I’m going to start this whole security thing by taking a look at the new BitLocker technology built in to Vista. Before I begin, I want to specify that I am by no means an expert on BitLocker and all of my information comes from the Microsoft site and a face to face with the engineers at Launch Tour 2007. So lets begin with requirements. You must have a modern motherboard which has a “TPM” or Trusted Platform Module. The reason I say must, is that there IS a third mode where you store your keys on a USB drive. However, if you do this, you are carrying around your keys in clear text on a USB drive. If that didn’t scare you in the least bit, then you are either a rather large individual who scares people enough for them not to want to get near you, or you don’t care about security, in which case you don’t need BitLocker.

So, now that we have the disclaimer out of the way, here is a thousand word on how Bitlocker works:

Basically, your keys are stored on this TPM and are used to unlock the MFT, which has the full volume keys that unlocks the rest of the drive. Cool, we’re in the clear, right?

Q1: What if I want to put the HD into another computer? The new computer’s TPM will not have the correct keys. Well, if the computer was connected and a part of an AD domain err.. I mean “tree”, then you can supposedly find those keys and “PUSH” them to the new TPM. No, the engineer did not know how to “PUSH” said keys. However you could also unlock it using a 36 hex value key. That you can right down.. on a piece of paper… that you might keep near or with your laptop…

Q2: What are the other two modes, and which one do I want?

Transparent operation mode: In this mode, BitLocker is completely transparent to the user. You just boot and log in. Bitlocker still encrypts the whole drive as you see above. But the “authentication” step is where Bitlocker checks to see if “boot files” have remained unmodified. I would be interested in finding out exactly which files it checks and what it checks for.

User authentication mode: In this mode, during boot, before any HD files are accessed, the user is prompted for a PIN. In my opinion, if your boss is dead set on using Bitlocker on all of your drives, you should insist on this one. (But guess what, for all those roadies that keep your computers in “Sleep”, BitLocker doesn’t mean anything. With a U3 device and a cool cygwin script, I can make a unencrypted copy of the system, even if it’s locked out)

So to break it down in conclusion: You have to have newer hardware, AD, roadies who don’t rely on “SLEEP” and educated users. Something tells me the last part of that would be a bit hard to accomplish.

But, that’s just my take on things, I’m just another security guy in a room with a small sign on the door that says “IT Dept”. What would I know?

jd

For more info, check out the wikipedia article: Wikipedia –> Bitlocker