◇ OpenCyber Academy
Rapid course · Chapter 3 · English

Chapter 3 — Week 3: Encryption and backups

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 3 — Week 3: Encryption and backups

Lesson map

Lesson 03 published. Map, example, EX027.

flowchart TD
  N0["Learning outcomes"]
  N1["3.1 Why encryption"]
  N2["3.2 Turning it on"]
  N3["3.3 Checking it worked"]
  N4["3.4 Backups"]
  N5["3.5 Testing a restore"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
  N6 --> EX["Worked example"]
  EX --> Q["Exercise EX027"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["3.1 Why encryption"]
  N2["3.2 Turning it on"]
  N3["3.3 Checking it worked"]
  N4["3.4 Backups"]
  N5["3.5 Testing a restore"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX027"]

[Learning outcomes]
    |
    v
[3.1 Why encryption]
    |
    v
[3.2 Turning it on]
    |
    v
[3.3 Checking it worked]
    |
    v
[3.4 Backups]
    |
    v
[3.5 Testing a restore]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX027]

Learning outcomes

You will (1) turn on and verify disk encryption; (2) store recovery keys safely; (3) check and test backups.

3.1 Why encryption

If a laptop is stolen while switched off, disk encryption makes its contents unreadable. Had the stolen laptop been encrypted, the food bank could have said with confidence that client data were safe. Windows BitLocker or device encryption uses the laptop's TPM chip so users do not need an extra password at startup.

The limit matters: encryption protects a laptop that is off or at its sign-in screen after a restart. A laptop stolen while unlocked and in use is protected only by the screen lock, which is why both checks are in the quick check.

3.2 Turning it on

Four laptops are not encrypted. Leah checks that each has a TPM enabled, turns on BitLocker and saves the recovery key to the food bank's cloud account and a printed copy in the office safe. One older laptop has its TPM switched off in its firmware settings; with the volunteer's agreement, Leah enables it first.

The recovery key matters because a firmware update or hardware change can make BitLocker ask for it at startup. Without the key, the volunteer's files would be locked away from the food bank too. Keeping one copy in the cloud account and a printed one in the safe means it is available even when the cloud service cannot be reached. By Thursday, all twelve laptops are encrypted.

3.3 Checking it worked

Leah confirms each laptop shows encryption on and protection active, rather than assuming. She notes the date in the spreadsheet.

Starting encryption is not the same as finishing it: a laptop can show encryption "in progress" for hours, or have it suspended after an update. Leah checks each of the four laptops she changed and the eight that were already encrypted, because the original problem was a laptop nobody had checked. The spreadsheet row for each device now records encryption status with the date it was confirmed, and the monthly routine repeats that check. If a laptop is stolen next year, the answer to "was it encrypted?" is a dated line, not a guess.

3.4 Backups

Files are stored in the cloud file service, which keeps previous versions for thirty days. Three laptops still keep documents only on the desktop. Leah moves those folders into the cloud service so they are backed up, and shows volunteers where to save.

The three were FB03, FB07 and FB10, which failed the backup check in the lab. Desktop-only files are the ones lost with a stolen laptop, encrypted or not: encryption keeps them away from the thief but does not give them back to the food bank. With the folders moved, a stolen laptop would cost the device and nothing else.

3.5 Testing a restore

Leah deletes a test file and restores it from the cloud service's recycle bin, then restores an older version of a document. Both work. CIS Controls v8 Control 11 includes testing that data can be recovered, because backups that have never been restored may fail when needed.

The thirty-day version history sets a limit: a file damaged and not noticed for six weeks could not be recovered this way. Leah records that limit for the trustees rather than claiming backups cover everything. She chose a test file and an old document version because these are the two situations volunteers actually face: a deleted file and an overwritten one.

Worked example

By Thursday, all twelve laptops are encrypted and verified, all documents live in the cloud service, and two restore tests have succeeded.

Synthetic case. Figures are synthetic.

Errors and limits

A recovery key saved only on the laptop itself is useless if the laptop is locked; keep it elsewhere.

Exercises

Synthesis

After week three, a stolen laptop would no longer expose client data, and files can be recovered.

Continue studying — chapter 03 of 04

← Chapter 02 (draft) · Course chapter index · Chapter 04 (draft) →