Whole-disk encryption

Two times recently I’ve had friends who have had data stolen from them physically; one had her house broken into and her laptop stolen, another had her external backup drive stolen.

It’s one thing to have a laptop or a hard drive stolen, but it’s much much worse to worry about the impact that the now-compromised data can have on your life — Stored passwords, confidential data, personal information, photos, the list goes on. It’s even possible that a thief could use the saved passwords and cookies saved on your computer to access your on-line accounts and do considerably more damage. On-line banking, email accounts, social-media accounts, etc.

Even if your laptop is damaged, it’s still possible for an attacker to take the hard drive out and hook it up to another computer to gain access to your information. Log-in passwords don’t protect against this if the OS is bypassed. Your data is completely accessible.

While it is possible to secure a large part of your data by encrypting your most private files, that still doesn’t cover areas like browser cookies, temp files, and the swap space. Data from secured areas can “leak” into those areas and still be viable for attackers. In addition, this requires effort, and I talked about this in my post about backups.

Hard drive passwords are one good tool, as they render the drive effectively useless to all but the most sophisticated attackers (read: all except police, government, and attackers with sophisticated tools). The hard drive is logically “locked” at the firmware level and cannot be unlocked without the correct password or some circumvention of this. Your data is still stored on the drive, but attempts to read the drive will fail. Most modern computers (especially laptops) and hard drives support hard drive passwords. This is a good tool, but if you’re at all concerned with the potential weaknesses of this, you might want something a little stronger.

Enter full-disk (or whole-disk) encryption. This is one of the strongest tools to protect against any time of attack against the hard drive. By storing the data on the drive in an encrypted form, it becomes next-to-impossible to get anything useful off the drive. Full-disk encryption typically uses the AES method, which is well-established to be secure.

There are several commercial solutions to full-disk encryption, but as a big supporter of free/open-source software, I’m only going to cover the free and cross-platform ones.

TrueCrypt (Windows, Mac, Linux) – This is an exceptional tool for encrypting both internal and external drives, and creating encrypted “containers” to store files in. Free and open-source, and from what I’ve seen, rock solid. I’ve used this under Windows to do full-disk encryption, and I still use it to keep my 1TB external hard drive encrypted. Setup is easy and doesn’t require you to reinstall the OS — encryption of your existing drive can be done on-the-fly and you won’t lose any data. (Though having a backup beforehand is always a good idea)

Ubuntu has a few options ingrained into the OS. Home directory encryption is a choice during installation, which protects your files when you’re not logged in. The encryption is very good, but there’s still the chance that file information will leak out into unencrypted areas of your drive. When you’re installing Ubuntu, and you’re at the part where you enter your chosen username and password, at the bottom of the screen you’ll see the option “Require my password to log in and decrypt my home directory.” That’s the option which enables home directory encryption.

The “alternate” installer CD gives a solution to this: Full-disk encryption using LVM/dmcrypt. Unfortunately, this option will require you to reinstall your OS as it requires the disk to be repartitioned as LVM and encrypted. Also, it’s a little harder to set up. Although the installer is guided (and some very good walkthroughs exist) there’s no fancy GUI. It’s also not easily reversible, but as far as I’m concerned, there’s no reason you’d want to. While installing using the alternate CD, choose “LVM with encryption” while you’re setting up partitions. It’s worth noting that this installation was markedly slower than a typical install (I think it took an hour-something) but considering the amount of disk I/O that was taking place, I’m really not surprised.

Performance versus an unencrypted drive in all cases is good — your system will take a performance hit but it wont be very noticeable except in cases of disk thrashing, or very heavy disk read/write activity. You will notice a little bit of a slowdown in system performance then, but it won’t be much.

Thoughts or opinions on this? Please share them!

, , ,