A screen lock is not volume encryption

Lesson map

Lesson 09. Map, example, EX055.

flowchart TD
  V["Volume locked or off"] --> E["Encryption is the control named for that state"]
  S["Interactive session unlocked"] --> L["Screen lock is the control named for that state"]
  E --> X["FB05 can pass encryption and fail the lock"]
  L --> X

Two states of the same laptop. Two different bits.

Logical drawing

screen-lock column
    only FB05 is 0
    FB05 encryption cell is 1
later checklist
    five minutes of inactivity
    that number is not stored in the matrix

Learning outcomes

After this chapter, you should be able to:

1. Match each control to the machine state chapter 3 already distinguishes.
2. Read FB05 as a row that passes encryption and fails the lock.
3. Refuse to treat the lock, or the five-minute choice, as a hardware patch.

9.1 Session lock and volume lock answer different states.

Chapter 3 draws the boundary carefully. Disk encryption protects a laptop that is switched off, or that is sitting at the sign-in screen after a restart. A laptop stolen while unlocked and in use is outside that protection. The screen lock is why the quick check has a separate bit. NIST SP 800-53 Rev. 5 names device lock as AC-11, a control on an interactive session. SC-28 names protection of information at rest. The catalog's split matches the case. This book still does not record an assessment that scores either control.

The matrix makes the split observable on one row. FB05 is [1, 1, 1, 0, 1]. Encryption, the second cell, is 1. The screen lock, the fourth cell, is 0. It is the only 0 in that column, which is why the print says screen lock 11/12. A sentence that calls FB05 "encrypted, therefore locked" has contradicted the row. The bit also does not store a timeout. Chapter 2 later applies a screen lock after five minutes of inactivity, by hand, from a printed checklist. Five minutes is that checklist's choice. It is not a value in lab_quickcheck.py, and it is not a measured observation of how long FB05 previously waited.

A session lock does not patch the processor or the memory. Kim and colleagues reported that repeated activation of one memory row can disturb bits in a neighbouring row. Kocher and colleagues described Spectre, a class of speculative-execution issue. The defender's relevant action for those classes is the vendor's update, which is the maintenance predicate in chapter 7, not a lock on the console. Fenwick recorded no memory fault and no speculative-execution finding. This chapter names the classes so they are not mistaken for a reason to rewrite the lock bit, and it does not describe how either issue is produced. Secure Boot, a signature check on early boot components, is a third mechanism. The file does not say whether Secure Boot is on or off for any laptop.

9.2 Worked example

Lesson table; scroll horizontally to read all columns →

Synthetic case. No memory address, timing sample, or boot-policy setting is added.

Errors and limits

AC-11 and SC-28 are catalog names. They are not scores on this page.

Apply

• EX055 — Which state? FB05 shows encryption on and screen lock off. A classmate sets the lock cell to 1 because five minutes was later chosen, and says the lock also settles Spectre. What do you keep?
  Show marking criteria

  Rubric: 3 = FB05 stays encryption 1 and lock 0; the column stays 11 of 12; five minutes stays a checklist choice outside the script; no speculative-execution finding and no Secure Boot state are added;; 2 = the two bits stay different;; 1 = one bit;; 0 = none.