Cyberstudy
PDF p.70 In progress

Disk and File Encryption

Open PDF at p.70 20 flashcards

Summary

PDF p.70

Disk and file encryption protect data at rest by encrypting storage devices or individual files. Full-disk encryption (FDE) secures the entire storage device, while volume and file encryption provide more granular control. Self-encrypting drives (SEDs) and cryptoprocessors like TPMs and HSMs enhance security by managing encryption keys.

In plain words

Supplementary — not from your PDF

Full-disk encryption scrambles everything on a drive, including free space, so a stolen laptop is useless without the unlock credentials. Volume and file encryption cover just a part: a volume, a folder or a single file.

Detailed explanation

PDF p.70
  • Data at Rest
    • Definition: Data stored in persistent storage media.
    • Encryption Levels: Range from full-disk encryption to file system or database encryption with granular access controls.
  • Full Disk and Partition Encryption
    • Full-Disk Encryption (FDE)
      • Definition: Encrypts the entire contents of a storage device, including metadata and free space.
      • Protection: Guards against physical theft by requiring user credentials to unlock the decryption key.
    • Self-Encrypting Drives (SEDs)
      • Types: HDD, SSD, USB flash drives.
      • Function: Built-in cryptoprocessor stores keys, not exposed to the OS.
    • Partition Encryption
      • Definition: Encrypts specific logical areas (partitions) of a disk.
      • Usage: Different keys for different partitions (e.g., boot, system, data).
  • Volume and File Encryption
    • Volume Encryption
      • Definition: Encrypts a storage resource with a single file system.
      • Examples: Microsoft's BitLocker, Apple's FileVault.
      • Scope: May or may not include free space and file metadata.
    • File Encryption
      • Definition: Encrypts individual files or folders.
      • Dependency: May require specific file system support (e.g., NTFS for Microsoft's EFS).
    • Metadata and Free Space
      • Metadata: Includes file lists, ownership, and timestamps.
      • Free Space: Can contain data remnants from deleted files.
  • Cryptoprocessors
    • Trusted Platform Module (TPM): Stores keys securely, compatible with encryption products.
    • Hardware Security Module (HSM): Provides centralized or portable key storage.

Important terms

taken from the text above
Data at Rest
Data stored in persistent storage media.
Encryption Levels
Range from full-disk encryption to file system or database encryption with granular access controls.
Full-Disk Encryption (FDE)
Encrypts the entire contents of a storage device, including metadata and free space.
Partition Encryption
Encrypts specific logical areas (partitions) of a disk.
Volume Encryption
Encrypts a storage resource with a single file system.
File Encryption
Encrypts individual files or folders.
Dependency
May require specific file system support (e.g., NTFS for Microsoft's EFS).
Metadata
Includes file lists, ownership, and timestamps.
Free Space
Can contain data remnants from deleted files.
Trusted Platform Module (TPM)
Stores keys securely, compatible with encryption products.
Hardware Security Module (HSM)
Provides centralized or portable key storage.
FDE Full-disk encryption SEDs Self-encrypting drives TPM Trusted Platform Module HSM Hardware Security Module

Examples & real-world scenarios

Supplementary — not from your PDF
  • BitLocker (Windows) or FileVault (macOS) on laptops.
  • Self-encrypting drives that keep the key inside the drive.
  • Encrypting one sensitive folder with file-level encryption.

Scenario

A sales laptop is stolen from a car. Because full-disk encryption was enforced and the key is protected by the TPM plus a PIN, the thief can't read customer data. The incident is a hardware loss, not a data breach.

Common mistakes

Supplementary — not from your PDF
  • Assuming file-level encryption also protects free space and metadata.
  • Thinking disk encryption protects files once the user is logged in and the disk is unlocked.

Practical skills

Supplementary — not from your PDF
  • Choose full-disk, volume or file encryption for a device.

What I should remember

Key Points PDF p.70
  • Data at Rest
    • Encryption Levels: Full-disk to file system/database encryption.
  • Full Disk and Partition Encryption
    • FDE: Encrypts entire storage device.
    • SEDs: Built-in cryptoprocessor for key management.
    • Partition Encryption: Encrypts specific disk areas.
  • Volume and File Encryption
    • Volume Encryption: Encrypts storage resource with a single file system.
    • File Encryption: Encrypts individual files/folders.
    • Metadata and Free Space: Includes file lists, ownership, timestamps, and data remnants.
  • Cryptoprocessors
    • TPM: Secure key storage.
    • HSM: Centralized/portable key storage.