Full disk encryption is routinely touted as an effective way of protecting data if a computer is lost or stolen. But, there are also those who say that encryption is useless and won’t touch it with a ten foot-long pole. How can this be?
Full Disk Encryption (FDE) Is Not What You Think It Is
Before we describe how FDE can help you secure your data, it should be pointed out that FDE may not be what you think it is. Most people know that encryption means scrambling information so it cannot be made heads-or-tails of until the data is unscrambled back into legible text.
Full disk encryption uses encryption to protect the data on your computers. However, it should be noted that FDE, as reflected in the name, encrypts your hard drive, not your data.
This is somewhat of a tricky concept, but can be easily illustrated via the following method. You’ve got three computers, A, C, and E. Of the three, only E uses full disk encryption to protect the contents of the hard drive (“E” as in encrypted). Computers A and B do not have encryption.
Now, let’s say you have an unencrypted plaintext file on computer A. You copy it over to computer E. This file is now protected via FDE. Then, you copy the file from E to computer C. Is the file on computer C encrypted?
The answer is no. Like I stated above, full disk encryption encrypts your hard drive. When the plain text file was copied over to the encrypted computer, the file is in an encrypted state because the hard drive is encrypted. But, the moment that file leaves the confines of the encrypted disk, as it did when the file was copied over from computer E to computer C, it is no longer encrypted.
The file left behind on computer E is, of course, still encrypted, and will remain so (unless the hard drive itself is decrypted).
The Power of Full Disk Encryption (FDE)
I won’t go into the details of it, but encryption–real, strong encryption–is powerful stuff. It is routinely touted that breaking modern encryption within one’s lifetime is impossible, even with the aid of all the computers currently found on this planet. This is the reason why the military and government services use encryption to secure their messages and communications.
However, breaking encryption is possible (and it’s more than a theoretical concept): one has to either figure out the encryption key or the username/password (which I’ll just refer to as “passwords” from here on).
Obviously, passwords are required to access encrypted information. If an unauthorized person manages to get a hold of such passwords, encryption is “broken” in the sense that encryption is not preventing a data breach. The same is true if someone is able to randomly guess the passwords successfully. And, if it cannot be guessed, a brute force attack–where all possible combinations are tried, one by one–could be carried out to figure out the password.
In order to prevent this, endpoint security systems like AlertBoot encryption software have settings to restrict how many times the wrong passwords can be entered before the system won’t accept passwords anymore. Let’s say the limit is 10 failed attempts. On the eleventh try, even if the correct password is entered, AlertBoot won’t let the user in. (There are ways to get around this in AlertBoot by calling the 24/7 hour support number. Other encryption services may vary on how they approach this.)
Such restrictions greatly minimize the occurrence of a data breach. When it comes to guessing the encryption key, however, the same restriction cannot be used (it’s like attempting to fully protect the security guard: if we stick a security guard on the security guard, who protects the second security guard?)
Because such restrictions cannot be applied to encryption keys, these are made to be long and complicated. For example, AES-256 is an encryption algorithm with a key length currently accepted as being “strong and safe.” A brute force attack would require 2256 tries to run through all combinations. In more familiar terms, that number would translate to 1.15 x 1077.Keep in mind that the number of atoms in the universe is thought to be 1 x 1080. No wonder the chances of correctly guessing an encryption key is impossible during one’s lifetime. You’ve got better odds of hitting the Powerball three times in a row.
Full Disk Encryption (FDE) And Its Detractors
So, if encryption is so good at protecting stuff, why the detractors? Well, people give many reasons why they think encryption doesn’t provide data security, but these are some of the reasons:
Bad/Weak encryption algorithms exist: Encryption is big business, and people are always on the look to create a better/stronger way to encrypt data. But, it turns out that creating a strong encryption algorithm is extremely difficult (which explains why most of the encryption algorithms out there that are in use are pretty old).
Many companies will announce a new method of encrypting information, but sooner or later, most of these algorithms are found not to work.
Badly Designed Implementation Environment: Even if the encryption is strong and reliable, the implementation of it in software may not be. For example, there may be coding errors that could allow one to bypass the security in place.
User Error: There are many types of encryption software out there. Centrally managed encryption provides an administrator with a command-and-control center to manage an enterprise’s computers’ encryption, preventing the actual computer users from messing around with the settings. However, plenty of encryption systems don’t have this feature, meaning that the enduser can actually turn off encryption.
Or, users who cannot be bothered to remember their own passwords will stick or tape the password on the computer itself. Obviously, such practices make the presence of encryption superfluous, like a gun without bullets.
It should be pointed out, though, that there are encryption packages that overcome most of these so-called problems. Regarding the first two issues, for example, utilize encryption software that has been vetted out by the security community.
There’s technically nothing one can do for the last case, where the users hamstring the security provided by encryption.
But not using encryption for that one reason precludes all those instances where a data breach could have been prevented because people did use encryption. Encryption won’t give you 100% protection; but, if won’t give you 0% protection either, which is what you get without it.
Benefits of Full Disk Encryption (FDE) vs. File Encryption
One of the glaring holes of FDE is that–as described earlier–files are not actually encrypted. That means that, even with FDE in place, one could have a data breach quite easily, such as by copying sensitive files off the computer (e.g., to a USB flash drive).
If a particular file or files must be protected, regardless of where they’re stored (computers, USB disks, sent as e-mail attachments, etc.), then full disk encryption must be used instead (or in combination with) file level encryption.
However, there are quite a number of benefits to using FDE:
Everything is protected, including the swap space and all temporary files. While not “real” files, they will contain sensitive data, depending on the nature of your work.
Endusers do not decide which files are to be encrypted. People may forget to encrypt files, or not do it at all.
Immediate data destruction. Deleting the encryption key ensures that the only way to access the data is by guessing it, which I’ve already described how hard it is.
Related Articles and Sites: