Solved supporting an office of computers with full drive encryption
-
@Mike-Davis said in supporting an office of computers with full drive encryption:
@black3dynamite said in supporting an office of computers with full drive encryption:
That's just user profile data. Are you talking about redirecting the user profile?
No , the question is two fold. First, can you install internet explorer to a secure volume so it can't launch unless they unlock their secured drive? Second If IE can't be installed on an alternate path, if the path to their temporary files is unavailable, will Windows just dump them somewhere else?
Internet explorer is not like the other browsers. It's part of the operating system. How about not using Internet explorer and stick with Firefox. I believe Opera and Vivaldi allows USB like installation.
-
@black3dynamite said in supporting an office of computers with full drive encryption:
@Mike-Davis said in supporting an office of computers with full drive encryption:
@black3dynamite said in supporting an office of computers with full drive encryption:
That's just user profile data. Are you talking about redirecting the user profile?
No , the question is two fold. First, can you install internet explorer to a secure volume so it can't launch unless they unlock their secured drive? Second If IE can't be installed on an alternate path, if the path to their temporary files is unavailable, will Windows just dump them somewhere else?
Internet explorer is not like the other browsers. It's part of the operating system. How about not using Internet explorer and stick with Firefox. I believe Opera and Vivaldi allows USB like installation.
I expect that they do. And even IE is effectively phased out. But even assuming that it is absolutely required, I'm unclear why its installation location matters. Maybe I'm missing something obvious, but no matter where it is running from, does that affect anything to do with security?
-
Coming into the conversation late here.
I have a full enterprise where most, if not all, of my laptops are bitlockered before they are deployed. Security keys are stored in the TPM for boot decryption. I also hold the kyes to the encryption on an IT controlled drive.
There is also a boot up password that must be entered by the user when the boot the computer up from cold. If they are rebooted, the startup password is bypassed automatically by the bios/uefi.
-
The requirement is that temporary files from using the web based software are not left unencrypted. In the suggestion that the
drive is not encrypted so that OS patches can happen I don't think that will work. If the user can launch IE without decrypting the secure drive, it fails the requirement. -
You're asking for full drive encryption while the computer is running?
-
@Mike-Davis said in supporting an office of computers with full drive encryption:
The requirement is that temporary files from using the web based software are not left unencrypted. In the suggestion that the
drive is not encrypted so that OS patches can happen I don't think that will work. If the user can launch IE without decrypting the secure drive, it fails the requirementWhy? Does IE store local files in a shared space? That sounds very unlikely. You've tested that?
-
If the computer is stolen, they don't want confidential files left unencrypted on the drive.
-
@Mike-Davis said in supporting an office of computers with full drive encryption:
If the computer is stolen, they don't want confidential files left unencrypted on the drive.
No one has questioned that. We are questioning why you think files would be written to that part of the drive.
-
@scottalanmiller said in supporting an office of computers with full drive encryption:
You can include the program files on the D drive. It's not too hard to look at the apps that you will be using and see where they store data.
We're going back to this. My thought is that Internet Explorer is not movable and you can't force it to store temp files on an encrypted drive unless you encrypt the entire drive.
-
There is an assumption that IE, and ergo Windows, is inherently insecure and cannot be trusted. Yet you will deploy it where you don't trust it, then use encryption running on top of it in the hopes that that fixes the problem you are assigning to the system itself. This seems like a strange set of things based on an assumption that I don't believe has foundation.
-
@Mike-Davis said in supporting an office of computers with full drive encryption:
@scottalanmiller said in supporting an office of computers with full drive encryption:
You can include the program files on the D drive. It's not too hard to look at the apps that you will be using and see where they store data.
We're going back to this. My thought is that Internet Explorer is not movable and you can't force it to store temp files on an encrypted drive unless you encrypt the entire drive.
We never left this. We KNOW that IE is not moveable. And we know that it stores files on the encrypted drive. The question remains... why do YOU feel that this is incorrect? You have avoided the one question the entire time.
Why do you feel that IE would ever write to the C drive?
-
We know that in Windows XP, there was a condition where IE could write to public space instead of private space under specific failure conditions. My understanding is that this was fixed after XP and that Vista and later have no possibility of this. If you have information contrary to this, you should say so because I've asked repeatedly and you've answered other things that aren't really relevant.
-
I'm not saying that IE can't have a security vulnerability here, I'm just asking if you know something that we don't. Because I've researched this and found nothing about it. So I'm wondering where you've come up with this vulnerability that is not supposed to be there.
-
@scottalanmiller said in supporting an office of computers with full drive encryption:
Why do you feel that IE would ever write to the C drive?
Why wouldn't It? The C drive is the default for everything Windows.
-
@scottalanmiller said in supporting an office of computers with full drive encryption:
Standard method is to have all user accessible space on a different volume. Like a D drive (partition.) That way the system can fire up, get patched and be used like a normal system but the data you need to protect can only be accessed with a password (or something) to allow it to decrypt.
I assumed the entire drive had to be encrypted, but you suggested I didn't have to encrypt the entire drive.
-
@DustinB3403 said in supporting an office of computers with full drive encryption:
@scottalanmiller said in supporting an office of computers with full drive encryption:
Why do you feel that IE would ever write to the C drive?
Why wouldn't It? The C drive is the default for everything Windows.
No, it certainly is not. IE files always go to the user directory. They are user files. Same as with any normal application. The user processes don't even have permission to write to the public space.
-
@Mike-Davis said in supporting an office of computers with full drive encryption:
@scottalanmiller said in supporting an office of computers with full drive encryption:
Standard method is to have all user accessible space on a different volume. Like a D drive (partition.) That way the system can fire up, get patched and be used like a normal system but the data you need to protect can only be accessed with a password (or something) to allow it to decrypt.
I assumed the entire drive had to be encrypted, but you suggested I didn't have to encrypt the entire drive.
Correct. And you've come up with no reason yet as to why that would not be true. So given that, I would assume that it is correct... the C drive does not need to be encrypted as no user data goes there. Just encrypt the drive with the user data.
-
Just a general note about all operating systems made today and as long as I can remember... none of them would care WHERE a binary is run from, that does not affect to where it would write temporary files. IE being moveable or not is certainly not a factor in Windows. Nor would it be in Linux, BSD, Solaris, AIX, Mac OSX, etc. The location of a binary does not have that kind of influence. That's simply the space on disk that it comes from.
-
The requirement from the security policy reads:
*Any devices connected to your computer or network containing or accessing Confidential Information must use encryption software. In addition, any device that is used to login to (application name) or other web based software containing Confidential Information must use encryption software.
Encryption is necessary even if you only access (application name) or other websites. When accessing various types of data, such as viewing a PDF or accessing certain websites, a temporary file containing hidden data from the sources could be saved to your hard drive without your knowledge. Because temporary files are often saved to your computer in these scenarios, the most prudent assumption is that your hard dive WILL include some element of Confidential Information. This is the underlying reason the breach notification laws in some states require you to notify clients when an unencrypted device is stolen.*
This is why I think I need to encrypt the entire drive.
-
@scottalanmiller said in supporting an office of computers with full drive encryption:
Just a general note about all operating systems made today and as long as I can remember... none of them would care WHERE a binary is run from, that does not affect to where it would write temporary files. IE being moveable or not is certainly not a factor in Windows. Nor would it be in Linux, BSD, Solaris, AIX, Mac OSX, etc. The location of a binary does not have that kind of influence. That's simply the space on disk that it comes from.
no, but in a two drive scenario if IE was on the encrypted drive, there would be no way for the user to launch it unless they decrypted the secure drive.
