## Chapter 9 — A screen lock is not volume encryption ### Lesson map Lesson 09. Map, example, EX055. ```mermaid flowchart TD V["Volume locked or off"] --> E["Encryption is the control named for that state"] S["Interactive session unlocked"] --> L["Screen lock is the control named for that state"] E --> X["FB05 can pass encryption and fail the lock"] L --> X ``` Two states of the same laptop. Two different bits. ### Logical drawing ```text screen-lock column only FB05 is 0 FB05 encryption cell is 1 later checklist five minutes of inactivity that number is not stored in the matrix ``` ### Learning outcomes After this chapter, you should be able to: 1. Match each control to the machine state chapter 3 already distinguishes. 2. Read `FB05` as a row that passes encryption and fails the lock. 3. Refuse to treat the lock, or the five-minute choice, as a hardware patch. ### 9.1 Session lock and volume lock answer different states. Chapter 3 draws the boundary carefully. Disk encryption protects a laptop that is switched off, or that is sitting at the sign-in screen after a restart. A laptop stolen while unlocked and in use is outside that protection. The screen lock is why the quick check has a separate bit. NIST SP 800-53 Rev. 5 names device lock as AC-11, a control on an interactive session. SC-28 names protection of information at rest. The catalog's split matches the case. This book still does not record an assessment that scores either control. The matrix makes the split observable on one row. `FB05` is `[1, 1, 1, 0, 1]`. Encryption, the second cell, is `1`. The screen lock, the fourth cell, is `0`. It is the only `0` in that column, which is why the print says `screen lock 11/12`. A sentence that calls `FB05` "encrypted, therefore locked" has contradicted the row. The bit also does not store a timeout. Chapter 2 later applies a screen lock after five minutes of inactivity, by hand, from a printed checklist. Five minutes is that checklist's choice. It is not a value in `lab_quickcheck.py`, and it is not a measured observation of how long `FB05` previously waited. A session lock does not patch the processor or the memory. Kim and colleagues reported that repeated activation of one memory row can disturb bits in a neighbouring row. Kocher and colleagues described Spectre, a class of speculative-execution issue. The defender's relevant action for those classes is the vendor's update, which is the maintenance predicate in chapter 7, not a lock on the console. Fenwick recorded no memory fault and no speculative-execution finding. This chapter names the classes so they are not mistaken for a reason to rewrite the lock bit, and it does not describe how either issue is produced. Secure Boot, a signature check on early boot components, is a third mechanism. The file does not say whether Secure Boot is on or off for any laptop. ### 9.2 Worked example | Reading of FB05 | Fits the row? | Decision | |---|---|---| | "Encryption cell 1, lock cell 0." | Yes | May stay | | "The only lock failure in the print." | Yes, the column has one zero | May stay | | "Five minutes is what the script stored." | The script stored 0 or 1 | Refuse | | "The lock closes a speculative-execution issue." | No finding, and a lock is not that patch | Refuse | > **Synthetic case.** No memory address, timing sample, or boot-policy setting is added. ### Errors and limits AC-11 and SC-28 are catalog names. They are not scores on this page. ### Apply - **EX055 — Which state?** FB05 shows encryption on and screen lock off. A classmate sets the lock cell to 1 because five minutes was later chosen, and says the lock also settles Spectre. What do you keep? *Rubric:* 3 = FB05 stays encryption 1 and lock 0; the column stays 11 of 12; five minutes stays a checklist choice outside the script; no speculative-execution finding and no Secure Boot state are added;; 2 = the two bits stay different;; 1 = one bit;; 0 = none. ### Continue studying — lesson 09 (chapter 09 of 20) [← Chapter 08](#ch-08) · [Course chapter index](../SUBJECTS.md) · [Chapter 10 →](#ch-10) Continue to the next authored lesson. ## Worked answers **EX055.** FB05 stays encryption 1 and lock 0. The column stays 11 of 12. Five minutes stays outside the script. No speculative-execution finding and no Secure Boot state are added.