Security Advisor

The Whole Drive

More and more companies are using full-drive encryption (FDE) as a way to protect their data.

• By Joern Wettern
• 04/01/2008

Many companies are now looking at full-drive encryption (FDE) as a primary method of protecting data on notebook computers against unauthorized access. Selecting the right FDE solution for your situation can be a tedious process, though. You need to know your choices and what capabilities to look for when evaluating products.

While any encryption process will slow down disk access somewhat, it's unlikely that it would be enough to be noticeable during everyday computing. If top-notch performance is an important issue, run some tests with your standard applications using different FDE products.

Most FDE systems include the same components. After starting the computer, but before booting the operating system, there's a pre-boot authentication (PBA) process. For this step, the computer boots into a small proprietary operating system, often a hardened minimal version of Linux. The user is prompted for a username and password, or a smartcard or token with a certificate. The offered credentials are compared against the PBA database.

If authentication is successful, the PBA mechanism loads the disk encryption key into memory and starts Windows from the encrypted partition, using a

Windows driver to decrypt each disk sector as needed. Once the pre-boot authentication mechanism has handed control over to Windows, the computer's operations are essentially identical to a non-encrypted computer.

If authentication fails, the encryption key remains inaccessible and the Windows partition remains encrypted. Additionally, the PBA mechanism may block any further authentication attempts after a certain number of failed authentications.

One important factor when considering an FDE product is the type of authentication mechanisms it offers. The typical choices are username and password or some type of two-factor authentication using certificates, tokens or a biometric mechanism. Two-factor authentication provides a higher level of security, but may require significant administrative overhead. If you decide to go this route, base your choice on usability and manageability. Also, try to find a mechanism you can use for other authentication needs, like remote access.

Out of Sight
Security should be transparent to users, and not something that unnecessarily complicates their experience. Adding PBA could potentially do just that. To simplify the startup process, most FDE software integrates with the Windows log-on process to automatically supply your pre-boot credentials to Windows. As long as your credentials are valid for both PBA and the Windows log-on, a single sign-on takes care of both.

Keeping single sign-on working reliably can take some extra care. Full-drive encryption with single sign-on functionality generally monitors password changes in Windows and automatically changes the pre-boot password to keep the two synchronized. However, if you change your password on another computer, the pre-boot database may not be updated and the passwords get out of sync.

Other schemes include:

Hardware-based encryption: Seagate and other storage vendors have recently introduced notebook computer hard drives with built-in encryption hardware. Encrypting the drive in the hardware can increase performance and may make encryption easier to use and manage. Many of these drives, however, don't provide a robust mechanism for central password recovery or two-factor authentication.

File-based encryption: Some products only encrypt specific files instead of an entire drive. After all, many files on your hard drive, like operating system files, don't contain confidential information. You can get better performance by encrypting only those files that need to be protected. Also, by leaving the disk structure and system files unencrypted, you can use most disk repair and disaster recovery tools on your computer.

However, file-based encryption depends on users or software to make decisions about which files should be encrypted. Those decisions can leave confidential data unencrypted. Also, without PBA protection, malicious software can infect the computer when it's started from removable media. These factors make FDE a better choice than file-based encryption, in most cases.

BIOS or ATA password: Many notebook computers let you configure a password in the BIOS that you need in order to access the hard drive. BIOS passwords don't actually encrypt data. They activate a lockout feature in the drive's firmware. However, there are several tools available to bypass this protection.

Some of the biggest differences among FDE products lie in the simplicity of central management. Before comparing different products, it makes sense to create a complete list of expected management tasks, from automated installation to remote unlocking for users who forget a password or lose a smartcard. You should also evaluate how easy it is for multiple users to share the same computer or add new users to the PBA database.

Finally, if you remotely manage computers, evaluate whether you can still start a computer remotely without human intervention to perform maintenance or install software. To allow this, the FDE solution needs to have a mechanism to temporarily turn off the PBA.

Recovery Scenarios
FDE solutions also differ in how they let you access your data in case something does go wrong with the disk, such as an accidental erasure of the partition table or physical damage manifesting itself as bad sectors. If you don't store important data on an encrypted drive, disaster recovery may simply consist of replacing and re-imaging a damaged disk.

If you ever need to recover data from an encrypted drive, you first need to remove the encryption before you can use most disk repair or data recovery tools. Most FDE products let you remove encryption from a disk partition, but only some let you recover data when part of the partition has become unreadable or when the partition table is missing.

Choosing the right FDE product can be a challenge, but making the right decision is much easier when you know what to look for. To ensure that you get the protection you need, insist on integrated PBA and evaluate whether or not you need two-factor authentication.