Chapter 27 — Systems, endpoints and hardware security: verification
Lesson map
Lesson 27 published. Map, example, EX079.
flowchart TD
N0["Learning outcomes"]
N1["27.1 Verification"]
N2["Lab — encryption verification"]
N3["27.2 Reading the result"]
N4["27.3 Follow-up"]
N5["27.4 Final state"]
N6["Why verify"]
N7["Reporting"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX079"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["27.1 Verification"]
N2["Lab — encryption verification"]
N3["27.2 Reading the result"]
N4["27.3 Follow-up"]
N5["27.4 Final state"]
N6["Why verify"]
N7["Reporting"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX079"]
[Learning outcomes]
|
v
[27.1 Verification]
|
v
[Lab — encryption verification]
|
v
[27.2 Reading the result]
|
v
[27.3 Follow-up]
|
v
[27.4 Final state]
|
v
[Why verify]
|
v
[Reporting]
|
v
[Worked example] --> [Exercise EX079]
Learning outcomes
You will (1) verify encryption after rollout; (2) handle unknown and in-progress states; (3) close gaps.
27.1 Verification
Agent reports show each laptop's encryption state.
The agent on each laptop reports one of four states: encrypted, encrypting, not encrypted or no report. Aisha keeps all four in the lab output, because counting encrypting laptops as finished or silent laptops as encrypted would overstate the result. She also spot-checks five laptops by hand, and all five match their reports. The lab output is saved with its date, so the next month's run can be compared line by line with this one.
Lab — encryption verification
"""Verify disk encryption status after rollout from synthetic agent reports (stdlib only)."""
status = {"encrypted": 40, "encrypting": 2, "not_encrypted": 1, "no_report": 2}
total = sum(status.values())
for k, v in status.items(): print(f"{k:14} {v:2d}")
print(f"verified encrypted {status['encrypted']}/{total} ({status['encrypted']/total*100:.0f}%)")
Run with python3 lab_encrypt.py. Verified output:
encrypted 40
encrypting 2
not_encrypted 1
no_report 2
verified encrypted 40/45 (89%)
27.2 Reading the result
40 of 45 verified encrypted (89%); 2 still encrypting, 1 not encrypted and 2 not reporting.
Forty of 45 is about 89%, so five laptops still need attention before the rollout can be called complete. Aisha lists the five by state rather than as one number. The two encrypting laptops need time, the unencrypted laptop needs a fix, and the two silent laptops need to be found before their state is known. Aisha does not round the result up: five laptops is more than one in ten of the fleet, and each could be the next stolen laptop.
27.3 Follow-up
The two encrypting finish overnight; the unencrypted laptop had a failed TPM and is fixed; the two silent laptops are tracked down.
Each of the five is closed with a recorded action and date. The silent laptops are a reminder of the inventory lesson: a device that does not report cannot be counted as compliant. One laptop's recovery key is also found missing from the directory, so Gareth backs it up and records the fix. The two encrypting laptops are checked again the next morning, and both report encrypted.
27.4 Final state
After follow-up, 45 of 45 are verified.
The final verification run shows 45 of 45 encrypted, including the two older laptops protected by a start-up password. Aisha saves the run with its date as evidence for the evaluation. From then on the check is repeated monthly, so a new or rebuilt laptop that is not encrypted appears within a month. The monthly check also confirms each recovery key is in the directory, so a laptop encrypted outside the rollout cannot hide a missing key again.
Why verify
Turning encryption on is not the same as confirming it is on. Encryption can fail if the TPM is disabled, the disk is full or the laptop is offline during setup. Verification uses agent reports from each laptop, cross-checked by spot-checking five laptops by hand.
Aisha also verifies that each laptop's recovery key is in the directory. One laptop's key is missing because it was encrypted manually before the rollout; Gareth backs up the key and records the fix.
She repeats the verification monthly as part of the weekly routine's monthly extension.
Reporting
Bramley's manager receives a one-line monthly status: laptops verified encrypted out of total.
The five remaining
Of the 45 laptops, 40 are encrypted at first verification. The five remaining are two still encrypting, one whose TPM had failed and two that were not reporting. The two encrypting finish overnight, the failed TPM is fixed, and the two silent laptops are verified when they come back online, one after its user returns from leave. The two old laptops without a TPM are already among the encrypted 40, protected by a password until they are replaced.
Project log entry
Verification also covers removable media. Bramley's policy says files on USB sticks must be encrypted, but checking is harder than for laptops. Aisha recommends issuing encrypted sticks and blocking unknown ones through the management server, and notes this as follow-up work rather than claiming it was done.
Worked example
One silent laptop is with a staff member on leave; Gareth verifies it on return.
Synthetic case. Synthetic.
Errors and limits
Counting "encrypting" as done is premature.
Exercises
- EX079 — Lab result. What share was verified encrypted? Rubric: 3 = 40/45 (89%); 2 = partial; 1 = vague; 0 = none.
- EX080 — Other states. Give the other states. Rubric: 3 = 2 encrypting, 1 not, 2 no report; 2 = two; 1 = one; 0 = none.
- EX081 — Final. What was the final verified count? Rubric: 3 = 45/45; 2 = partial; 1 = vague; 0 = none.
Synthesis
Verify every device and resolve each exception.
Continue studying — chapter 27 of 40
← Chapter 26 (draft) · Course chapter index · Chapter 28 (draft) →