Chapter 16 — Disk encryption
Lesson map
Lesson 16 published. Map, example, EX046.
flowchart TD
N0["Learning outcomes"]
N1["16.1 What it protects"]
N2["16.2 Turning it on centrally"]
N3["16.3 Verifying"]
N4["16.4 Recovery keys"]
N5["16.5 Servers"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
N6 --> EX["Worked example"]
EX --> Q["Exercise EX046"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["16.1 What it protects"]
N2["16.2 Turning it on centrally"]
N3["16.3 Verifying"]
N4["16.4 Recovery keys"]
N5["16.5 Servers"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX046"]
[Learning outcomes]
|
v
[16.1 What it protects]
|
v
[16.2 Turning it on centrally]
|
v
[16.3 Verifying]
|
v
[16.4 Recovery keys]
|
v
[16.5 Servers]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX046]
Learning outcomes
You will (1) explain full-disk encryption; (2) verify status across laptops; (3) manage recovery keys.
16.1 What it protects
Full-disk encryption protects data when a device is lost or stolen while switched off. Teachers take laptops home with marking, reports and sometimes pupil details, so a stolen laptop without encryption could expose children's data. With BitLocker and a TPM, the disk is unreadable without the startup check passing or a recovery key being entered.
It does not protect a laptop stolen while switched on and signed in, nor data already synced to the cloud, which is why the screen lock and encryption work together. For the trust, the practical value is that a laptop left on a train becomes a lost device rather than a reportable breach of pupil data.
16.2 Turning it on centrally
Dev enables BitLocker through the management service with keys automatically saved to the directory. Laptops encrypt in the background while staff keep working. Older laptops without an enabled TPM need either a firmware setting change or a start-up password, so Tomás uses the hardware fields from chapter 2 to find them before rollout.
Saving keys to the directory before encryption starts is the important order: a laptop encrypted without its key stored anywhere becomes unrecoverable after the first motherboard repair. Background encryption means teachers do not lose lesson time, though a laptop closed all evening simply pauses and continues the next day.
16.3 Verifying
Turning encryption on is not proof that it is on. Tomás exports the encryption state of every laptop and finds 87 of 94 fully encrypted, four still encrypting, two with protection suspended after firmware updates and one never started because its TPM is disabled. Each case gets an action, and the export is repeated weekly until every laptop shows fully encrypted and protection on.
The four still encrypting are laptops that were rarely switched on, while the two suspended ones show a known effect of firmware updates that should resume after a restart. The one with a disabled TPM needs the firmware change from the hardware check, made with its teacher's agreement.
16.4 Recovery keys
If a laptop's startup changes, for example after a motherboard repair, it asks for the recovery key. Keys stored in the directory let Dev help the teacher quickly. Access to keys is limited to Dev and the outside company's lead engineer, and each retrieval is logged. Tomás tests one retrieval on a spare laptop to confirm the process works.
The test on the spare laptop matters because a key that exists in the directory but cannot be found quickly is little help to a teacher before a lesson. Tomás times the retrieval and writes the steps into the routine documents.
16.5 Servers
Linux servers in the locked server room use encrypted volumes for backups taken off site. Servers themselves are physically protected, so the trust decides encryption at rest on them is lower priority than on laptops.
The decision is recorded with its reason, the locked room and the limited number of people with keys to it, so it can be revisited if a server ever moves somewhere less protected. Backup volumes taken off site are different because they leave the locked room, and so they are encrypted before they go.
Worked example
After fixes, the weekly export shows 94 of 94 laptops fully encrypted with protection on, and the result is filed as evidence for the trust's data protection records.
Synthetic case. Figures are synthetic.
Errors and limits
Suspended protection after firmware updates is easy to miss; always check protection status as well as encryption percentage.
Exercises
- EX046 — Theft scenario. A teacher's laptop is stolen from a car. What does full-disk encryption protect, and what does it not? Rubric: 3 = protects data at rest when off; not if unlocked or account compromised;; 2 = protects data;; 1 = vague;; 0 = none.
- EX047 — Verification states. Name the four encryption states found and the action for each. Rubric: 3 = all four with actions;; 2 = three;; 1 = fewer;; 0 = none.
- EX048 — Key access control. Who should be able to read recovery keys, and why log retrieval? Rubric: 3 = few named people, logging for accountability;; 2 = IT;; 1 = anyone;; 0 = none.
Synthesis
Encryption is effective only when it is on, verified and recoverable.
Continue studying — chapter 16 of 30
← Chapter 15 (draft) · Course chapter index · Chapter 17 (draft) →