Computer/data security for home users
Monday, May 28th, 2007I think about security a lot. I backup my data on removable drives, and those drives are not only stored in a safe, but are fully encrypted. Even the file system structure is encrypted, meaning that if you connect the removable drive via USB, Windows(R) thinks the device is unformatted. I use TrueCrypt to “mount” the device; a new drive letter is mounted and I can access the files/folders on the drive as I normally would. However, if a thief stole the device, that person would 1) not even know anything was on the device, since it would appear as unformatted, and 2) would have a helluva time getting anything useful from it.
On my desktop, I make liberal use of EFS (encrypting file system). EFS is similar to TrueCrypt in that it provides transparent, on-the-fly encryption, but differs in that it is file-system based (metadata is not encrypted, but file contents are). EFS is functionally different in other ways too, but logically accomplishes the purpose of securing data-at-rest in the event that the storage device is physically removed/stolen.
I take a lot of other steps to ensure the security of my data. But this blog entry concerns data at rest. Data is at rest when a laptop is stolen. Data is at rest when a company loses its backup tapes. The computer is not on and the storage device is not plugged in. But when it is, is the data safe? If files are encrypted, is it a certainty that file fragments don’t exist in unencrypted form on the file system somewhere? What about the pagefile? Does it contain plaintext fragments of important, confidential information?
Vista Business (and higher) include the ability to use EFS to encrypt the pagefile, in addition to non-system files in the file system. The Enterprise and Ultimate editions of Vista include a s/w or h/w-based FDE (full disk encryption) implementation (h/w-based when using the TPM, s/w-based otherwise). That can secure the contents of the entire drive (volume), potentially mitigating the “file fragments” concern.
Home users may not be as concerned as government & businesses are (or should be) about security, but for those of us who don’t want our personal and financial docs leaked on IRC, full disk encryption and other easy-to-use solutions may be just what the doctor ordered.