I agree with Brad. We used Securedoc and encrypted 100 percent of our laptops, and it went off without a hitch. Another division used Safeboot and had similar results.

We found it to be less troublesome and less risky to encrypt the whole drive, and we can say with 100% certainty that if a laptop is lost, the data was encrypted. That's a nice feeling, and avoids a lot of uncomfortable post-mortem questions from Sr management and Legal if one is lost.

Also, the data is not the only target - on pen tests I have stolen, trojaned, and returned a laptop, then harvested passwords and other info from it.

My 2 cents - Do the whole disk.

BlackBerry service provided by Nextel

-----Original Message-----

From: "Brad Judy" <Brad.Judy (at) colorado (dot) edu [email concealed]>

Date: Fri, 25 Aug 2006 09:24:30

To:<focus-ms (at) securityfocus (dot) com [email concealed]>

Subject: RE: Whole disk encryption

> Why? You only need to protect the data not the whole OS. It

> causes too many problems. I don't recommend creating a

> headache for yourself when you only need to protect some data.

Yes, you only need to protect data, but can you guarantee that data is

only being written to the encrypted part of the disk? If the user can

readily write to a non-encrypted space, then you've lost much of the

benefit of the encryption because if a laptop is lost/stolen you can

only say "I'm pretty sure the data was encrypted". Check with your

legal department and see how they feel about "pretty sure". :-)

Brad Judy

ITS - UCB

------------------------------------------------------------------------
---

------------------------------------------------------------------------
---

[ reply ]