Originally posted by: InlineFive
That makes sense, thank you. Is using EFS on the users directory sufficient (only place information will be stored) or should I look at encrypting the whole volume?
It depends what you are trying to achieve.
If you are concerned about performance, stability, etc. then encryption is undesirable. Although small, there is a performance hit associated encryption - and there are theoretical stability issues (a minor data corruption can irrecovably destroy an encrypted file, whereas sometimes slightly corrupted data files can be recovered).
EFS provides you with the option to encrypt some files and leave other unsecured - e.g. files that multiple users might want to share could be left unencrypted, whereas confidential files could be secured. The potential security risk is that temp files, e-mails, etc. may not be secured. If the hard drive is examined forensically, there may be circumstantial evidence about what is in the secured files, or who else might have the files - it's possible that if you've zipped them up at some point, that a temporary zip file may be lurking somewhere.
Bitlocker provides 'whole drive encryption' this is a brute-force and ignorance approach and ensures that if the PC falls into the wrong hands, nothing useful can be extracted from it. No forensics, no data recovery, no internet history/e-mails/temp files, nothing. However, in order to do anything useful with the PC, you need the key. So any, and all users, will need to share the same access key.
A corporation who needs to ensure that confidential management documents don't get leaked to the press by a disillusioned IT dept employee might use EFS to ensure that these files can only be read by the specified user and the CTO.
A government agency who needs to ensure that nothing at all, even when examined by expert forensic analysts, can be recovered from a stolen laptop would be better off with bitlocker.
Maximum security is achieved by encrypting the whole volume, as without the key, the drive may as well be brand new (indeed for corporations who wish to dispose of computers at the end of their life, bitlocker is brilliant. Just quick format and remove the drive from the PC, and it's instantly 'securely wiped' - no need for time consuming degaussing or software 'shredders' or dangerous and environmentally unfriendly physical destruction). While this blocks outsiders, it does nothing about insider attack.
Facebook
Twitter