Laptop encryption the hard(ware) way
By Rick Cook
Unless you've been playing Second Life nonstop for months, you're probably all too aware of the problem of data loss from laptop computers. It seems like every month there is another announcement where megabytes of sensitive data is lost because someone's laptop was stolen.
Protecting information on laptops comes down to three things:
Data can be encrypted at the file level with software, the entire disk can be encrypted with software, or you can use a special hard disk with built in encryption of the entire disk. File-level encryption is best suited for data in motion over a network, disk-level encryption in software is more secure, and hardware encrypted disks are more secure yet.
Full disk encryption (FDE) usually prevents the computer from being booted up without the password or key. That protects not only the files themselves, but also things like .tmp files, buffers and other points of attack.
The problem with software-based FDE is overhead. Effective encryption takes processing power, and software FDE increases save time by 40% to 300%, depending on the product. By contrast, hardware FDE unloads the encryption function onto a specialized processor, typically built into the disk or controller and has little or no effect on disk performance.
While there have been hardware-based FDE products before, such as Enova, very few computer manufacturers supply laptop systems with them. Now Seagate, Hitachi and others are offering laptop drives with built-in full-disk encryption and other drive manufacturers are expected to follow soon.
This is still very new. Seagate and Hitachi only announced their FDE drives in Dec. 2006 and began shipping their drives in the spring of 2007. The first vendor to announce a laptop using them, ASI Computer Technologies, has just begun shipping Seagate-equipped laptops to VARs for resale to vertical market. According to ASI, the base price of the systems is around $2,150. The Hitachi drives are available in Alienware and Dell XPS laptops. The company says the Travelstar 7K200 will be available from retailers this summer for about $250 for aftermarket installation.
Unlike Seagate, which uses a separate chip to handle encryption, Hitachi builds the encryption function into the disk firmware. This allows FDE to be easily enabled by the manufacturer before shipping the disk. (Encryption cannot be enabled or disabled by the purchaser.)
FDE introduces some requirements of its own. Key management is a major issue, just as it is with any encryption scheme. For that reason, you want to make sure you have an effective key management and recovery system in place before introducing FDE laptops into the organization. It may also make sense to standardize on a single brand of drive with good key management facilities.
About the author: Rick Cook specializes in writing about issues related to storage and storage management.
06 Jun 2007
Disclaimer: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.