Software HDD Encryption: Poll

@g.jacobse said:

I'm looking at the three main players for Software HDD Encrypting: Symantec, McAfee and Sophos

I'd avoid the first two here.

Whats the main goal? What are you encrypting. Are you wanting just some files or the whole drive?

MattSpeller

I've had good luck with Bitlocker but it will slow you down (same with most any whole drive encryption). Best to have a good SSD or IIRC there are FIPS compliant HDD's that handle it internally???? Might be wrong on the last bit. Get a SSD anyway.

scottalanmiller

Yes, you can get drives that do this themselves without needing the software layer to handle it.

gjacobse

@thecreativeone91 said:

Bitlocker is in windows 7/8 Enterprise.

We do not have Win 7 Enterprise.

@thecreativeone91 said:

@g.jacobse said:

I'm looking at the three main players for Software HDD Encrypting: Symantec, McAfee and Sophos

I'd avoid the first two here.

Whats the main goal? What are you encrypting. Are you wanting just some files or the whole drive?

My goal is to avoid them if possible.

@scottalanmiller said:

Yes, you can get drives that do this themselves without needing the software layer to handle it.

Is it practical to order 65 hard drives, with many of the computers are older models? I have about twenty that I have ordered in the last 15 months.

@scottalanmiller said:

Yes, you can get drives that do this themselves without needing the software layer to handle it.

You can even get Dell to load your CTO systems with them.

gjacobse

As for Encrypted HDDs I'm not sure I want to go this route as it would mean managing (x) number of devices from the device. I would rather have a central management console so that I can update the password if needed on any given device should the system become compromised. I have enough to do,.. I don't want to keep single managing devices if I don't have to.

@g.jacobse said:

As for Encrypted HDDs I'm not sure I want to go this route as it would mean managing (x) number of devices from the device. I would rather have a central management console so that I can update the password if needed on any given device should the system become compromised. I have enough to do,.. I don't want to keep single managing devices if I don't have to.

What's to manage with FDE Harddrives? The harddrive always encrypt - It's not possible to disable. You can change the encryption key in the bios but then you'd loose access to all data.

scottalanmiller

Nothing would be easier to manage than encrypted drives.

@g.jacobse said:

so that I can update the password if needed on any given device should the system become compromised. I have enough to do,.. I don't want to keep single managing devices if I don't have to.

What do you mean by Compromised? if if something gets on the system while it's running (virus etc) it will not see the encryption key. In fact it won't even know the drive is encrypted as the when logged in the files are un-encrypted.

scottalanmiller

Drive encryption is only to protect against hardware theft - of someone pulling drives and running away with them. It has zero protection against compromise.

gjacobse

@scottalanmiller
So - Hard drives would be simpler than using a managed console? Where you are able to manage all (x) devices from a central location? Like updating the Admin / User passwords?

scottalanmiller

@g.jacobse said:

@scottalanmiller
So - Hard drives would be simpler than using a managed console? Where you are able to manage all (x) devices from a central location? Like updating the Admin / User passwords?

Under what circumstance would you ever manage them or change anything?

gjacobse

There are a few times;
HDD password compromised by user (shared with someone that doesn't need it)
Defined password / security Policy dictates (not set currently)
IT staff departure

scottalanmiller

@g.jacobse said:

There are a few times;
HDD password compromised by user (shared with someone that doesn't need it)
Defined password / security Policy dictates (not set currently)
IT staff departure

Why would a user get an HDD encryption password?

scottalanmiller

@g.jacobse said:

IT staff departure

Why would IT have it? There is no need for that. Use a break glass so that this doesn't happen.

MattSpeller

Are you looking to have a PW on boot?

scottalanmiller

@g.jacobse said:

Defined password / security Policy dictates (not set currently)

This should be a key so not covered by a password policy.

gjacobse

@MattSpeller said:

Are you looking to have a PW on boot?

Yes - Required password on boot. We must adhere to FIPs 140-2 for HIPPA and other compliance items.

MattSpeller

@g.jacobse Ahhh ok now we're talking the same language.

I'd opt for a BIOS pw - you can set them up with Dells, not sure what you're running. They can also be setup to completely wipe the drive after (10?) failed attempts.

MattSpeller

HDD encryption is separate from the pw - thats where we were all confused.