How to secure BitLocker configurations

How to secure BitLocker configurations

Hacking Exposed Windows
By Joel Scambray

Have a look inside the third edition of Hacking Exposed Windows : Microsoft Windows Security Secrets and Solutions by Joel Scambray, with this excerpt from chapter 12, "Windows security features and tools."

With the introduction of Windows Server and Windows Vista came an

    Requires Free Membership to View

    Login

    When you register, you’ll also receive targeted alerts from my team of editorial writers and independent industry experts with the latest news, tips, and advice to help you do your job more efficiently and effectively. Our goal is to keep you informed on the hottest topics and biggest challenges faced by IT professionals today working with desktop management and security technologies.

    Margie Semilof, Editorial Director

    By submitting your registration information to SearchEnterpriseDesktop.com you agree to receive email communications from TechTarget and TechTarget partners. We encourage you to read our Privacy Policy which contains important disclosures about how we collect and use your registration and other information. If you reside outside of the United States, by submitting this registration information you consent to having your personal data transferred to and processed in the United States. Your use of SearchEnterpriseDesktop.com is governed by our Terms of Use. You may contact us at webmaster@TechTarget.com.

Windows Vista security
Vista BitLocker Drive Encryption tips

Top 10 Windows Vista security tips

Windows Vista's security features: One year later
additional security feature, BitLocker Drive Encryption (BDE, or BitLocker), which protects the confidentiality and integrity of the operating system volume during the boot sequence and while the operating system is not loaded. Windows Server will also extend this capability to protect data volumes as well. BitLocker was designed to mitigate offline attacks, such as removing the physical drive from a lost or stolen laptop and accessing the data from an attacker controlled operating system. In the following section we discuss the various configuration options for BitLocker and their prerequisites.

BitLocker configurations

As mentioned, BitLocker can be configured in a variety of ways. In this section we discuss each, along with its strengths, weaknesses and prerequisites. BitLocker can be configured to operate in the following modes:

  • BitLocker with a Trusted Platform Module (TPM).
  • BitLocker with a TPM + startup PIN.
  • BitLocker with a TPM + USB token.
  • BitLocker without TPM.
  • BitLocker without TPM + USB.
  • BitLocker without TPM + startup PIN.

Tip: Microsoft provides an excellent step-by-step procedure for configuring your system in each of these scenarios.

Depending on the desired configuration for BitLocker, your system must also satisfy other hardware and software prerequisites. To determine whether your Windows Vista computer meets these requirements, perform the following steps:

  1. Click start.
  2. Click control panel.
  3. Click security.
  4. Click BitLocker Drive Encryption.

If your computer configuration meets all prerequisites, you will see the screen shown in Figure 12-1.

At a high level, these configuration options represent different combinations of the following:

  • systems with the TPM.
  • systems without the TPM.
  • systems using single-factor authentication.
  • systems using two-factor authentication.

Of these, the most secure configuration is a system that has a TPM and utilizes two-factor authentication, for this reason: The TPM provides BitLocker with the ability to validate each component of the boot process. This ensures the platform is in a known secure state before decrypting the volume.

With most authentication systems, barring implementation flaws, the degree of difficulty to authenticate as another principal increases with the number of "factors" -- each factor introduces an additional test that must be passed by the entity attempting to authenticate. Common authentication factors include the following:

  • something you have.
  • something you know.
  • something you are.


Figure 12-1: system that satisfies BitLocker prerequisites

Currently, BitLocker supports two of these: something you have (a USB or TPM) and something you know (a PIN). In the next section, we take a deeper look at the desired solution -- BitLocker equipped with a TPM and an additional form of authentication, such as a PIN or USB token.


This was first published in April 2008

Join the conversationComment

Share
Comments

    Results

    Contribute to the conversation

    All fields are required. Comments will appear at the bottom of the article.

    Disclaimer: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.

    Back to top