Chapter 9 — Disk encryption with BitLocker | Technical Systems, endpoints and hardware security

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 9 — Disk encryption with BitLocker

Lesson map

Lesson 09 published. Map, example, EX033.

flowchart TD
  N0["Learning outcomes"]
  N1["9.1 Purpose"]
  N2["9.2 Enabling"]
  N3["9.3 Verifying"]
  N4["9.4 Recovery keys"]
  N5["Desktops too"]
  N6["Encryption checks over the PC's life"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX033"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["9.1 Purpose"]
  N2["9.2 Enabling"]
  N3["9.3 Verifying"]
  N4["9.4 Recovery keys"]
  N5["Desktops too"]
  N6["Encryption checks over the PC's life"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX033"]

[Learning outcomes]
    |
    v
[9.1 Purpose]
    |
    v
[9.2 Enabling]
    |
    v
[9.3 Verifying]
    |
    v
[9.4 Recovery keys]
    |
    v
[Desktops too]
    |
    v
[Encryption checks over the PC's life]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX033]

Learning outcomes

You will (1) enable BitLocker; (2) store recovery keys; (3) verify encryption.

9.1 Purpose

Accountants carry laptops to clients. If one is stolen, BitLocker makes the drive unreadable without the key. Client financial data are confidential, so encryption is essential. A stolen laptop without encryption would expose client records, and the firm may have to tell clients and the regulator. With BitLocker and a protected key, the data cannot be read, which greatly reduces the harm. Nadia checks that every laptop leaving the office is encrypted. Lena tells the partners before rollout that their laptops will restart once during encryption, so nobody is caught out before a client visit.

9.2 Enabling

The supplier enables BitLocker with TPM protection through the management tool, storing recovery keys in the directory. The PC with a disabled TPM from chapter 2 has it enabled first. Using the management tool means every PC is encrypted in the same way, with keys stored centrally rather than on paper. Enabling the TPM first was necessary because BitLocker uses it to protect the key. Nadia checks the oldest PC after the change to confirm it encrypted successfully. Lena is told when encryption finishes on each laptop, so she knows which ones are safe to take to clients.

9.3 Verifying

Nadia checks encryption status in the console and with the manage-bde status command on two PCs. All laptops show fully encrypted with protection on. Checking two PCs directly confirms the console report. A drive can show as encrypted while protection is suspended, for example after a firmware update, so Nadia looks for protection on as well as encryption. She records the results with the date in her notes, and repeats the check after the next round of firmware updates. Both direct checks matched the console, so Nadia records the console report as reliable for the monthly figure.

9.4 Recovery keys

If BitLocker asks for a recovery key, the user calls IT, who verifies identity before reading out the key. Retrieval is logged. Verifying identity before reading out the key stops someone posing as a staff member from unlocking a stolen laptop. Nadia uses the same callback method as for password resets. Each retrieval is logged with the user, date and reason, and the supplier reviews the log monthly. Recovery keys are only readable by the supplier and Nadia. Staff are told about the callback step in advance, so a request to confirm identity is expected rather than taken as distrust.

Desktops too

Office desktops are encrypted as well. A break-in could take desktops as easily as laptops, and encryption costs nothing extra on PCs with a TPM. The supplier enables BitLocker on all thirty PCs, not just laptops, in a second wave a week after the laptops.

Nadia also checks USB sticks used to carry client files to meetings. The firm buys encrypted sticks and asks staff to stop using personal ones.

Desktops are verified the same way as laptops, with the encryption status and date recorded in the inventory for each machine.

Encryption checks over the PC's life

Encryption needs checking at several points, not just once. When a PC goes for repair, BitLocker may be suspended for a firmware update; the supplier resumes protection afterwards and Nadia checks the status the same day. Every new PC's encryption is checked on its first day, before it receives client data, and noted on the joiner checklist. Lena receives a monthly line in the IT report giving the number of PCs encrypted out of thirty. These three checks cover the moments when encryption most often goes wrong: after maintenance, at setup and through slow drift, and together they give the partners steady evidence.

Worked example

A laptop asks for its recovery key after a firmware update; Nadia verifies the user by callback and reads the key from the directory.

Synthetic case. Events are synthetic.

Errors and limits

Keys stored on a sticky note in the laptop bag defeat encryption.

Exercises

EX033 — Why laptops first. Why prioritise laptops for encryption? Rubric: 3 = leave office, theft risk;; 2 = travel;; 1 = vague;; 0 = none.
EX034 — Status command. Which command shows BitLocker status? Rubric: 3 = manage-bde -status;; 2 = manage-bde;; 1 = vague;; 0 = none.
EX035 — Key request. How should a recovery key request be handled? Rubric: 3 = verify identity, read key, log;; 2 = verify;; 1 = vague;; 0 = none.
EX036 — Bad storage. Why is a written key in the laptop bag a problem? Rubric: 3 = thief gets both;; 2 = insecure;; 1 = vague;; 0 = none.

Synthesis

Encryption with protected recovery keys keeps client data safe if devices are lost.

Continue studying — chapter 09 of 18

← Chapter 08 (draft) · Course chapter index · Chapter 10 (draft) →