You have your nice laptop for running around the world with, you are on a business trip to Warsaw and then suddenly after getting off the plane and on your way to your meeting you find that you do not have it. Doh! you remember that you put it in the little pocket of the seat in front of you just before you landed but you forgot to get it out. You frantically get in touch with the airline who tell you that nothing has been handed in, and then you start to worry about the commercial secrets that you have on the disk and that copy of the spreadsheet that contains all your banking details. It is lost and available to whoever has the machine. Oh, but you say that you have the OS logon to protect you… wrong, that is easy to bypass when you have physical access, just remove the disk. Oh yes, the Bios password – same issue and anyway you can normally get past that with some secret key presses found in many places on the Internet. What about the 40 bit encryption put in place by Excel on the spreadsheet? – nope that will be gone too with a couple of utilities, and anyway that data is spread all over the disk in temp and page files for the half skilled hacker to get.

So you are screwed. What now?

Well there is something that you could of done that is really easy to have implemented and that would have protected you from all but the most serious of attackers – whole disk encryption. Historically tricky outside of certain quarters, it certainly has been available but only in the last 12 months has it really become simple to implement and use. You could use Bitlocker from Microsoft of course, if you have Vista. Then again you are almost certainly not running Vista and anyway Bitlocker is a little tricky to implement and only available on some versions of Vista – definitely not the one you probably have. So what are the alternatives? Well I will not go into the whole bunch, but I will focus on one which is freely available and simple to implement – Truecrypt, in particular version 6.1 which has largely resolved some critical problems for operation with laptops that earlier versions suffered from. The problems that it used to have was that it would not let you suspend or hibernate, but that is now resolved.

So how do we get it? Just go to Truecrypt’s website and download it, make sure that you have read the installation guidance off their website, backed up your important data (because it could go wrong!) and just run the installer and set your passphrase well. In my instance I found a big problem during the installation – I was installing on a netbook without an optical drive and the installation routing REQUIRES that you create a recovery boot cd. It is irritating that a bypass mechanism is not available for this, but this is sort of for your own protection. Anyway, out came the USB CD/DVD writer and a boot CD was dutifully created and installation completed. The installation is pretty simple and includes a test boot but the most interesting fact is that at the end of installation, your disk is still not encrypted. It actually does this as a first step after install completion, and it allows you to continue to run the machine as normal as it churns through all the disk encryption, and allows you to pause the process and/or shut down the machine at any time, for it to continue when you startup again. This is a very nice touch.

The encryption process takes a nice length of time dependent upon disk size but at the end, you have a high level of disk encryption that just happens all the time without you doing anything more. In operation you do not notice a difference at all apart from some performance loss. Now on my Atom based 1.6GHz processor, I reckon that the performance hit in normal operation is about 10-15% where disk access is required (I have not measured it) but there is a much greater effect on the hibernation process – both going into and coming out. Certainly a doubling of the time to do the process and I can only guess that during that phase the disk writing/reading capability is hamstrung in some way but the overall impact is acceptable considering that if I lost the laptop, all my corporate secrets are still secret – as long as I picked a suitably strong pass phrase and logon passwords. Note that for suspend operation, the encryption boot block does not come into operation so your logon password is all that protects you there.

Truecrypt does offer other facilities as well, as it offers multi-layers of encryption and data hiding but for the standard business use a single disk encrypt is almost certainly enough. Truecrypt also offers the more mundane folder encryption particularly for external drives but I will go through that in another post.

All in all then, this is a must both to protect your data and your clients data, and a simple addition to your portable business armoury. If you or your company wants further advice about deployment of software like Truecrypt and security principles that are advisable, then please feel free to contact Blackarrow Consulting via our website for that service.