

Not an excuse.

My company is a Telco you likely loathe and has 100,000 plus employees in its ranks. All Desktop and Laptops are drive level encrypted. Checkpoint is the software they use. Its use is transparent to employees. Logging in with your current Windows password decrypts the drive and starts the OS.

If you lose your Windows password, the IT group has the ability to decrypt the drive using a boot CD. Either the keys are the same ( unlikely ) or the system will query an online server for that users key ( or a secondary key ). Can't tell you, I don't forget my passwords :D

I'm sure there are some vulnerabilities out there for whole drive encryption, but for the most part, it keeps the data relatively safe from all but the most dedicated.

Herp Derp... why wait so long?!

[erroneus]

You know? Endpoint encryption is trivial. There are so many products that do it effectively and easily. Why is this being done so late? Where I work, we do that to EVERY computer a user touches, not just laptops. If it isn't locked behind a server room door, it's locked to a desk and the HDD encrypted. Even the receptionist machine is encrypted.

What the hell are these people even thinking?

Sure... data recovery is more expensive or more impossible. I get that. But you know? It's kind of worth it. Also, if it's important data that lives ONLY on the endpoint machine? Well, that's another thing they are doing wrong.

Re:Herp Derp... why wait so long?!

[somersault]

data recovery is more expensive or more impossible. I get that. But you know? It's kind of worth it.

That depends on what the data is and how valuable it is to competitors, etc. If you get so paranoid that you are literally chaining PCs to desks and encrypting them, do you also disable or physically incapacitate USB ports, make sure that nobody is sending out files via email, FTP, etc, etc? Or are you doing this more to protect from opportunist thieves?

Re:Herp Derp... why wait so long?!

[tlhIngan]

Well, IT has to deploy it - and there are VERY strange interactions that can happen.

One common one was after being issued new laptops, about half of them started getting "Delayed write failure" errors on Windows and subsequently, corrupted files. No one ever figured it out - a combination of BIOS updates, Windows upgrades (from XP to 7), etc., seemed to have minimized the problems.

Other ones included very odd daily BSODs as well - they just started happening and was linked to the FDE conflicting with the antivirus software.

Of course, I suppose the issue is the company was paranoid enough to use FDE, computer management/deployment, and computer monitoring suite at the same time (monitors which files get transferred externally, etc. Basically legit spyware).

I suppose the problem is partly Windows - after installing all that stuff, the whole system gets rather fragile...

Re:Herp Derp... why wait so long?!

[Beorytis]

At my 6,000-person employer, all laptops have required endpoint encryption for several years now. The reason it became necessary? To comply with federal regulations for contractors. We couldn't work on NASA (or FEMA or EPA) projects without it.

Re:Herp Derp... why wait so long?!

[garyebickford]

I visited a Chevron facility back in 1998. At that time they had their own custom version of Windows (did they have source?). Putting your own data or program on the machine would get you fired. The IT staff could, and would, push a new version of the OS overnight whenever they felt the need, writing over everything on the machine, including all your work if you hadn't pushed it up to the file server. Their desktops had no floppy, no CD, and this was before USB. Opening the case would get you fired. The guy I was visiting, an oilfield engineer but a former sysadmin at another company, had a network problem a few weeks before. If he were allowed, he could have opened the box up, fixed the problem and been back at work in 1/2 hour. As it was it took two weeks before the networking guy finally made it over to fix it, so the engineer was dead in the water for two weeks.

*face palm*

[Picardo85]

Jesus, the small company I worked for (400 employees or so) had all but the desktop machines encrypted many years ago. I can't remember what they used before the built in windows encryption, but at least they had something there.

It's insane to hear that large companies don't have their machines encrypted though it's a mouseclick away for their IT-dept while prepping the computer for deployment.

*face palm*

Re:*face palm*

[VortexCortex]

Jesus, the small company I worked for (400 employees or so)
[...]

It's insane to hear that large companies don't

Scale. Hindsight. Legacy Systems. Easier said than done.

Sometimes you want to do the "right thing"(tm) but need some sort of cluster fsck to show those higher ups that the cost v benefit analysis preventing you from doing so is wrong. Notice it was personal info, not science & engineering stuff. Which would be more effective to lose if you want an org-wide policy approval? Just sayin' maybe their "IT-dept" is actually working as intended.

Re:*face palm*

[geekoid]

great, now do it for 10,000 people, not all of whom are using the same OS version, across the world. Plan the maintenance for that. the history, roll out time. and so on.

400 people, how...quaint

Re:*face palm*

[strikethree]

If it makes you feel any better, many corps and agencies do indeed have full disk encryption already. It takes time for this kind of thing to filter through to everywhere. As you grow older, you will see time differently and begin to understand why some are ready and others are not yet ready. It has been less than a decade that this has even been a realistic goal.

Re:*face palm*

[Anonymous Coward]

Jesus, the small company I worked for (400 employees or so)...

I've heard many different interpretations of the Christian bible before, but never this one. Is there a newsletter to subscribe to where I may learn more information?

Re:*face palm*

[Anonymous Coward]

GE uses encrypted laptops. 300k employees, worldwide distribution of labor. No problem.

Encryption mandatory

[__aardcx5948]

Wait, NASA doesn't encrypt its laptops? Why not?

Just use Bitlocker, it's enforced by GPO where I work. Or if on another system, truecrypt or just CryptFS.

Why is this an issue?

Re:Encryption mandatory

[ulzeraj]

I know that a lot of people working on NASA doesn't use Windows.

Re:Encryption mandatory

[tukang]

Wait, NASA doesn't encrypt its laptops?

What's even more shocking is that they steal laptops

Re:Encryption mandatory

[Anonymous Coward]

What does this have to do with anything? Linux has cryptsetup, FreeBSD has geli, Solaris now has ZFS encryption and probably more tools. There are drives that encrypt in hardware that are either for laptops or in the whole SCSI/SAS arena that I'm not lucky enough to be in...but there is a hard drive shortage in play.

My issues with the software side of encryption are these:

a) Reliable key management and recovery. It's easy with cryptsetup and geli, as well as file-based solutions like GPG. eCryptFS looked rather unpleasant, and I was somewhat lost with EFS on Windows XP. I think this way: If there are too many hoops to jump through to get key recovery, data will be lost.

b) Performance. Without any hardware crypto helpers, expect a noticeable overall loss of performance. Sometimes it's a 5% loss, sometimes it's a 30% loss, it depends on what you're doing. Keep in mind, computers that are fast enough for 24/7 crypto are fairly new. If you don't mind going slow for the sake of safety, that's fine, but I can't convince many people to do that.

c) Testing takes more time than usual. For my own deployment on a spare 32-bit Linux server, I thought I did well with cryptsetup and XFS until it ran out of vmalloc space to allocate files for backup. After much pecking through stale Internet answers and unfriendly mailing lists, I stumbled upon the problem myself: When I set up Linux to see more than 864 MB of memory, the kernel dropped my vmalloc space from 256 MB to 128 MB, and that was fine for XFS by itself but not with cryptsetup. After setting vmalloc to 384 MB, the problem went away, but to make sure it didn't come back, I went for the highly-not-recommended kernel 2G/2G split of address space...and it worked perfectly. When it comes to file systems and crypto, advice on the Internet is poor and getting worse. I tested, and tested, and tested, and I have trustworthy crypto solutions that I can use wherever I go, even if it's just GPG and flash keys. However, I can't recall anything that I *had* to test so much. GPG key management was child's play next to this. So was my experience with C, VB, and SQL Server.

d) Backups must be done. When you don't do crypto, you might let a backup slide for a few days extra. If there's a disaster, there are plenty of recovery and forensics tools around for plaintext drives. There's less of an option here when dealing with crypto.

I take this as law: When somebody asks you, "You can get my data back, right? Right?" then your answer has to be better than, "uhhhhh..." and once you say, "yes," you must back up that with action. "It depends" is a really bad answer, and there's a lot of "it depends" in crypto.

Crypto simply adds hassle and wastes time for the benefits it provides. If NASA saw that data on some of their laptops was not worth encrypting because they trusted the people that operated the laptops, I can see that quite easily. Bad results, but it's understandable. If I thought that we were going to have something important like another space shuttle or an astronaut on Mars, I might be worried a little more about plans on a NASA laptop.

Re:Encryption mandatory

[painandgreed]

Why is this an issue?

My guesses are:

Older users and laptops that weren't encrypted and the user doesn't want to mess with it.
Departments and users that buy their own equipment with their own budgets and never go through an IT department.
Personal laptops (bought and owned by users) used for work.
Department and users that buy the wrong laptops (no TPM) when their IT practices require it.
Combine all of the above and there are probably lots of laptops the IT department doesn't even know about unless it's lost with work data on it.

A months time?

[HideyoshiJP]

That seems like a project that will take longer than a month. Full disk encryption on a large scale is a PITA.

Re:A months time?

[Synerg1y]

That's why it's a lot better to be pro-active about it and handle it pre-deploy. A month to play catch up isn't actually all that bad. Then again I think it'll probably take them longer anyways.

good idea

[mrflash818]

I work for A Very Large Health Plan, and it is policy that all work laptops use encrypted harddrives and USB drives.

The laptops that are issued out to us workers already come encrypted, and also with the software that only allows writing to USB drives if you allow the software to encrypt the USB drive.

So far, seems to work, but does make a new laptop seem to be modest at boot/read/write times.

Re:good idea

[MachineShedFred]

I work for A Very Large Retailer, and we've had all our laptops encrypted for years, as a Safe Harbor requirement, and a requirement of auditing by the payment card industry.

Good to know that government is catching up to where business has been half a decade ago.

[shrug]

[Thumper_SVX]

You know, we've been doing this for four years where I work. And yes, I know everyone here is going to espouse Truecrypt as the one true solution, but the simple fact is NASA is run as a corporation... as such they'll probably go for a solution that's vendor supported. The fact that they're NASA will probably mean they'll get a pretty decent price on the software too.

Now, the downside of full-disk encryption (which many lazy corporations do instead of home directory only) is that it does increase the load on your system, slow it down and make recovery if/when it breaks a royal pain. Our helpdesk has an almost constant stream of laptops coming and going through their hands that they have to decrypt and re-encrypt because something got out of sync. Time consuming, and leads to downtime for the users. I've often suggested home folder only encryption... but the higher ups want it all encrypted... right up to the point that their laptop is down for two days because they've broken it.

By the way, another horrible side effect of whole disk encryption is that our experience says that it'll kill SSD's pretty rapidly. Our average SSD life is less than a year at this point because there doesn't seem to be a good full-disk encryption software that properly implements TRIM... so spinning disk or hybrid disk is the way to go.

Re:[shrug]

[ltcdata]

You know, we've been doing this for four years where I work. And yes, I know everyone here is going to espouse Truecrypt as the one true solution, but the simple fact is NASA is run as a corporation... as such they'll probably go for a solution that's vendor supported. The fact that they're NASA will probably mean they'll get a pretty decent price on the software too. Now, the downside of full-disk encryption (which many lazy corporations do instead of home directory only) is that it does increase the load on your system, slow it down and make recovery if/when it breaks a royal pain. Our helpdesk has an almost constant stream of laptops coming and going through their hands that they have to decrypt and re-encrypt because something got out of sync. Time consuming, and leads to downtime for the users. I've often suggested home folder only encryption... but the higher ups want it all encrypted... right up to the point that their laptop is down for two days because they've broken it. By the way, another horrible side effect of whole disk encryption is that our experience says that it'll kill SSD's pretty rapidly. Our average SSD life is less than a year at this point because there doesn't seem to be a good full-disk encryption software that properly implements TRIM... so spinning disk or hybrid disk is the way to go.

I run a Lenovo X220 with hardware accelerated AES on a Core I5. The increased load is NON-EXISTENT. Also if you run a SSD with sandforce controller (which compresses data), the performance will be poor, and the wear very high. I run a samsung 830 SSD. Fastest ssd for encrypted disks (does not compress data on the fly). Also, i use DiskCryptor. It does have TRIM enabled for encrypted disks.

Re:[shrug]

[Nimey]

It should only slow down old/cheap computers whose CPUs don't support the AES instructions, and TrueCrypt now supports TRIM... and AES instructions.

It'd be nice if someone would write a front-end for TrueCrypt that supports enterprise-type manageability.

Re:[shrug]

[Anonymous Coward]

Full disk encryption is prefered because it is hard to ensure that users or applications don't leak information from protected directories to unprotected directories.

Did you look for self-encrypting drives? I don't know if SSD offer this feature yet but you can get HDDs which do the encryption in the drive itself and give access only when provided with the key.

Re:[shrug]

[MufasaZX]

I implemented Seagate hybrid drives and PGP Whole Disk Encryption on all my company's laptops a year or two ago and it works very well, and only once had a funky out-of-sync explosion that required a call to Symantec support to resolve. If you pull out a drive that has an OS issue and try to slap it into a USB dock, as long as the other computer also has PGP it'll just ask for the password and then away you go.

One minor thing that doesn't work is boot-sector based BIOS updates (Dell in particular), but getting around this with a bootable Windows98 USB key is easy enough.

Another problem with SSDs...some of them (SandForce) use compression to reduce the write cycles to the flash chips and boost performance, which is all well and good until your data is encrypted and totally uncompressable. It still works fine, but the stunning SSD performance from SF's controller comes down to more mortal levels. Hence we use the Seagate hybrid drives, they are cheap, large, and fast enough.

Re:[shrug]

[IT.luddite]

So much for using mod points on this discussion... 3-4 years ago, I was the technical lead on a project to encrypt all laptops (mobile data, but not handhelds... *shrug*). The original project team had selected a solution (home directory only encryption) and then commenced to hit the skids. I was brought in to turn the project around. I found security weaknesses on the directory encryption (Hiram's boot cd could easily bypass it). We decided to test a whole disk solution, and went with it. For an environment that had 800+ laptops, ~25% being field crew devices (shared devices, assigned to a truck with crews then assigned to trucks on a daily basis), full deployment took 6 weeks and a dedicated team of 6 people. During the 6 weeks, we trained the IT Support staff on how to support systems w/ whole disk encryption including the decrypt process as well as continuing the roll out for new hardware deployments. Does it add to overhead on support and cause situations where data is "unrecoverable" when otherwise there would be a reasonable chance to recover? Yes. The business determined it was worth it due to the number of laptops lost/stolen. As a side note, not one user complained about additional system latency. Password sync was easily achieved via LDAP and the keys to the kingdom is held in an enterprise cert that can decrypt/access all devices. PGP WDE is the current solution. So far, so good. No linux support though.

Re:[shrug]

[sribe]

I've often suggested home folder only encryption... but the higher ups want it all encrypted...

And they're absolutely correct. A laptop gets stolen that contains information which you are legally obligated to keep confidential, and you are threatened with a lawsuit over the breach of confidentiality, do you prefer:

A) being able to say "the entire disk was encrypted"

B) having to argue that having the user's home folder encrypted was sufficient, and potentially having to prove that no confidential data was stored outside the home folder, but having to prove that without the actual disk in your possession as evidence

Re:[shrug]

[Anonymous Coward]

Shutting down a laptop with an encrypted fileysystem, abruptly (IE, battery dying) guarantees corruption.

If you are going to encrypt your filesystems you will also need to rigorously back up the contents against corruption and educate your users in how critical it is to properly and completely shut down the laptop. This, IMHO, is a losing battle.

Re:[shrug]

[geekoid]

I look forward in getting your keys and password out of your swap file.

Re:[shrug]

[RNLockwood]

I work for a US Federal Agency and our notebooks were all encrypted about two years ago. I know that some problems arose from that but in my major problem is that it takes 10 or, more often, 15 minutes from boot to have a usable machine! We will soon need to insert a "LinkPass" card in our machines to be able to use them (we have had the passes for a few years), we must wear the cards in the facility, and they will be used to unlock exterior doors, too. It's going to be difficult to remember to take the card out when one leaves the vicinity of the office/cubical.

Re:[shrug]

[Anonymous Coward]

Link please. Can you provide any other references to encryption and reducing the life of SSD's? It's not something I've heard of before. Not saying you are full of it, maybe I've been under a rock.

Re:[shrug]

[Anonymous Coward]

Use an enterprise grade encryption solution and the "decrypt re-encrypt" crap becomes irrelevant.

Re:[shrug]

[Anonymous Coward]

Or you just use one of the many SSDs that has AES-256 built in (and is doing it all the time, regardless of whether the key has been password protected or not). Some of them even work with typical corporate encryption solutions.

Budget Cuts?

[Anonymous Coward]

Between April 2009 and April 2011 it lost or had stolen 48 'mobile computing devices.'

Why would NASA need to steal 48 'mobile computing devices'??

Re:Budget Cuts?

[lister king of smeg]

i thought that to

Re:Budget Cuts?

[richlv]

http://www.space.com/14531-nasa-mars-missions-budget-cuts-2013.html

Many companies already do this

[Anonymous Coward]

Many companies already do this. All notebooks where I work (a large Si company) have encrypted hard drives. With a SSD and a reasonably modern CPU there is very little performance impact. My 2 year old notebook with SSD and encryption is much faster than the previous model which had no SSD and no encryption.

What's surprising is that the majority of companies and government agencies don't do this. The cost of implementation is very low compared to the value of the data that could be lost.

12 years ago

[Anonymous Coward]

They started the paperwork for it 12 years ago, but it only just approved.

Snark is easy, how about a technical discussion?

[Anonymous Coward]

How about an actual conversation about encrypting laptops? What tools do you prefer? What is your workflow?

Reasons

[rossdee]

They are worried that Aliens might steal their technology
Somebody might find out they aleady stole alien technology
They are worried that the FBI might hack into their emails and find out who they are having affairs with
Sheldon Addison might wonder where the money he gave Newt went

Really...9/11 forced a lot of large Corps to

[oxnyx]

The security laws in the US after 9/11 force alot of big corps to encrypt. As far as I tell it slow down boot time and forces IT to take 2 days to turn around anything as there is 12hrs to decrypt the hdd and then 12 to re-crypt.This month we got told to put stickers on all documents to state it security level...I'm really sure those stickers "CORP. INTERNAL ONLY" will really slow down those outsider eyes. Soon I'm sure we will have to us a secret de-coder ring to read the print out. Really have you guys read most internal documents? They are of little interest to the people who are PAID to read them.

Re:Really...9/11 forced a lot of large Corps to

[tatman]

I wonder how long it will be before the gov starts either regulating it. I mean a) requiring it b) requiring a gov back door. All in the name of fighting crime of course.

Really?

[erp_consultant]

I'm surprised that this is not already standard procedure. If it were up to me I'd probably disable all the USB ports as well. If you've got the best firewall in the world it won't be worth a plug nickel if someone takes a flash drive with a virus on it and plugs it into a PC in the office. Now you're inside the firewall and it spreads like wildfire.

Good old fashioned IT management

[Krneki]

A known problem since the first laptop was issued, but ignored until today.

Now that the shit hits the fan they want it done yesterday.

Re:Good old fashioned IT management

[Pontiac]

More likely is that it's been a revolving budget request from IT for years and years but upper management keeps pushing it down the list to fund high visibility pet projects to pad their resumes with.

Only when the shit hits the fan to these low profile projects get funding and suddenly need to be done ASAP without any proper selection process.
The bid ends up not with the best product but in the hands of the sales drone the boos is cozy with.

The lesson here is.. If you have an important project that keeps getting kicked down the road be prepared.. Have your selection and proposed budget done and ready to roll so when the boss runs in asking for ideas you cover his ass you have something to hand them.

When you have a billion hammers, flies ARE nails

[Anonymous Coward]

But really what's the need to have your OS and application files, which are going to be the same on every device, encrypted?

That is done simply because it makes things simpler (that's the upside) and it's essentially "free" (there's virtually no downside). Even with low-end 2004 tech (a single core 800 MHz Transmeta CPU) I could barely notice dm-crypt having a significant effect on performance or battery life. With modern hardware people would need to use benchmarking tools just to be able to see the extra percent of overhead that one of their many cores has to endure. It's just too cheap to worry about.

It would seem that, if you can collect enough samples of encrypted disks that have enough of these files on them..

I'm not sure if this is a 1970s thing or more generally a "post-WW2" thing, but most crypto these days tends to be resistant to "known plaintext attacks".

This is amazing: Why didn't they do it 10+ years a

[Terje Mathisen]

I was in charge of testing/verification of full disk crypto when my then-employer (Hydro) mandated it almost 20 years ago:

At that time 5 vendors made it through our pre-qualification tests, among these I was able to trivially break 3 of them (replace a conditional branch with its opposite), one took 20 minutes and only Utmaco's SafeGuard Easy had done a proper security design, where the user password was used as (part of) the seed for the key used to decrypt a copy of the master disk key.

I.e. the system _must_ be safe against attack from anyone, including the vendor!

I wrote a longer post about this the previous time the same issue came up on /.

Terje

Re:Snark is easy, how about a technical discussion

[Anonymous Coward]

This.

Why keep data on the laptops at all?

[concealment]

At this point, why not have them VPN in to a central server, and keep all work materials there?

Between the trendy "cloud" and the availability of high-speed internet and most computers having encryption cycles to spare, our machines are now souped-up thin clients.

The idea that people need to take gigabytes or even megabytes (640k is ok though) of confidential data home with them on their laptops needs to be questioned. What are you doing with all of that? At home? On the subway?

Forget it: keep the data under control, and make the laptops worthless to foreign espionage.

My work laptop

[Sparticus789]

I work for the Federal Government and every laptop has to have FDE in order to leave the building. This policy has been in place for years. NASA is just behind the times of every other federal agency. Too busy playing with robots, I assume.

AAARRRRGHHH

[MrLint]

NONONNONONONO

This is not how you deal with an incident like this. You have to reexamine your infrastructure and find out *why* that info was on an endpoint to begin with. This is teh same BS kneejerk reaction that makes for bad IT planning. Just go and wallpaper of it with a band-aid and look all betterer.

HULK SMASH!!!!

Re:AAARRRRGHHH

[Beorytis]

Planning is great and rules are great, but you need to be ready for the inevitable cases when plans are not followed and rules are broken.

Re:AAARRRRGHHH

[MrLint]

Sadly you are right, nature keeps giving us better idiots

Re:AAARRRRGHHH

[FaxeTheCat]

You have to reexamine your infrastructure and find out *why* that info was on an endpoint to begin with.

And when you examine the infrastructure you may find (we do) that there is no LAN speed infrastructure everywhere (not to speak of the latency crossing a continent), and there are cases where there is no connectivity at all.

Keeping all data centrally is a good idea, but sometimes the real world will just not cooperate.

The McAfee Solution

[Anonymous Coward]

NASA should do what my employer has done, and start utilizing to McAfee Endpoint Encryption. If you attempt to break the encryption, your computer gets high on bath salts and tries to kill you. Seems secure to me.

NASA doesn't own most of their computers

[oneiros27]

They're leased from HP as part of the NASA ACES contract :
        http://www.nasa.gov/home/hqnews/2010/dec/HQ_C10-080_ACES.html

Prior to that, there was a contract with Lockheed Martin.

They have to put out a specification of what they want the machine configuration to look like, and then HP gives 'em a cost per month for it.

And the 'devices' lost aren't necessarily laptops ... it could be cell phones or tablets, which are also leased through ACES.

There *are* ways around this, but you have to do more paperwork, and then you can buy stuff off SEWP, and they're maintained by different groups of sysadmins (assigned to the mission, project or division).

And to make it more fun -- if you sign all of the paperwork to take a government furnished computer off site as a contractor, you're liable for the full original purchase price, no depreciation. (this might not be true for ACES) ... so I know a few people who brought their work-assigned laptops back and said they'd rather buy their own ... which means there's then *NO* control over them ... although they're not supposed to put SBU / ACI on it.

NASA Transparency drirective

[scorp1us]

I thought NASA was ordered to be completely open and no information was to be considered sensitive. This was ordered at its inception when it was created to provide the space program, in order to NOT be military in nature so that the Russians would not be worried. Sure they have shared information over the years but nothing NASA has done has been military in nature.

It seems to me then, that nothing NASA can have can be 'sensitive' in nature, and these encryption efforts run counter to t heir chartered openness.

Re:NASA Transparency drirective

[SecurityGuy]

NASA has employees. Those employees have things like SSNs and disabilities and other such things that go in personnel files. It's one thing to say that all NASA's mission data should be completely open, and quite another to say that means everyone who works there should expect the public to be pawing through their data when that data would be afforded protection at any other employer.

Re:NASA Transparency drirective

[Anonymous Coward]

Lots of information NASA can have can be sensitive: personnel records, contract bids, information about coming contracts, come to mind quickly. Vendors may supply details of products being considered for purchase, but declare those details to be confidential business information. Not everyone at an agency like NASA is working directly on science or engineering activities.

Re:NASA Transparency drirective

[pavon]

I thought NASA was ordered to be completely open and no information was to be considered sensitive.

While very little of NASA's work is classified, the vast majority of their technical work is covered by ITAR and export control laws, and has to be protected from dissemination outside of the US. Export control can be very over-reaching, and needs to have a major overhaul, however some of the restrictions are on things that could easily be militarized.

Re:NASA Transparency drirective

[Anonymous Coward]

This was ordered at its inception when it was created to provide the space program, in order to NOT be military in nature so that the Russians would not be worried.

Consider the logic of the Shuttle program:
1) Single-use rockets are the cheapest way to launch things into space. We know this now and we knew it forty years ago. If the Shuttle were cheaper, it would have been bought or replicated in the private sector long ago.
2) It is cheaper to replace a satellite than to repair it in orbit. Even with one-off projects like the HST, making a second one is cheap compared to design costs
3) Despite this, NASA spent 25 years hauling a huge cargo bay, wings, landing gear, etc up and down for every piddly astronaut mission, whether it needed them or not.

Why? Why waste so many resources?

The Space Shuttle could perform one specific task that nothing else could replicate: it could deorbit a large satellite intact. The Space Shuttle program ensured that the US had the ability to recover a satellite from LEO and bring it back for examination. Keeping a fleet of Shuttles meant we could do it nearly whenever we wished. We'd never need to do that for something we put up there, but we might get curious about another country's satellites.

The Space Shuttle program was the trump card to prevent the weaponization of space during the Cold War. If Russia built an orbital launch platform, we could prove it. This is why Russia was hell-bent on building the Buran...they wanted the same capability. The reason they mothballed it: just like the Shuttle, it was too fucking expensive to use for your standard commercial/scientific launches. The Soviets enjoyed the advantage of not having to answer to the citizenry. Anyone who asked about the Buran was told to fuck off. We, on the other hand, had to spend a quarter-century pretending this giant white spy-plane was the most efficient road to space.

Fuck that noise. I'm glad it's gone. Put it in a museum next to the U2 and SR-71

Re:NASA Transparency drirective

[scorp1us]

Well when I got to meet the guy that invented Beowulf at NASA (at a computer security class at UMBC) he said they could not use firewalls to protect the network and Beowulf was created from the effort of finding breaches that could have been prevented with proper application of firewalls and encryption.

48 'mobile devices'? in two years?

[Anonymous Coward]

Most businesses would have shit after a few devices were lost or stolen. Seriously, how do you lose a laptop or smartphone like that? Do thieves rove the NASA parking lot in packs? Is there a mugger riding up and down in the elevator?

Re:48 'mobile devices'? in two years?

[FaxeTheCat]

Most businesses would have shit after a few devices were lost or stolen. Seriously, how do you lose a laptop or smartphone like that? Do thieves rove the NASA parking lot in packs? Is there a mugger riding up and down in the elevator?

For an organization of that size with a fair share of mobile users, I do not think the number is very high. Our organization has all policies and training in place to avoid laptop theft, but there are still quite a few of them. Most happen during travel. Airports are bad. Then again, most organizations keep their numbers internal, so we will not know if NASA lose more than the average.

Way to be out front, NASA.

[NikeHerc]

My employers in my last two jobs have given me a total of three encrypted laptops, the oldest going back to the middle of 2008. If you choose an appropriate h/w vendor, an encrypted disk won't slow down the typical laptop user.

Encryption didn't seem to affect the Dell laptop; not true for the ThinkPad, it was slower than Christmas.

Why did it take so Long?

[Formorian]

I work in Gov't, state level. EVERY SINGLE laptop is encrypted. You plug in a USB, before you can move data to it, it has to be encrypted (you can move data off to computer without encrypting). You burn CD it get's encrypted.

They just this year started encrypting desktops also.

What I don't understand is why is it not a Fed Gov't rule that every agency that has portable media (tablets/laptops/usb/etc) has to be encrypted? This should just be standard now. Esp after having 48 incidents in 3 years? WTF, after first incident they should have started working on a plan to encrypt stuff.

Re:Why did it take so Long?

[denobug]

I work in Gov't, state level. EVERY SINGLE laptop is encrypted. You plug in a USB, before you can move data to it, it has to be encrypted (you can move data off to computer without encrypting). You burn CD it get's encrypted.

They just this year started encrypting desktops also.

What I don't understand is why is it not a Fed Gov't rule that every agency that has portable media (tablets/laptops/usb/etc) has to be encrypted? This should just be standard now. Esp after having 48 incidents in 3 years? WTF, after first incident they should have started working on a plan to encrypt stuff.

Because like so many trivial things in life, it gets political. Worse for federal government, since not only do they have to deal with office politics, they also have to deal with the OTHER politics when it comes to how to run an agency with the appropriate ideology, down to if it fits the ideological view of certain people whether to encrypt a stupid harddrive or not.

What's NASA trying to hide?

[Macdude]

What's NASA trying to hide? It looks to me like they're a bunch of terrorists...

Surprised

[thetoadwarrior]

My company has been doing this for ages. It just makes sense and I'm really surprised NASA does not do it already.

Public, private, practical

[Anonymous Coward]

On the practical surface of it, this should have been done long ago.

On a more theoretical basis, what's the justification for doing it at all? NASA is a publically-funded research organization. Maximizing public benefit would call for every detail of NASA's activities to be publically available, and "misplaced data" seems more like a happy-accident additional distribution mechanism.

The "right to be secure in one's papers" is a right of the citizen, not of the government. So what's the downside here? "Other countries might learn how to do our stuff"? They already can.

Re:Public, private, practical

[colinrichardday]

Would you be willing to work for NASA if your Social Security number were posted on a publicly available website?

Yes, why the wait?

[rickb928]

We've been doing this at my work for a few years now. Any organization that is at all concerned with data loss should already be doing this to all user workstations, portable AND desktop. Anything less is bordering on malpractice.

Re:When you have a billion hammers, flies ARE nail

[NikeHerc]

... most crypto these days tends to be resistant to "known plaintext attacks".

256-bit AES is generally considered safe for geologic time, with geologic time possibly being reduced by orders of magnitude for the NSA. Any NSA /.ers care to comment?

Horses and Barn Doors...

[Mr. Sanity]

Too bad they didn't do that before I had to recieve this email this week:

OFFICE OF THE DIRECTOR
November 14, 2012
TO: JPL Employees and Contractor Personnel
FROM: Charles Elachi
SUBJECT: NASA Laptop Security Breach
On Tuesday November 13, we were all notified that a NASA laptop and official NASA documents issued to a Headquarters employee were stolen. The laptop contained records of sensitive, personally identifiable information (PII) for a large number of NASA employees, contractors and others. NASA is assessing and investigating the incident and taking every possible action to mitigate therisk of harm and/or inconvenience to affected employees.
We at Caltech/JPL are extremely concerned about the potential implications of this incident to our employees and affiliates. We have been in contact with NASA Headquarters, and they advise us that they intend to mail letters beginning this week to affected or potentially affected individuals as they are identified. NASA has not provided us with thelist of individuals whowill be notified.
In the meantime, a good resource of protective measures is the Federal Trade Commission's website, Facts for Consumers, Identity Theft: What to Know, What to Do, at: http://www.ftc.gov/bcp/edu/pubs/consumer/idtheft/idt01.shtm. The State of California also has information at www.privacy.ca.gov. Click on "Consumer Information Sheets" on the left-hand column and you will find several Consumer Information Sheets that may be helpful.
We call your attention to this portion of NASA's message:
"NASA has contracted with a data breach specialist, ID Experts, who will be sending letters to affected individuals, informing them that their sensitive PII was stored on the stolen laptop and they could be impacted by the breach. This notification also will provide them information on how to protect their identity using the fully managed services of ID Experts at no cost to the individual. These services will include a call center and website, credit and identity monitoring, recovery services in cases of identity compromise, an insurance reimbursement policy, educational materials, and access to fraud resolution representatives. If you receive a notification letter in the mail, follow the directions to activate your services as soon as possible.
All employees should be aware of any phone calls, emails, and other communications from individuals claiming to be from NASA or other official sources that ask for personal information or verification of it. NASA and ID Experts will not be contacting employees to ask for or confirm personal information. If you receive such a communication, please do not provide any personal information."
We will issue further relevant information as we learn more. We are committed to assisting our employees who may be impacted by this incident. If you have questions, please feel free to contact JPL Human Resources at x4-7506.

Re:Horses and Barn Doors...

[ScottMaxwell]

Yes, but don't worry: that massive amount of info they're collecting on you as part of HSPD-12[*] is perfectly safe.

[*] Where NASA said we all had to submit to unrestricted background investigations -- where they could gather any data they wanted on you, from any source, whether it be your doctor, your lawyer, your priest, your ISP, or whatever -- and then a secret, unappealable tribunal would decide if we could keep our jobs. I and others sued them over this, and lost. But don't worry, we can all see that NASA keeps careful track of sensitive information.

Obligatory ref

[drdanny_orig]

http://xkcd.com/538/

Re:Obligatory ref

[colinrichardday]

Wouldn't a rubber hose be better than a wrench? If you hit people upside the head with wrenches, they're not going to be able to give you much information.

About F****** Time

[moonwatcher2001]

Boeing did this 6 years ago.

Why doesn't NASA Just....

[AMuse]

An awful lot of people in this thread have quick and simple "just do this" solutions for NASA's data encryption challenges.

NASA isn't your standard corporate environment - there are serious challenges to any "Just do X" solution. They DO need to encrypt everything but its not a simple single-answer thing. They have to accommodate every scenario from "HR newbie with PII data in an office envrionment" to "Laptop collecting data on a C-130 as it flies through hurricanes" to "Laptops controlling robots in the desert during field tests sulating Martian environments".

In many of those cases a laptop with broken
encryption software means millions of wasted dollars if the experiment is a wash.

In other cases NOT having crypto means serious secrecy issues.

Anyway, there's no excuse for this loss but could we please stop pretending that NASA literally never considered DAR on mobile devices, and that simply doing {your favorite product} on everything would solve all the problems?

Thanks....

Wonder what encryption they are using...

[Anonymous Coward]

An encrypted laptop is not a be all and end all. I wonder what program they are using for their FDE encryption, since some are better than others, especially when it comes to recovering data.

I have used one commercial program which, if the MBR gets hosed, the drive is worthless. No way to recover, period. Other utilities like TrueCrypt allow for backup CDs to be made so one has a good chance at recovery.

I'm assuming the laptops are running Windows. If so, humble old BitLocker is pretty good. With the TPM, it protects against a good amount of attacks. It also can use a USB flash drive and/or a PIN. Recoverability is easy -- either use a file saved off, use the entries stored in AD, or a data recovery agent.

I use this on laptops I use -- if I'm holding the USB flash drive and the laptop is off, then I know a blackhat will score hardware if it is stolen, but the contents of the laptop are definitely not theirs. I also use a HDD password just so the drive is not usable in any shape or form.

lost or stolen

[Anonymous Coward]

Do you think the laptops were really lost or stolen or maybe some people that work there just needed a 'new' computer to use at home

Re:When you have a billion hammers, flies ARE nail

[pixelpusher220]

Any NSA /.ers care to comment?

Are you prepared to die? ;-)

LOL

[Anonymous Coward]

Large corporations already do this, and have been for years.

ehm what?

[kelemvor4]

I wonder how it will be before other large organizations start following suit as a sensible precaution?

I'm pretty sure that laptop encryption IS the standard at most big businesses these days. It is in the company that writes my paychecks, anyway. I think NASA was just behind the times on this issue.

lol

[Anonymous Coward]

wait... you can put a rover on mars, use the rockets to counter balance the gravity, use weights on one side of the delivery vessel to deal with cold or hot weather and drag created by the atmosphere... but you waited till 2012 to encrypt laptops... that has to be the dumbest group of smart people ive ever met.

Duh...

[JDAustin]

I work for a large corp whose own screw ups with lost un-encrypted PC has been duly noted here on Slashdot. It is corporate policy to encrypt every hard drive that is not locked up. With Win7 and bitlocker its simple to get encryption for 80%+ of normal users.

Re:When you have a billion hammers, flies ARE nail

[geekoid]

depends.
Do you define 'Geologic time' as the time it takes to beat a password out of someone? Or the time it takes to ask the corporation to turn the key over?

Ontario has had this in some of their government

[Anonymous Coward]

As a Ontario Public Health unit we've had to have all of our Mobile devices fully encrypted for some time now. If planned right and the right tools are used the encryption doesn't add that much burden to IT, except for when you deploy systems. Although if you go for 2 factor Auth, 1 password for encryption, another for the domain/computer access then you have extra password resets coming your way.

With a lot of the new developments in SED's (self encrypting drives) you can cut the time to encrypt down to seconds.

Re:This is amazing: Why didn't they do it 10+ year

[strikethree]

I was in charge of testing/verification of full disk crypto when my then-employer (Hydro) mandated it almost 20 years ago

Because 20 years ago, the resources that it took were extreme so an extreme need was required to even consider it. A bit less than a decade ago, the resource usage became light enough to where most anyone could consider it and, not surprisingly, we are seeing it done more often. This is not rocket science... pun only slightly intended.

Right Time

[bill_mcgonigle]

I've personally been using LUKS for 4-5 years but I've also taken a power/performance hit for doing so.

Just ordered a new laptop with an i5 in it, and even within the i5 family I had to be careful to order a chip with AES-NI in it (the unit with the other specs I wanted winds up being mid-market due to limited configuration choice). But at least now the top 50% of the market has AES-NI built-in and those trade-offs are something to not-so-fondly remember.

So now the passwords will be on Post-It's?

[Anonymous Coward]

This will only stop data thieves who are too stupid to turn the laptop over and read the password off the owner's Post-It note.

Re:This is amazing: Why didn't they do it 10+ year

[Terje Mathisen]

No, the resource usage was not "extreme":

We did measure some slowdown of applications, but mostly in the single-digit percentage range.

This was simply because most applications those days did all their work in memory, only Microsoft's virtual disk swapper would use the disk during normal operation, and then only in case you suddenly needed a lot of free memory space.

Bulk load of application and data files did slow down a bit, but significantly less than 50%, i.e. the hard drive did not suddenly become half as fast even for bulk transfers.

When I was involved in the AES process more than 10 years ago, one of our targets was to optimize the crypto code so that a 1996 vintage PentiumPro could handle a 100 Mbit/s full-duplex communication line, or correspondingly about 20 MB/s of disk en/de-cryption.

Today full disk crypto is effectively free, except in power usage, since all computers have multiple cores, most of which are idle even when an application is working hard, and a single core can keep up with the fastest available (spinning) hard drive. A modern i7 core with the AES extensions can do the crypto without getting hot. :-)

Terje

why not use desktop virtualization...

[freshlimesoda]

but then again..its not rocket science.

We do

[Chris Mattern]

I work for a fairly large university. It's been part of our IT standard that all laptops must have full-disk encryption for a few years now.

Re:When you have a billion hammers, flies ARE nail

[garyebickford]

No need to beat - threats and bribery, or just cuteness and heavy breathing, will generally work fine. In red team tests back in 1999 (IIRC) a Navy group found that the average cost to bribe a sys admin to let 'bad guys' into the data center and provide passwords to get in was about $7000. With inflation, maybe that's $10,000 now.
I'm sure that 90% of workers would give up the password with merely a threat of pain, although I like to think that most would resist bribing.

Re:Snark is easy, how about a technical discussion

[Anonymous Coward]

This.

In other words, nothing.

Encryption isn't always the best solution

[SaZZer]

Where I work, all laptops are required to have full disk encryption. These are windows laptops, and includes the swap file. And this includes developer machines. Building large source trees on a machine with this encryption just isn't realistically feasible, but its what were expected to do...

The security people tested it out first of course - on some support machines that do nothing more than email and word. And because it worked well enough there it was rolled out compony-wide...

I don't understand the big deal....

[Anonymous Coward]

FDE is only effective if the laptop is turned off... do you guys really always shut your laptops down? I can't think of the last time I actually powered off my personal OR work laptop. Basically what I'm saying is... there's not much gain here, though it is relatively easy to implement.

Need to lose 48 devices to come to this insight?

[Anonymous Coward]

All my laptops have an encrypted /home... it doesn't take a genius to think of such a precaution, does it?

Not always a good idea...

[Anonymous Coward]

There's a lot of people who bemoan unencrypted laptops as being dangerous and irresponsible. The problem is that the management will require that the IT guys only use certain big corporate encryption solutions that have bits of paper saying their 'secure' which as we all know means nothing of the sort. Plus, those big corporate systems are usually so badly implemented that they cause a nice, new, nippy laptop to slow down so far you'd be better off typing a document on a typewriter. Corporate encryption and security software tends to suck the big one. Much better to leave PCs unencrypted but to require people to store everything on something like a secure external HDD or Ironkey-type USB drive.

wouldn't it be easier and cheaper

[Anonymous Coward]

to tell employees not to put personal information on government owned computers?