OpenCyber Academy
Postgraduate · Chapter 7 · English
Course code: OCA-150Chapter 07: OCA-150-C007

Chapter 7 — Encryption and device loss

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 07 published. Map, example, EX031.

flowchart TD
  N0["Learning outcomes"]
  N1["7.1 Why it matters"]
  N2["7.2 Verification"]
  N3["7.3 Recovery keys"]
  N4["7.4 Responding to theft"]
  N5["Removable media"]
  N6["Testing the loss procedure"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX031"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["7.1 Why it matters"]
  N2["7.2 Verification"]
  N3["7.3 Recovery keys"]
  N4["7.4 Responding to theft"]
  N5["Removable media"]
  N6["Testing the loss procedure"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX031"]

[Learning outcomes]
    |
    v
[7.1 Why it matters]
    |
    v
[7.2 Verification]
    |
    v
[7.3 Recovery keys]
    |
    v
[7.4 Responding to theft]
    |
    v
[Removable media]
    |
    v
[Testing the loss procedure]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX031]

Learning outcomes

You will (1) verify disk encryption; (2) manage recovery keys; (3) plan for theft.

7.1 Why it matters

Laptops used by the dental nurse manager and clinicians at home carry patient data. Full-disk encryption with BitLocker protects data if a device is stolen, provided recovery keys are protected and encryption is verified. Encryption is only useful if it is actually on, if keys are available when a legitimate user is locked out, and if keys cannot be used by a thief. Priya's plan covers all three: verifying encryption on each laptop, escrowing recovery keys, and limiting who can retrieve them. Kestrel's nine laptops are listed in the inventory with their users, so each one can be checked.

7.2 Verification

Priya compares console reports with a sample of devices checked by hand. Three laptops show encryption suspended after a firmware update; the supplier resumes protection and adds a weekly check. A console report shows what the management tool believes, not necessarily the state of the device. The hand checks found what the console missed, because suspended protection still looked like encryption to it. The weekly check now flags suspended protection directly, and Priya repeats a small hand sample each quarter to confirm that the console and the devices still agree.

7.3 Recovery keys

Keys are escrowed to the directory, and access to them is limited and logged. A key retrieval test is run for one laptop. Escrow means a locked-out clinician can be helped without losing data, while limited and logged access means a recovery key cannot be retrieved quietly. Only named supplier staff can retrieve keys, and each retrieval is recorded with the reason and the person who asked. The test confirms that the escrow actually works for a real laptop, rather than trusting the configuration. Priya records the test date and result in the encryption register, and repeats it each year.

7.4 Responding to theft

The loss procedure confirms encryption status, disables the account's sessions and records the event for data protection review. Confirming encryption status matters most for a data protection decision: a stolen laptop that is verified encrypted with a protected key is a much smaller risk to patients than one that is not. The procedure also asks when and where the device was lost, which data the user worked with, and whether any recovery key was retrieved afterwards. The record goes to Kestrel's data protection lead, who decides on any notification. The supplier also removes the laptop from management.

Removable media

Clinics sometimes export images on USB sticks for referrals to specialists. Unencrypted sticks undo laptop encryption. Priya recommends issuing encrypted sticks for referrals and, longer term, moving referrals to a secure transfer service offered by the regional health network. Until that is in place, staff are asked to record each export in a simple log so that a lost stick can be traced to its patients.

She also checks that desktops in surgeries, which never leave the building, are encrypted too. A stolen surgery desktop during a break-in would expose the same data as a stolen laptop, so the same policy applies.

Testing the loss procedure

A written procedure is only a hypothesis until someone follows it. Priya runs a tabletop exercise with the operations manager: a clinician reports at 19:00 that a laptop was stolen from a car. They walk through each step with a timer, from confirming encryption in the console to revoking sessions and recording the event. Most steps work, but the exercise shows that nobody knew who should notify the data protection officer out of hours, or how quickly. A named contact and phone number are added, and the procedure is updated with the date. A second exercise six months later confirms the gap is closed and finds no new ones.

Worked example

All 9 laptops are verified encrypted after the three suspended cases are fixed.

Synthetic case. Figures are synthetic.

Errors and limits

Suspended encryption looks fine in some reports; always check protection status, not only whether encryption was ever enabled.

Exercises

Synthesis

Encryption only helps when it is on, verified and recoverable.

Continue studying — chapter 07 of 12

← Chapter 06 (draft) · Course chapter index · Chapter 08 (draft) →

Worked answers

EX031. Firmware updates can suspend protection, leaving data unprotected until resumed.

EX032. A small group of IT staff, with each retrieval logged.

EX033. Confirm encryption, revoke sessions, record for data protection review.

EX034. It confirms the console's reports match reality.

EX035. Yes where the vendor supports it, after confirming compatibility, since images are sensitive.