Beta
×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Only 27% of Organizations Use Encryption

samzenpus posted more than 4 years ago | from the here's-all-my-data dept.

Encryption 175

An anonymous reader writes "According to a Check Point survey of 224 IT and security administrators, over 40% of businesses in the last year have more remote users connecting to the corporate network from home or when traveling, compared to 2008. The clear majority (77%) of businesses have up to a quarter of their total workforce consisting of regular remote users. Yet, regardless of the growth in remote users, just 27% of respondents say their companies currently use hard disk encryption to protect sensitive data on corporate endpoints. In addition, only 9% of businesses surveyed use encryption for removable storage devices, such as USB flash drives. A more mobile workforce carrying large amounts of data on portable devices leaves confidential corporate data vulnerable to loss, theft and interception."

cancel ×

175 comments

Sorry! There are no comments related to the filter you selected.

Dont blame IT (4, Insightful)

jhoegl (638955) | more than 4 years ago | (#30761886)

We would do it if we werent undermanned, underfunded, and had competent users.

Support for things is already maxing many people out, now you want to add this?

Please.

Business As Usual (2, Insightful)

Anonymous Coward | more than 4 years ago | (#30761910)

Yeah, blame the users, that will always make up for the fact that they depend on you to take care of these things for them.

Re:Business As Usual (2, Insightful)

Anonymous Coward | more than 4 years ago | (#30762198)

Security is not a product, I can give you the best security tools, but if you are too lazy to learn how to use them and the to use them with the needed competence(and paranoia) it will not work. There is no way to transform security in a magic button which an incompetent user just clicks and gets it.

Secutrity requires effort to check the keys, keep them private, accept the extra steps to apply and check it, remember passwords , keys and credentials ecc.ecc.

90% users are plainly and loudly annoyed by common access password expire time and complexity requirements. They are simply not intellectually ready to manage encryption of fixed and removable media.

Use systems that users dont need to think about... (3, Insightful)

jonwil (467024) | more than 4 years ago | (#30762270)

There do exist packages that can handle the encryption of at least fixed disks without the user needing to do anything more than the usual login. BitLocker for one (and BitLocker can plug into Active Directory easily)

With the right software, it is possible to protect the fixed disks of all PCs in the enterprise (including laptops that may only connect to the network through a VPN or may be used in places where there is no network access at all such as airplanes) and the only thing the users have to do is to log in just like they normally do. Mobile devices like Blackberries and Windows Mobile devices also have options for encryption that IT can enable. Even email can be encrypted without the users doing anything special using modern versions of Exchange (at least from what I read with Google)

Re:Use systems that users dont need to think about (1, Troll)

Spazmania (174582) | more than 4 years ago | (#30762396)

With the right software, it is possible to protect the fixed disks of all PCs in the enterprise

Unless of course you actually want to use your computer. Then you discover how painfully slow it is. How it happily encrypts your USB drive too, rendering it useless. You take a power point presentation with you and look like a fool in front of your customers because it's encrypted and they can't display it on the projector from you thumb drive.

Seriously, the windows software-based hard disk encryption solutions right now are total POS.

Re:Use systems that users dont need to think about (1)

jonwil (467024) | more than 4 years ago | (#30762462)

Does BitLocker have the limitations you refer to?

Re:Use systems that users dont need to think about (1)

cbhacking (979169) | more than 4 years ago | (#30762982)

No, it doesn't, he's either an idiot or a troll.

BitLocker's ecnrypt/decrypt delay is almost entirely hidden in disk latency. The CPU can do encryption far faster than the disk can do I/O, so unless another program was heavily leaning on the CPU while you're accessing the disk, you won't even notice the slowdown.

BitLocker in Windows 7 or Server 2008 R2 supports encryption of removable drives, but doesn't make it mandatory and certainly doesn't do it automatically. You (IT) *can* make it mandatory using Group Policy, but even then you don't have to use the encryption - un-encrypted volumes are simply mounted read-only, so you're not going to be encrypting your client's presentation by accident just because you plug it into your computer. However, one of the coolest tricks is BitLocker To Go, where when a removable drive is encrypted, BitLocker creates a small second partition on the device that is *not* encrypted, and stores there a Windows binary capable of decrypting the drive (on versions of Windows that don't support BitLocker). Obviously you need a key, which depending on how the drive was encrypted in the first place might require that the computer be currently connected to a domain (or it might require a password, or smart card, or any of a number of other things).

In any case, accidentally encrypting a flashdrive requires such a phenomenal degree of stupidity that I'd be amazed such a person could plug a flashdrive in correctly. A lot of people don't even see it since it's only avaialble on higher-end editions of Windows, but BitLocker in Win7 is extremely user-friendly and the interface is not at all ambiguous.

Re:Use systems that users dont need to think about (1)

lukas84 (912874) | more than 4 years ago | (#30762638)

While Bitlocker certainly slows down my laptop a bit (i did benchmarks, about 10%), i can't complain about it being slow.

ThinkPad W500, 4GB RAM, Windows 7 Enterprise x64, OCZ Vertex 120GB with TRIM Firmware.

Our end users mostly have ThinkPads T500, 4GB RAM, Windows 7 Enterprise x64 with the normal 7200 RPM hard drives. They also don't complain about their laptop is slow.

For USB sticks, we do not mandate them to be encrypted. This, of course, shifts all the blame in case of data loss to the end user. Which is fine by me.

Re:Use systems that users dont need to think about (0)

Anonymous Coward | more than 4 years ago | (#30762954)

Wow, glad to see you've actually used it before making up stuff about it. We use BitLocker on all of our corporate machines (where legal - we still have a couple of countries where we can't legally turn it on yet). It doesn't actually encrypt USB drives the way you say. The Vista version can't encrypt thumb drives (although it can encrypt spinning disk removable drives - you just have to force it to as it won't do it automatically). The Windows 7 version will encrypt thumb drives if you tell it to or if your policy requires it. There is also a reader app right on the key to get access to the files from Windows XP and up. So the drive isn't useless. Now, before you say "I can't read the power point on my customer's Linux machine" - how is that Microsoft's fault? You encrypted it, you hopefully knew the software requirements of the reader.

As another said below - it isn't slow either. It's right in the ballpark for competing solutions and typically comes in at about 5% to 10% (10% is on disks spinning at 5,400 RPM on older notebooks - we spec'ed all of our notebooks with 7,200 RPM drives and you don't get a 10% hit with those).

Re:Use systems that users dont need to think about (1)

omglolbah (731566) | more than 4 years ago | (#30762504)

Bitlocker is as far as I can tell not available for windows XP which makes it unavailable to most corporate users.

With the slow speed of migration from windows xp bitlocker is hardly something available to most.

Re:Use systems that users dont need to think about (1)

cbhacking (979169) | more than 4 years ago | (#30763004)

This is true, although many businesses are upgrading to Win7 and some already upgraded to Vista, both of which support BitLocker (7 moreso than Vista). What's more, a laptop that is intended to carry sensitive data and leave the premises may well have a higher edition of Windows installed specifically to enable BitLocker, even if it also then needs a virtual XP install in order to access some horribly legacy IE6-only ActiveX corporate intranet site.

Re:Business As Usual (1)

tomtomtom (580791) | more than 4 years ago | (#30762886)

90% users are plainly and loudly annoyed by common access password expire time and complexity requirements. They are simply not intellectually ready to manage encryption of fixed and removable media.

I have complained to my corporate IT-droids about this before. My issue isn't the expiry (90 days is perfectly reasonable), it's the ridiculous policy they enforce which means that about 70% of the RANDOMLY-GENERATED passwords I try to use won't even work. They enforce: (1) At least one of each of: number, upper case, lower case, symbol; (2) No two consecutive characters a repetition; (3) No two consecutive characters may be adjacent on a QWERTY keyboard; and (4) No three or more consecutive characters are allowed to form ANY dictionary word (if you've ever played Scrabble you'll know how many ridiculous 3-letter combinations get caught by this)?).

The net effect of this (aside from the fact that it dramatically reduces the valid search space for brute-forcing) is that once people have a pattern which actually complies with the rules they then WRITE IT DOWN AND PUT IT ON A POST-IT ON THEIR MONITOR and then just increment the digits they invariably put on the end every 90 days. Net result: LESS security, AND more complaints to IT. Utterly stupid.

Re:Business As Usual (0)

Anonymous Coward | more than 4 years ago | (#30762948)

There is nothing reasonable about password expiration.

Re:Business As Usual (2, Insightful)

Sir_Lewk (967686) | more than 4 years ago | (#30762952)

I can give you the best security tools

Well according to this article, it seems the vast majority of your peers cannot even be irked to do that much. Blaming users for not knowing how to use software they were never given in the first place takes a special kind of jackass.

Also, password expire times are idiotic that probably do more to reduce password security than increase it.

Re:Dont blame IT (0, Troll)

MortenMW (968289) | more than 4 years ago | (#30761936)

+1

Time, money and people could solve it

Re:Dont blame IT (1)

physburn (1095481) | more than 4 years ago | (#30762956)

I do blame IT at least partially, a business IT center, might well see the wisdom of data encryption everywhere, but competing against this is, how easy it is to recover lost data (damaged disk, lost passwords or encyrption keys), plus the add complexity of managing the system. If it was built into windows i'm sure many more companies would us it. It is built into linux, but not exactly visable, or well known. Better support in OS would i'm sure make encryption much more commonly used.

---

Cryptography [feeddistiller.com] Feed @ Feed Distiller [feeddistiller.com]

That's what happens when using Windows. (-1, Flamebait)

Anonymous Coward | more than 4 years ago | (#30761894)

This isn't surprising. This is just what happens when using Windows, which doesn't enforce security over typical remote desktop connections. You have to resort to third-party (often very expensive!) solutions to get such basic functionality.

On the other hand, OpenSSH is pretty universal in the UNIX and Linux worlds now. Virtually nobody has used rsh for nearly 20 years. So anyone connecting remotely via X-over-SSH automatically gets at least some degree of encryption.

Organizations with remote users need to start moving away from Windows. With so many viable open source alternatives, virtually all of which handle remote users in a much more secure manner, it's time to start doing things right.

Re:That's what happens when using Windows. (1)

timmarhy (659436) | more than 4 years ago | (#30762564)

RDP supports 128bit encryption. you fail.

Re:That's what happens when using Windows. (1)

lukas84 (912874) | more than 4 years ago | (#30762656)

In fact, RDP since Windows XP/2003 can use SSL/TLS, but i believe it default to a 56bit RC5 cipher without configuration and/or group policies in effect.

SSL/TLS was made the default with WS08/Vista.

Remote Desktop (3, Interesting)

Anonymous Coward | more than 4 years ago | (#30761904)

I telecommute and all my work is stored on the server I remote into.
As I have no work stored locally there is no encryption (aside from the VPN into the server).

Re:Remote Desktop (5, Informative)

fuzzyfuzzyfungus (1223518) | more than 4 years ago | (#30762490)

I have to wonder how many of the outfits in TFA's little scare story fall into your category.

Remote access to network resources via a Citrix or other terminal server setup isn't exactly uncommon and means that no data of any interest actually end up on the user's HDD. They could still have a keylogger or screen-grabber lurking; but full disk encryption wouldn't save you from that in any case.

Frankly, unless the remote users are all on fully-managed-owned-and-issued-by-IT laptops, which are the only ones where full disk crypto is really going to be practical on any scale, a terminal server is overwhelmingly easier to set up and run. "Go to our website, click here, receive desktop" is a far simpler instruction than "Establish a VPN connection, now connect to our fileserver to access your documents, now configure your email client, now do all the other little things that would happen automagically if you were on a machine we had set up. Oh, you'll probably be asked for your credentials 10 times or so, because your machine isn't bound to our domain."

lose the keys, lose the data ... (3, Interesting)

Anonymous Coward | more than 4 years ago | (#30761918)

There are corporate docs using Office 2003 DRM where I work. I'm literally the only person in a multi-national company that can read the docs because I'm the only one who applied the hotfix for the expired certificate.

IT can't or won't do it through the domain.

Does anyone beiieve this number? (3, Insightful)

upuv (1201447) | more than 4 years ago | (#30761922)

I'm a consultant. I have honestly NEVER encountered any user at any company encrypting disk/usb/cd/dvd/email.

Exactly where does this BS stat come from again?

Re:Does anyone beiieve this number? (5, Insightful)

commport1 (1530901) | more than 4 years ago | (#30761960)

I'm with you. In the consulting space, and the MAJORITY of companies don't have anything coming close to 'sensitive corporate data' to fall into the wrong hands that would necessitate encryption. To tell you the truth, the majority couldn't give two hoots about who reads their monthly sales figures, HR reviews, etc etc. Anyone who REALLY wants to is going to read them anyway, right? The MAJORITY of companies could care less. Eg. a Club. They sell alcohol and have a couple of restaurants, etc. Exactly the same as the Club down the street. And there is NO competitive advantage for the 'club down the street' to gain by reading the competitors reporting. Not a big deal.

Re:Does anyone beiieve this number? (1)

the_xaqster (877576) | more than 4 years ago | (#30762224)

I suspect that 99% of laptops that are either lost by the owners (Left in a cab or whatever) or stolen are by people who will either want to fence it quick so don't care what is on it, or will want to keep it and see these corporate files as taking up space they could fill with pr0n.

Most thieves will not be thinking "Oh, that's the big bank execs laptop, I wonder what confidential information he has? Let's have a look shall we", but more likely "Oh, look. Shiny!"

Re:Does anyone beiieve this number? (2, Insightful)

Mr. Freeman (933986) | more than 4 years ago | (#30762332)

Sure, the usual thief doesn't give a shit about the data. What you need to worry about are the thieves that are after your laptop because of the data on it. They'll certainly care about it. I lock my door at night because I'm concerned about the small number of people that would break in with the intention of harming me, not the 99.9% of people that wouldn't do anything even if the door was wide open.

The fact that most of the laptops being stolen are falling into the hands of idiots is no excuse for failing to protect them from the real threats.

Re:Does anyone beiieve this number? (1)

SharpFang (651121) | more than 4 years ago | (#30762590)

The fact the thief doesn't go after your data doesn't mean they won't enjoy benefits from whatever they got it once they realize it's there. So even very simple encryption helps, but no encryption at all means trouble.

A laptop was stolen from a politician in Poland. It was a common thievery, nothing political. But tabloids wrote about sexual preferences and music tastes ("...500 mp3 files which we believe were of course ripped from legally owned CDs and not downloaded illegally") of that politician a week later - as soon as the thief realized what he stole, and found the right people to sell it to.

Small vs. large businesses (1)

aclarke (307017) | more than 4 years ago | (#30762310)

As someone else pointed out, as you move up in the size of business, you're more likely to encounter encryption and more stringent security policies. There are definitely many exceptions though on both ends of the spectrum.

I'm also a consultant, and personally all the user information on my laptop is encrypted. I don't want to ever have to explain to a client that my laptop was stolen with any of their sensitive data available on it.

Re:Does anyone beiieve this number? (1)

cheesewire (876598) | more than 4 years ago | (#30762802)

Yup, you can take my usb stick and read it all you want. Unless you're particularly interested in seeing what I've been working on recently, it will quickly bore you silly. The most damage loosing it would do it inconveniencing me. Whereas encrypting the thing would prevent me simply hand it to people so they can access my files.

9% encrypt their flash drives vs. x% who cypher their paper docs before leaving the building?

I'm not saying it shouldn't be done - I'd hope someone actually carrying sensitive data around would encrypt it as a precaution, just as I hope the people I just sent a paper copy of my passport to will have the diligence to not take on the train and leave it on the table.

And thats the difference (0)

Anonymous Coward | more than 4 years ago | (#30762880)

"in the consulting space"

Sorry, I didnt read anything after that.

Re:Does anyone beiieve this number? (0)

Anonymous Coward | more than 4 years ago | (#30761966)

I work in a large corporate environment (20,000+ desktops) - we implemented full disk encryption for laptops and enforced the use of encrypted USB sticks across the estate last year.

I wasn't directly involved in the projects, so product selection may have been botched, but neither solution we've chosen appears enterprise-ready. Both have come with a high support overhead.

Re:Does anyone beiieve this number? (4, Informative)

AliasMarlowe (1042386) | more than 4 years ago | (#30761982)

I'm a consultant. I have honestly NEVER encountered any user at any company encrypting disk/usb/cd/dvd/email.

Where I work (company has over 10^5 employees worldwide), whole disk encryption is standard on all laptops. It is uncommon on desktops, however, and not compulsory on removable devices. All remote access is always encrypted, and requires the correct encryption package and authorizations. A similar situation existed at the place I worked before (about 3.10^4 employees worldwide).

Due to the support and policy infrastructure needed, I suspect encryption is much commoner in large organizations than small ones. How the statistics on use of encryption (TFA says 27%) are formed is another matter.

Re:Does anyone beiieve this number? (1)

bertok (226922) | more than 4 years ago | (#30762362)

I'm a consultant. I have honestly NEVER encountered any user at any company encrypting disk/usb/cd/dvd/email.

Where I work (company has over 10^5 employees worldwide), whole disk encryption is standard on all laptops. It is uncommon on desktops, however, and not compulsory on removable devices. All remote access is always encrypted, and requires the correct encryption package and authorizations. A similar situation existed at the place I worked before (about 3.10^4 employees worldwide).

Due to the support and policy infrastructure needed, I suspect encryption is much commoner in large organizations than small ones. How the statistics on use of encryption (TFA says 27%) are formed is another matter.

I've been to about 100 organisations, and I've seen only 2 with widespread encryption, and only 1 with 100% encryption.

If you count every organisation that uses SOME encryption, maybe 27%, but even then, how many small businesses use serious security?

Re:Does anyone beiieve this number? (1)

badevlad (929181) | more than 4 years ago | (#30762366)

I have had remote work in foreign IT company. As one of standard requirements was having encrypted disk with all working materials. Except for this one case, I never encountered any user at any company encrypting anything.

Re:Does anyone beiieve this number? (1)

david.given (6740) | more than 4 years ago | (#30762768)

...about 3.10^4 employees worldwide...

<pedant> 92 employees isn't such a big number. And who's the 0.3521 of an employee? Did someone fail to get out of the way fast enough when closing the tape vault? </pedant>

Re:Does anyone beiieve this number? (1)

uuddlrlrab (1617237) | more than 4 years ago | (#30762114)

In what office jobs I've held (mostly inbound customer service), I've never encountered an encryption program deployed company-wide to make sure data stays secure. I did see a lot of company propag-, I mean, materials referencing the need for encryption and good data protection practices. In other words, a lot of hot air.

Re:Does anyone beiieve this number? (1, Interesting)

Anonymous Coward | more than 4 years ago | (#30762146)

I've worked for the Dutch ministry of foreign affairs, and at least my department not only didn't use encryption, but also no virus scanners, and yes, everyone was administrator on his computer. I've seen computers with sensitive data teeming with worms and viruses. (I was the guy who had to clean them up.) Truth is, people won't care about this until two things happen: 1) something goes spectacularly cataclysmically wrong and 2) the government fails to cover it up properly.

Re:Does anyone beiieve this number? (1)

asc99c (938635) | more than 4 years ago | (#30762174)

Agreed. I'm not in consulting myself, but I do write custom software, and regularly visit customer sites for install and commissioning of the software. I have also never once seen a company encrypting stuff like this. Just one company wouldn't let us connect our own laptops onto their network, and instead provided laptops we could collect each morning. That's about the most security conscious place I've ever encountered, and most of these are very large companies typically tens of thousands of employees.

Re:Does anyone beiieve this number? (1)

TheCarp (96830) | more than 4 years ago | (#30762932)

Have you worked in health care...recently?

I think it was only regulations that made us do it. Well, made them do it. When they came to me and asked if I installed their encryption product, I told them that I had been encrypting my drive for over 3 years on my own, and unlike most others, my job really is easier if I run linux than windows, and then I tossed the key size and encryption mode at them (figured if I made their eyes gloss over they wouldn't want to continue the discussion) and told them I would be happy to talk to whoever I have to to get proper approval to use this instead.

They gave me the check mark and moved on. Good thing too, had to send the laptop to the shop a couple of years ago, and they replaced it/kept the old one with hard drive. Had I not been encrypting, that would have been a much bigger deal.

-Steve

How much of this is really SENSITIVE? (1)

Isaac-1 (233099) | more than 4 years ago | (#30761942)

I have to wonder how much of this data that most people deal with in a work from home, telecommuter lifestyle is really that confidential. It seems to me even those with cut throat rival competitors where corporate espionage is the accept norm would find little value in much of the information they could gain by sifting through the virtual in boxes of these people. After all its not like your likely to find the super secret plans for the new product, instead you are likely to find random puzzle pieces that give no clue as to the big picture. Some email exchange about being mis-billed for janitorial supplies here, someone talking about the revising the employee lunch schedule, and then a bit of gold, a 23 page spreadsheet file projecting the cost vehicle fleet utilization.

Re:How much of this is really SENSITIVE? (1)

uuddlrlrab (1617237) | more than 4 years ago | (#30762160)

I don't think this is so much corporate espionage, as it is personal data of either customers, clients, or even the company's own employees, falling into the wrong hands. Like identity thieves or black-hat hackers sifting for credit card numbers or other usable financial information, payroll/account details that could possibly include bank account numbers, etc. How many people these days use direct deposit? And some companies that handle medical/rx must abide by HIPAA (Health Insurance Portability and Accountability Act) [wikipedia.org] , which requires certain "Personal Info" to be released only internally, or only to third parties directly involved with a given person's health care. There are companies that need this, either by law, or just as a good common sense measure, and if not for the entire organization, then at least some departments should look into it.

Encryption drawbacks (5, Informative)

WetCat (558132) | more than 4 years ago | (#30761950)

Using encryption has its drawbacks:
* you must provide a meaningful key management
* you lose speed of your machines for number crunching
* you can easily lose data in the event of hardware corruption
* access to data is a bit harder even for legitimate purposes
* many systems (for example Active Directory domain controller .vs. ipsec) doesn't work well with encryption
* skills of your systems management must be higher

Re:Encryption drawbacks (3, Insightful)

grahamlee (522375) | more than 4 years ago | (#30762026)

Taking those point by point (and staying on topic by discussing hard drive encryption, the subject of TFA):

* you must provide a meaningful key management

Depending on the size of the organisation and the purposes for using encryption, key management may not be necessary, though you still need a capable and reliable lost-passphrase-recovery helpdesk which is going to cost.

* you lose speed of your machines for number crunching

I think you need to review just how much time you think computers spend reading and preparing data from the hard drive. If you're in the middle of a number-crunching job, it's pretty much negligible. And besides that, most business laptop users (the target users of full-disk encryption) are trying to read e-mail and write Powerpoint slides, they aren't trying to simulate protein folding.

* you can easily lose data in the event of hardware corruption

* access to data is a bit harder even for legitimate purposes

Yes, that's the whole point. It's usually only a bit harder (you have to authenticate before the operating system will boot) but in return for that, the confidentiality of your data is protected. Security is about risk management and if the risk of publicising your company's secrets is more significant than the risk of users losing time by forgetting their passwords, then the trade-off is worth making.

* many systems (for example Active Directory domain controller .vs. ipsec) doesn't work well with encryption

Firstly, the kind of encryption they're talking about in the article, as implemented by BitLocker on Windows and third-party products on many operating systems, is transparent to operating system processes.

skills of your systems management must be higher

Oh noes! I pay my systems managers to manage my systems but don't want to pay people who know what they're doing!

Re:Encryption drawbacks (1)

grahamlee (522375) | more than 4 years ago | (#30762076)

Firstly, the kind of encryption they're talking about in the article, as implemented by BitLocker on Windows and third-party products on many operating systems, is transparent to operating system processes.

Erm :). Secondly, active directory domain controllers are typically run on servers rather than laptops, and full-disk encryption is typically run on laptops rather than servers.

Re:Encryption drawbacks (1)

lukas84 (912874) | more than 4 years ago | (#30762680)

Microsoft recommends using RODCs and BitLocker in branch office servers in insecure locations.

Re:Encryption drawbacks (2, Informative)

KiloByte (825081) | more than 4 years ago | (#30762134)

* you lose speed of your machines for number crunching

I think you need to review just how much time you think computers spend reading and preparing data from the hard drive. If you're in the middle of a number-crunching job, it's pretty much negligible. And besides that, most business laptop users (the target users of full-disk encryption) are trying to read e-mail and write Powerpoint slides, they aren't trying to simulate protein folding.

For typical modern hard disk and CPU speeds, it takes about a single whole core to encrypt/decrypt the data at full bandwidth. That's definitely not a negligible loss. Business users may be not trying to run make -j like we do, but they'll still suffer significantly decreased battery life.

Re:Encryption drawbacks (-1, Flamebait)

bjourne (1034822) | more than 4 years ago | (#30762326)

For typical modern hard disk and CPU speeds, it takes about a single whole core to encrypt/decrypt the data at full bandwidth.

Ehh.. Say what? What "full bandwidth" what "single whole core"? You make no sense.

Re:Encryption drawbacks (2, Informative)

broken_chaos (1188549) | more than 4 years ago | (#30762382)

From my experience playing with dm-crypt under Linux (on a greater-than three year old laptop, nonetheless), the speed and battery impact is surprisingly negligible for anything that doesn't constantly access the disk. Even with constant disk access, it was often less than a 'full core' of CPU utilisation. The only circumstance I can see full disk encryption, even done entirely in software, being a significant drain on performance is with a single core system or an extremely fast hard drive setup. A number of business-oriented laptops come with dedicated hardware disk encryption these days, such as some of the Lenovo offerings.

Of course, I did tweak the system I used to a fairly significant degree -- for example, most compilation (it was running Gentoo) was done fully in RAM, thanks to tmpfs, as well as using some other laptop-mode tweaks that reduced frequency of writes. It wasn't even that I needed the data on the disk encrypted... I just did it because I could, with few downsides and the upside being some more experience with that sort of security setup (which has come in handy since).

Re:Encryption drawbacks (1)

KiloByte (825081) | more than 4 years ago | (#30762876)

Was that "constant disk access" seek-bound or throughput-bound?

Re:Encryption drawbacks (2, Interesting)

Anonymous Coward | more than 4 years ago | (#30762182)

I ask, what are the tradeoffs though? Some of these factors can be mitigated. If you use Vista or Windows 7, Bitlocker recovery keys can be plopped into Active Directory.

The factors for not having encryption are worse, and this is not factoring PCI/DSS compliance, Sarbanes-Oxley, HIPAA, CALEA, and other laws:

* The legal liability of having records that were likely tampered with, so if there is a tax audit, there is no proof of anything that can stand in a tax court. The IRS or tax body may find that the lack of security constitutes malfeasance and assess immense fines.

* Shareholders will band together and make a class action suit at a drop of a hat. If a company shows that it knew about the risk, but didn't deploy encryption, there will be flocks of law firms in a feeding frenzy looking for anything which could be construed as gross misconduct or failing to employ due diligence.

* Law enforcement who is tired of chasing ID theft cases will be looking at the company to see if any criminal laws about data retention got broken. (This is mainly the EU.)

* You can do a lot with paying ad guys for PR, but it will cost a lot more to patch up damaged reputation than having meaningful security in the first place.

* The fees a company pays to have data recovery consultants will far, far outweigh the costs of having a security infrastructure. Yes, I have heard many bosses say, "just call Geek Squad", but for an enterprise-level meltdown, one will be looking at a huge tab, especially if business production systems are down.

* In some countries, having a rival company or nation know who is on a business's payroll may put lives at stake, especially if someone is found to be working for an unpopular company in an unstable country.

Re:Encryption drawbacks (3, Insightful)

bertok (226922) | more than 4 years ago | (#30762472)

Using encryption has its drawbacks:
* you must provide a meaningful key management
* you lose speed of your machines for number crunching
* you can easily lose data in the event of hardware corruption
* access to data is a bit harder even for legitimate purposes
* many systems (for example Active Directory domain controller .vs. ipsec) doesn't work well with encryption
* skills of your systems management must be higher

I know you probably mean well, but every one of those statements is basically false.

- Active Directory + Bitlocker OR AD + Encrypting File System (EFS) both do automatic key management, key escrow, etc...
- Bitlocker has no performance impact, it uses the TPM chip. Also, most CPUs are MUCH faster at encryption than disks are at reading or writing data, so it's not a bottleneck even for software-only systems.
- hardware corruption causes data loss anyway, encryption just ensures that you only ever get valid data. In that respect, it's a little like ZFS -- encryption also provides integrity, as well as security.
- Access to data on encrypted volumes is NOT harder. It's usually transparent. If you have proper backup procedures in place, you need never access data in non-standard ways. Speaking of which, your backups should be encrypted too!
- AD works well with encryption, and has its own built in. It's already reasonably secure for most applications, and doesn't really need further encryption. The only AD related protocol that had issues with ipsec is DNS, but Windows 7 and 2008 R2 now support that as well.
- If you're already deploying Windows Vista or 7 SOEs, adding in Bitlocker trivial, it's basically a checkbox. Deploying ipsec is admittedly a little harder, but it's not exactly rocket science.

I've implemented extensive encryption before, and it wasn't hard, and the users never noticed. From what I've seen, the lack of encryption is not caused by technical issues, but laziness and politics.

Security is one of those things that's not a problem day to day, just like backups. The users don't notice, and nobody complains to the managers about it, so it must not be a problem, right?

You only need security on those rare occasions when there's a hack, or a laptop gets stolen, or some intern sells 10 petabytes of old backup tapes full of customer data on eBay for $35. Of course, when those things happen, it's already too late to implement security. The breach has already occurred. There's no going back in time to tick checkboxes.

In case you're wondering just how common data breaches are, check out this list of the publicly known ones:

http://www.privacyrights.org/ar/ChronDataBreaches.htm [privacyrights.org]

If that doesn't scare you, think about how many more there are that the public didn't find out about. Chances are good that your personal data has been leaked to God-knows-who, probably several times, because of lazy IT admins and inept managers.

Re:Encryption drawbacks (2)

lukas84 (912874) | more than 4 years ago | (#30762694)

Bitlocker has no performance impact, it uses the TPM chip.

Wrong. While Bitlocker utilizes the TPM to ensure a secure boot and automatic unlocking (if so desired), the TPM chip is NOT used to handle the actual encryption/decryption.

BitLocker in Windows 7 will support the new Core i3/i5 AES extensions for faster encryption, though.

As a road warrior I should be using encryption... (5, Interesting)

hwyhobo (1420503) | more than 4 years ago | (#30761952)

As a road warrior I should be using encryption, right? I would be a perfect candidate for it? And yet there is no way I will encrypt my laptop when I travel. The risk of losing access to the data when something goes wrong is far too dangerous to risk it. I have had problems on the road already, yet I have always managed to recover my data either from my laptop or from backups, but what happens when the decryption mechanism or the OS crashes? Carry another laptop? Carry bootable USB-based decryption tools? Sorry, too many variables, too much potential for trouble.

It all comes down to a simple calculation - what is the mathematical probability of someone stealing my drive vs. my OS or disk crashing?(1) Anyone who has traveled knows the second far outweighs the first.

(1) As long as it is unencrypted, you can still recover it relatively easily.

Re:As a road warrior I should be using encryption. (4, Funny)

motherjoe (716821) | more than 4 years ago | (#30761980)

So long as you don't work for Equifax, Choicepoint, the IRS, FBI or any other organization that's going to have my SSN on your Laptop. :)
 

That's another problem altogether (4, Insightful)

hwyhobo (1420503) | more than 4 years ago | (#30762002)

So long as you don't work for Equifax, Choicepoint, the IRS, FBI or any other organization that's going to have my SSN on your Laptop. :)

That's another problem altogether - that kind of information should never be carried on one's laptop, period. It should only be accessed through a secure tunnel, and it should reside at HQ. There it should be encrypted.

Re:That's another problem altogether (1)

motherjoe (716821) | more than 4 years ago | (#30762032)

Yes, I was poking a little fun and trying to make the author really think about if the info is worth the risk of going unencrypted.

Referencing.....

http://www.privacyrights.org/ar/ChronDataBreaches.htm [privacyrights.org]

Re:That's another problem altogether (1)

aclarke (307017) | more than 4 years ago | (#30762368)

You're right of course. Should, should should. I don't know what business you're in, and what data is on your hard drive. I know I DO have sensitive information on my laptop, much as I try to remove it. For instance, I once had a customer email me a Microsoft Access database with > 13,000 customer records with credit card, CVV code, and full billing name and address. That clearly violated a number of agreements he had in place with his acquiring bank, but it only takes one file like that that you forget to delete from your inbox, or is still in your trash, or whatever, and losing your laptop can have a catastrophic effect on your credibility.

This is why, in addition to trying to keep sensitive information off my laptop, I ALSO encrypt everything. I'm sure I'm in a different situation than you, and maybe I'm just more paranoid. Perhaps if your laptop is stolen with company data, you can just blame IT for not having a better security policy in place. Since in my case, I'm on the hook, I don't want to be the weak link in the chain.

My encrypted information is also stored in a cloud-based backup (encrypted) and an on-site backup (encrypted). The two backups use different encryption methods. If my laptop dies in the field, I still have access to all my files if necessary and I shouldn't ever lose more than the last few hours of work, maximum.

Re:As a road warrior I should be using encryption. (1)

upuv (1201447) | more than 4 years ago | (#30761996)

100% Agree. The simple fact is if I encrypt it here I can't un-encrypt it there. Translation. My hard disk uses version 1.5.3.6.3.222.43..56666.333 of software BLOTZO.supersafe.org and nothing else I own does. My HD goes cactus I'm screwed.

I simply can't trust that I can recover from a failure. Even if I carry the magic secret key to the encryption.

It'll cost "me" more to recover than to have stolen.

P.S. I will go down on assault charges the next time some moron un-plugs my usb drive without safely ejecting it.

Re:As a road warrior I should be using encryption. (2, Insightful)

jimicus (737525) | more than 4 years ago | (#30762150)

100% Agree. The simple fact is if I encrypt it here I can't un-encrypt it there. Translation. My hard disk uses version 1.5.3.6.3.222.43..56666.333 of software BLOTZO.supersafe.org and nothing else I own does. My HD goes cactus I'm screwed.

I simply can't trust that I can recover from a failure. Even if I carry the magic secret key to the encryption.

It'll cost "me" more to recover than to have stolen.

P.S. I will go down on assault charges the next time some moron un-plugs my usb drive without safely ejecting it.

Which is why the correct response to "Oh dear my OS has failed and I now can't recover any of the encrypted data that was on the hard disk" is NOT "I'll have to crack out the bootable USB rescue disk that has never been properly tested and cannot possibly work in all circumstances".

The correct response is "Oh well, that's what the backup is there for".

(How easy it is to enforce your users not storing data on their laptops - or if they must do so guaranteeing they have a working backup facility in place - is another issue altogether).

Re:As a road warrior I should be using encryption. (2, Insightful)

Jeian (409916) | more than 4 years ago | (#30762042)

It depends on your job. If you're, say, a marketing consultant, encryption probably isn't all that important. If you work for a credit card processing company (I previously worked in the IT department for one) you absolutely should be using encryption.

Re:As a road warrior I should be using encryption. (2, Insightful)

Orlando (12257) | more than 4 years ago | (#30762120)

It all comes down to a simple calculation - what is the mathematical probability of someone stealing my drive vs. my OS or disk crashing?(1) Anyone who has traveled knows the second far outweighs the first.

I would go even further - What is the mathematical probability of someone stealing my [laptop] AND be interested enough in the data on the disk to bother trying to get access to it.

Even without encryption, getting access to the data on a laptop which uses OS password authentication requires some time and knowledge. I would argue that most people who steal laptops would reinstall as soon as they see a login screen. In other words, the hardware is more valuable to them than the data.

Be sure, I'm not saying the risk is zero, but it's pretty low.

Orlando

Re:As a road warrior I should be using encryption. (1)

IBBoard (1128019) | more than 4 years ago | (#30762254)

Even without encryption, getting access to the data on a laptop which uses OS password authentication requires some time and knowledge

I'm not exactly sure I'd call "throw a Linux Live disk" or "unscrew the HDD compartment, remove the disk and hook it up to a desktop" things that require much time or very much knowledge.

Chances are that thefts probably are to sell it and that they aren't interested in the data, but companies still shouldn't want to risk it (particularly if they work in a more sensitive environment with customers other than the standard commercial players).

Re:As a road warrior I should be using encryption. (1)

Orlando (12257) | more than 4 years ago | (#30762682)

I'm not exactly sure I'd call "throw a Linux Live disk" or "unscrew the HDD compartment, remove the disk and hook it up to a desktop" things that require much time or very much knowledge.

You wouldn't call it much knowledge, but you're reading Slashdot, right? The vast majority of laptop thieves wouldn't know or care how to do this.

Re:As a road warrior I should be using encryption. (1)

Hognoxious (631665) | more than 4 years ago | (#30762882)

The vast majority of laptop thieves wouldn't know or care how to do this.

But they might know a fence who does.

There's always the possibility (remote, but not zero) of someone "stealing to order" if they're targeting a specific organization.

This is why China is beating America hands down (1)

Colin Smith (2679) | more than 4 years ago | (#30762372)

I would go even further - What is the mathematical probability of someone stealing my [laptop] AND be interested enough in the data on the disk to bother trying to get access to it.

Two words you might want to consider...

"industrial" and "espionage"

Software installed and versions for further hacking attempts on the rest of the infrastructure.
Sales, marketing, pricing information. Release timing information.
Source code in products.

You name it.

The information is almost certainly far more valuable than the hardware, to the right people.

 

Re:As a road warrior I should be using encryption. (2, Interesting)

aclarke (307017) | more than 4 years ago | (#30762378)

If you have sensitive customer data on your computer, by law you may be required to notify those customers if the data is lost. Or, you may decide that morally it is the right thing to do. Therefore, you also have to balance the potential bad press your company's announcement will generate based on you losing your laptop, whether or not you know that the people who stole it are going to access the data.

Risk management is more than just the likelihood of your laptop being stolen and your data being accessed by criminals. It's about the significance of each risk as well. Given that for many people, having a laptop stolen and having to disclose that fact is a huge negative, having encryption can mitigate or eliminate that risk.

Re:As a road warrior I should be using encryption. (1)

Bert64 (520050) | more than 4 years ago | (#30762262)

And if your OS fails to boot, you will need to carry bootable media with you in any case.

There are also hardware encrypted drives, OS independent, no performance hit, no software to become corrupted... The only thing that would stop you getting at your data is a hardware failure, and a hardware failure will break an unencrypted drive just as badly.

No, it won't (1)

hwyhobo (1420503) | more than 4 years ago | (#30762304)

a hardware failure will break an unencrypted drive just as badly.

I have found myself in a situation where my laptop was field-unrecoverable. Yet, since I carry a fairly common model of a Thinkpad, I was able to borrow one from the site I was visiting, and a simple drive swap solved the problem.

Re:As a road warrior I should be using encryption. (2, Insightful)

Anonymous Coward | more than 4 years ago | (#30762282)

I also use a laptop often. However, I use TrueCrypt or BitLocker on Windows, and PGP WDE on my Mac. Why? Because if my laptop was stolen, I'd rather have it be "just" a hardware theft that I can get a police report, file a claim on my insurance, and replace my hardware. Without encryption, I would have not just a hardware theft, but a possible theft of:

* License keys to the OS and apps. A volume license key for a popular app is a boon for pirates.

* Personal Documents on the hard disk which can be used for ID theft, or used in combination with burglars to make finely targeted violent crime.

* Work documents. You would be surprised who has extremely company confidential material on personal machines because they need it for a remote presentation to a client. It could be something as simple as a roadmap of unreleased products that a prospective customer wants, but in the hands of competition, it would mean a major competitive loss.

* Passwords stored in a password manager, either the Web browser or another utility. I use different passwords for every Web site I go to, so if one site doesn't get compromised, it won't mean anything else does.

* Cached files. You can glean a lot of information even from deleted files about someone, the people they associate with, their job, and such.

* Identity. How many people put their Quicken files on a protected disk image or TrueCrypt partition, and make sure to unmount it when done balancing the checkbook?

* VPN settings. Even if someone doesn't know my VPN password, they will have account information, IP, and port number, and from this, they could try at the very minimum a brute force attack which either will work, or will have the account get denied. This would look very bad as an employee.

* Identity in another sense. A criminal can take a laptop and then masquerade as another individual to give the police someone to target and arrest.

On the road, I also take measures to contain data loss. I have a custom U3 USB flash drive that has a BartPE image on the CD part. I then have another USB flash drive with two TrueCrypt volumes on it. The first holds an OS image that I made before going on the trip. The second TC volume holds backup copies of my documents. Finally, I use a cloud computing backup service (using a keyfile so the documents leave my machine encrypted), so I am assured of fairly recent backups automatically. For maximum security, I keep a smart card on my keyring which can be used with PGP or TrueCrypt to ensure that if I have the smart card with me, no attacker is going to be able to mount those volumes.

USB flash drives are small, easily encrypted if you use known good software like TrueCrypt, Apple's Disk Image utility, LUKS, or EncFS, and easy to put in some sort of case (even a Ziplock bag) so they don't get lost in a laptop case.

Re:As a road warrior I should be using encryption. (2, Informative)

Radtoo (1646729) | more than 4 years ago | (#30762398)

but what happens when the decryption mechanism or the OS crashes? [...]

It all comes down to a simple calculation - what is the mathematical probability of someone stealing my drive vs. my OS or disk crashing?(1) Anyone who has traveled knows the second far outweighs the first.

(1) As long as it is unencrypted, you can still recover it relatively easily.

Well, I'm not sure what encryption solution you might have tried. I for one have been using first TrueCrypt and then LUKS on a laptop. It traveled far and its hard disk drive already had to be replaced twice. There never were any particular pains with encryption.

First and most important of all, backups and encryption do not interfere. So you obviously DO backup such a laptop that may get stolen, lost, or break completely. Certainly, if you use encryption, you want to have the software needed to decrypt an encrypted partition it on your backup or a live DVD, but that's nothing that's hard to get.

Even filewise recovery and forensics is possible on an encrypted partition, too - as long as you have the master encryption header (or similar) backed up, there's little chance for additional problems introduced by having encryption in case of a recovery.

Re:As a road warrior I should be using encryption. (1, Interesting)

Anonymous Coward | more than 4 years ago | (#30762846)

So, your data is so important that you cannot deal with losing access to it, but not so important that you won't encrypt it.

You must be in sales. Why are you reading slashdot?

My experiences were. (1)

motherjoe (716821) | more than 4 years ago | (#30761954)

The two Global IT outsourcers I worked for had us encrypt for Lotus Notes and Outlook, remote VPN connections, and when we connected to network devices on shared or owned customer space it was always SSH or SFTP.

That said, for much of the older legacy stuff that was deep inside each company's infrastructure it wasn't so much required.

Which is fine. (0)

pspahn (1175617) | more than 4 years ago | (#30761956)

At some point, organizations will realize they actually were vulnerable, and will swarm to adopt new security policies.

A lack of security, in this case, ends up creating security... job security.

More then I expected. (3, Interesting)

Wizarth (785742) | more than 4 years ago | (#30761964)

That is a larger percentage then I expected. I wonder if the statistics were collected by asking people if they used it, and the percentages were more the amount of people who knew they should be.

Re:More then I expected. (1)

SgtChaireBourne (457691) | more than 4 years ago | (#30762602)

That is a larger percentage then I expected. I wonder if the statistics were collected by asking people if they used it, and the percentages were more the amount of people who knew they should be.

It probably is directly proportional to the percentage of businesses leaving Windows behind. The number is growing rapidly, but to avoid harassment of all kinds, including pesky sales drones, they try not to be visible about it.

Anonymous Coward (0)

Anonymous Coward | more than 4 years ago | (#30761994)

Heh-heh. Which ones?

that's because (2, Informative)

rastoboy29 (807168) | more than 4 years ago | (#30762074)

we geeks haven't made it easier to use.

Re:that's because (0)

Anonymous Coward | more than 4 years ago | (#30762736)

We geeks haven't made our posts easier to read, either.

Orangutans (0)

Anonymous Coward | more than 4 years ago | (#30762084)

Am I the only one who read that initially as: 27% of Orangutans? I thought that was a pretty good number for an ape.

Come on now (1)

Frogbert (589961) | more than 4 years ago | (#30762096)

There is no way it is that high.

Disk encryption can be very useful sometimes (3, Interesting)

vadim_t (324782) | more than 4 years ago | (#30762156)

There's one use for encryption people don't generally discuss: tech service.

I've been running a home server for a long time. Such systems over time accumulate years worth of mail, which will contain private data, website passwords, and so on. I personally feel uncomfortable with sending a disk containing years worth of data to a tech support department when I want to say, get it replaced under warranty. There have been a few stories about underpaid techs looking for music and porn on customers' hard drives. And if the disk is broken I can hardly erase it properly.

So my solution:

For servers, encrypt the disk, and keep the key in an USB drive always plugged into the server. If a disk breaks, I remove the disk, and send it for warranty replacement without worrying about the data.

For laptops, I use Ubuntu's disk encryption. It's even better there as laptops usually don't have RAID, and may break for multiple reasons that I can't personally fix.

Re:Disk encryption can be very useful sometimes (0)

Anonymous Coward | more than 4 years ago | (#30762546)

If only Gary Glitter had known that...

Of course, that is one reason why various governments want encryption to be illegal.

A lot of organisations just are not that important (4, Insightful)

frinkacheese (790787) | more than 4 years ago | (#30762226)

If you run a cleaning company or you're a group of plumbers or perhaps you have a fairly large landscape gardening company then your data just is not that important or a target. So this survey is really quite useless, so what is Agnes Cleaners do not encrypt their thumb drives with their cleaning rota on it? Nobody cares. So whilst all organisations should encrypt just because it is sensible, not all organisations really need to bother because the likelihood of anything happening to their data is so small that it's just not worth the effort of sorting out the idiots who call up the part-time IT admin guy because they have forgotten their encryption key (again).

Re:A lot of organisations just are not that import (1)

grahamlee (522375) | more than 4 years ago | (#30762280)

How about Agnes Cleaners' contact database, containing all their customer records?

Re:A lot of organisations just are not that import (1)

TheLink (130905) | more than 4 years ago | (#30762404)

Who really cares about contact databases? They're just a bunch of public info - stuff in business cards. Unless Agnes Cleaners is a CIA front company it'll be no big deal.

It's likely that their customers already list themselves on the "Agnes Cleaners Facebook fan page" and post stuff like "hey I'm going to Florida, but I've changed the locks - stupid lock broke, so you can find the key under the doormat".

Most people don't care about secrecy. And in most cases it doesn't matter, because fortunately most people don't pick a _petty_crook_ career (the smart amoral/evil people pick careers which allow them to _legally_ take lots of money from stupid people).

If the contact databases got destroyed or became inaccessible it could affect their business. Agnes Cleaners might care about that. But they don't need crypto for that - just decent backups.

Re:A lot of organisations just are not that import (1)

frinkacheese (790787) | more than 4 years ago | (#30762482)

Good point, Sheila's Cleaners may get their contact database and steal all their business. This is why we should all hire a "Independent Mac and iPhone contractor, specialising in security issues." to make sure that we don't get pwned like this.

Now I have tried Sheila's cleaners and they are just not as good. For one, they didn't clean the table under the tablecloth and then they didn't iron my boxers.

Re:A lot of organisations just are not that import (1)

dltaylor (7510) | more than 4 years ago | (#30762358)

Does Agnes Cleaners work for anyone with a medical condition that requires a cleaning support staff? That service may even be paid for in whole or part by a public (Medicare) or private health insurer.

HIPAA!

Ah ah, what about the emails?! (1)

etenil (1645213) | more than 4 years ago | (#30762364)

Companies massively use emails, even for very sensitive business information. While I was still sysadmin, I was amazed to see all this mass of unencrypted and even unsigned emails passing through! I did try to make people sensitive to the issue (I wasn't in charge of the outsourced mail part), but only making the white collar people understand the advantages of using something like PGP was a hell... Encrypting stuff on the hard drive is all very nice, but as long as their emails will be transiting in clear form, I'm pretty sure no one will even bother trying to get into their hard drive...

Re:Ah ah, what about the emails?! (1)

Radtoo (1646729) | more than 4 years ago | (#30762760)

I myself doubt that wiretapping (even without encryption) is a desirable approach to get at data, as opposed to stealing computer drives. With the drives you get everything that has not been mailed yet as well as everything from years back, all in one go. Most evil doers would not only be interested in current correspondence, no?

It is also an issue of practicality. Drive encryption is very easy and unobtrusive to deploy and manage. The basic variant uses just the same password in the same login screen.

As opposed to that, key management, and other basic usage concerns on PGP or similar are not easy. Average Joe needs to know too way too much about how these things work, and IT Staff / Power users don't get enough flexibility. Your white collar people may have spared you a LOT of annoyances while you still were sysadmin, in fact.

CheckPoint... (1)

bomek (63323) | more than 4 years ago | (#30762426)

If all encryption software are like those from checkpoint, i understand those numbers...

What tha? (-1, Flamebait)

Anonymous Coward | more than 4 years ago | (#30762502)

I clicked 'disable advertising' on slashdot, why didn't this article go away?

Small office setup (1)

freedumb2000 (966222) | more than 4 years ago | (#30762524)

I have no idea if this is at all a best-practice (nost likely not), but I still feel like sharing how encryption is used in our 2-person office.

I set up disk encryption (with dm-crypt) for the linux server data drives and their backup drives only. The (Windows) desktop clients are dumb machines in the sense that no data stored localy, except installed applications. All work is done on files on the server directly.

My main worry is that someone walks away with the server machine and/or the backup drives and has access to all company relevant data of the past 20 years.

The server is unlocked with a keyfile stored on a USB flash drive, which is stored in a safe. The only time it is needed is when the server gets rebooted (practically never). The keyfiles for the external backup drives are stored on the local encrypted server partion. They get read every time the backup drives are switched and mounted. All drives aditionally share a common master keyphrase, in case the USB flash drive dies.

I am aware that this scheme has it's holes, unencrypted temporary data on the Windows host being the most obvious. What worries me most though is unencryped e-mail transfer and no tamper-safe documents formats. PDF would be great as common all-purpose distributable document format, but it's protection is a joke. I'll be happy to hear comments on how to improve my setup, but keep in mind we are small shop and won't be investing in dedicated appliances or any of that nature.

Re:Small office setup (1)

adosch (1397357) | more than 4 years ago | (#30762854)

I have no idea if this is at all a best-practice (nost likely not), but I still feel like sharing how encryption is used in our 2-person office.

2-person office, *NOT* an IT organization. Of course doing that is going to work for you because you only have one other person besides yourself to get on board, get up-to-speed, get their stuff together, and know what they are doing. Not an entire team, organization, department, etc. comprised of hundreds and hundreds of people. Apples to oranges IMHO.

My main worry is that someone walks away with the server machine and/or the backup drives and has access to all company relevant data of the past 20 years.

The server is unlocked with a keyfile stored on a USB flash drive, which is stored in a safe. The only time it is needed is when the server gets rebooted (practically never). The keyfiles for the external backup drives are stored on the local encrypted server partion. They get read every time the backup drives are switched and mounted. All drives aditionally share a common master keyphrase, in case the USB flash drive dies.

...so you have this grand plan in place for all this implemented server-side encryption, but there's a high potential for someone to physically walk out the door with your server? Are we still talking about security here? Sounds like you've clearly adopted the "obscurity" method.

No corporate data on my computer (1)

gnasher719 (869701) | more than 4 years ago | (#30762580)

Seriously, what makes you think there would be any corporate data on my home computer when I work from home? Allowing anything like that is just insane. No sane organisation would ever allow that. (Obviously the UK government is no sane organisation by that definition).

While everyone is arguing over drive encryption... (2, Informative)

barzok (26681) | more than 4 years ago | (#30762642)

thousands of businesses are using plain FTP and email to throw unencrypted files around to & from other companies daily.

And how many of that 27% are using it effectively? (1)

Chris Mattern (191822) | more than 4 years ago | (#30762666)

I've seen disk encryption set ups where you never have to supply an outside key or password to start up the computer--it's all self contained. Meaning that all the information necessary for decryption is being kept on the disk. Yeah, that's secure.

Re:And how many of that 27% are using it effective (1)

lukas84 (912874) | more than 4 years ago | (#30762704)

No, it's kept in the TPM.

While this isn't perfect, such a scheme will prevent anyone except targeted industrial espionage from accessing the information. If you're a small company with no special IP, this is a good-enough approach that keeps support costs low.

Up to... (1)

imakemusic (1164993) | more than 4 years ago | (#30762752)

The clear majority (77%) of businesses have up to a quarter of their total workforce consisting of regular remote users.

And my left arm is made of up to 75% cheese.

Is it just me, or is that line a little misleading?

Why not leave the hard disk in the datacenter? (1)

An dochasac (591582) | more than 4 years ago | (#30762840)

The amount of data in typical business documents and email now vastly exceeds the amount of data you need to push out to a thin client to provide a good user experience. Why not leave the hard drive and all of the data they contain in your home office and only take home the keyboard and screen to display it with [aimtec.co.uk] (which DOES use an encrypted channel back to the data center). That's what my company does and if a Sun Ray thin client or Gobi laptop ever goes missing, so be it, pull another one off the shelf and keep typing where you left off.

Encryption (1)

Ivan Stepaniuk (1569563) | more than 4 years ago | (#30762924)

Ncvxm fmnwo octef gaiwv gwrsl s
Load More Comments
Slashdot Login

Need an Account?

Forgot your password?

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>