When should an IT consultant use full disc encryption?

Question

In what circumstances should an IT Consultant encrypt their hard drive to protect their code/data of their clients?

I am thinking that if it does not add much to your work load you might as well use full disc encryption with a 'weak' password to at least prevent someone from accessing your email files and other documents if your laptop is stolen, even if they will not get access to any database files or other very sensitive data.

Answer 1

I agree that full-disc encryption is good, especially if you have sensitive data on your a laptop (you probably do). So, with the new laptop models being plenty fast, I'd say "always".

That said, there are caveats:

• if you forget your password, this means all your data are as good as gone (until you remember the password again).
• (corollary: any encryption solution that has a "recover password" option is likely snake oil, not encryption)
• weak passwords == no protection (your cow-orkers probably won't try to break into your computer, but a stolen laptop's data could be worth some money; plus, pass-phrases are quite strong and easy to remember)
• the full-disk encryption could make sleep mode/hibernation impractical, if not impossible (check the product you plan to use)
• some data may be accessible from additional locations (e.g. your e-mails may be stored on a server, with a copy stored locally in your computer)
• full-disc encryption is not magical pixie dust - it doesn't provide security against other attack vectors, you still need to address those separately (backups, antivirus, firewall, phishing protection, social engineering, rubber hose cryptanalysis)

Note that encryption should not be seen as a way of securing the data forever from anyone - its goal is just to delay an attacker long enough to make the attack uninteresting. With strong encryption, it should take years before the attacker gets to the data by brute force, at which point the data is so old that it's useless. Although the National Security Agency (or similarly powerful entity) can probably crack the encryption much faster (as it can throw enormous amounts of computing power at it), full-disk crypto is still good protection against anyone else cracking it (e.g. your competitors or a random thief).

As a bonus, encryption eliminates casual snooping: if you forget your (powered-off) laptop somewhere, an almost-honest person might decide to browse through your files before returning it to you, just out of curiosity. There's a proverb that says "most locks are made to keep honest people honest"; strong locks will do that, and also keep the really malicious people out for long enough.

Answer 2

1: "weak" passwords aren't an actual issue. Folks don't come around to offices and brute force their way into machines. The real issue is: 1) social engineering, or 2) Keyboard loggers; both of which render a "strong" password useless. Teach your IT department's less technical folks about those two things, how to spot them, and how to handle them, and you'll have no problems.

2: If somebody gets your encrypted disc in their hands, it won't matter that it's encrypted. They can get the data. It's just a matter of how much the data is worth to them. If you're protecting nuclear codes or Google's search algorithm, I'd go for armed guards and forget drive encryption.

Answer 3

Frankly, I don't think there's any excuse for not using FDE. I have used it in my laptop for years, with practically no issues.

I use LUKS encryption, which is part of Debian (the installer will even set it up for you).

To address the concerns in other answers:

• if you forget your password, this means all your data are as good as gone True, but this only means you need to keep your password written down in a safe place (or good memory). Forgetting is not much of an issue, because you have to type it in every time you boot.
• the full-disk encryption could make sleep mode/hibernation impractical No problem. Sleep is unaffected, because RAM contents are preserved. Hibernation works out of the box, and hibernates to an encrypted swap partition.
• reduces performance This is true, but the impact is minimal in normal operation. It is only noticeable if both I/O and CPU are maxed out. The only situation I notice is during video encoding, and even then the overhead is only about 10%.
• any encryption can be cracked Unlikely - if you choose a strong passphrase (i.e. one generated by a program), there is (in the foreseeable future) no way to brute-force it.

In my opinion, a laptop with any kind of even mildly private information should always use FDE. Laptops are too easily lost or stolen.