Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have about 30 (this number will most likely grow over the next few years to 50 or more) unencrypted laptops that I have been tasked to encrypt (entire drive). These machines will be used off site regularly by my users. These machines are running Windows 7 and XP (about 50/50), but more Windows 7 every month. I have experience with Truecrypt, and have had no issues. It appears to be THE solution for a free solution.

My concern with Truecrypt is that my users will have 2 passswords needed to login to their machines. Also, I need to choose to either have 1 password for my organization, or carefully document each machine's password (management nightmare). In my mind, choosing between a managed and a free encryption solution is primarily based on the NUMBER of machines that will be encrypted and supported.

Two questions:

  1. From a management standpoint, what is the tipping point of users where a managed solution would pay for itself over Truecrypt?
  2. What are some good third party solutions? (I will consider Bitlocker, but the price to upgrade Windows 7 licenses is a turn-off)

I would love to hear from some admins with experience in supporting encrypted machines in a corporate environment.

Many thanks in advance!

share|improve this question

3 Answers 3

up vote 2 down vote accepted

When to use Truecrypt and when not to?

If one of your laptop goes missing, and you either A) have confidential data on the machine, or B) can't confirm that there is NO confidential data on the laptop then you need some kind of encryption scheme. Of course, you (and your organization) need to decide what criteria you want to use to consider what is confidential and what isn't. I recommend you don't neglect this step; you don't want to go to all this work if it is not necessary, nor do you want to elevate your organization's equivalent of the office's cookie recipe to a level of secrecy that demands AES-256. If you've already been through the process, then you're good to go.

My concern with Truecrypt is that my users will have 2 passsword needed to login to their machines. Also, I need to choose to either have 1 password for my organization, or carefully document each machine's password (management nightmare).

The choice between using a single password for your fleet of laptops or using unique passwords on per-machine basis depends on some question you need to think about:

If you pick a single password, will you change it every time someone who knows it leaves employment? If not, how often will you rotate it? If you pick a unique password, you'll have increased security but increased overhead too (however you won't have to rotate the password for every laptop each time an employee leaves). How will you keep track of the password rotation scheme?

My suggestion here is pick a permutation scheme that uses a number that physically stays with the laptop, like part of the serial number. Add something else to this that you can remember. The permutation scheme should be relatively hard to guess, but easy enough so that you can sit down at laptop and not have to refer to documentation. This should reduce some of the management overhead. Obviously, if you need to rotate the password for a laptop, you need to pick a new permutation scheme to "generate" your password with. This could be a simple as incrementing a digit... regardless document, document, document.

In my mind, choosing between a managed and a free encryption solution is primarily based on the NUMBER of machines that will be encrypted and supported.

Total agreement here. 30 - 50 machines seems do-able here with a un-managed solution, BUT you'll want to carefully think that through before you commit to it. Try a test rig to get an idea of what kind of overhead it will require.

  1. From a management standpoint, what is the tipping point of users where a managed solution would pay for itself over Truecrypt?

This depends on whether you have more time or more money. :D Like I said, there are ways to reduce the overhead of un-managed solution. The overhead may be less than you think.

2. What are some good third party solutions? (I will consider Bitlocker, but the price to upgrade Windows 7 licenses is a turn-off)

In my opinion, only Bitlocker, but only if you already have the licenses. TrueCrypt is an excellent product in my experience. The other thing to mention about Bitlocker, is you still can't get away from the password issue... I believe the official line from Microsoft is that they do NOT recommend storing the password in TPM as it is vulnerable to a cold boot attack.

From TechNet: "The TPM-only authentication mode is easiest to deploy, manage, and use. It might also be more appropriate for computers that are unattended or must restart while unattended. However, the TPM-only mode offers the least amount of data protection. If parts of your organization have data that is considered highly sensitive on mobile computers, consider deploying BitLocker with multifactor authentication on those computers."

Additionally, the enterprise addition allows you use AD to store "recovery keys" (presumably copies of the keyfiles required for encryption. This is a nice integrated Windows version of TrueCrypt's Recovery Disk Functionality.

share|improve this answer
    
Ahh, so bitlocker has no (secure) single sign on support? Interesting. Excellent food for thought and great insight, thank you! –  tm77 Mar 11 '11 at 4:29
    
Please see my edits. There's really no such thing as "secure" single sign on support for full disk encryption. It's a chicken and egg problem, how are you supposed to access some sort authentication server before you can access the file system itself? TPM gets around this by storing the passphrase locally on "firmware", but as mentioned this not the recommened approach. (Also: please be sure to mark the appropriate response as the answer for your question when you feel like your query was solved) –  kce Mar 11 '11 at 6:08

We just went through this and decided on truecrypt because of it's track record. We currently have 15 users on it and could grow quite large. There are two options:

create an image with a complicated password. Create the restore cd from this. Then have the user change it. Do not create another cd.

Or create a complcated password and have the user change it after creating the cd. After changing do not recreate the cd. This allows you to reset the password with your password that you made sure to remember.

The biggest issue is your time and energy. Good luck!

share|improve this answer
2  
Am I missing something, or are both your solutions the same? 1) Use complicated password, 2) Create CD, 3) Change password, 4) Do not create another CD –  Mark Henderson Mar 11 '11 at 1:31
    
That is one way to deal with the password I did not think of. Excellent solution. Mark, yes I do agree with you. :) –  tm77 Mar 11 '11 at 1:58
1  
This is a good solution to recovery... it's been a while since I've tried this but as long the encryption keys don't change your true crypt recovery CD will work even if the passphrase has been changed correct? –  kce Mar 11 '11 at 3:16
    
@kce well the truecrypt says so: "WARNING: Your TrueCrypt Rescue Disk allows you to restore key data if it is damaged. By doing so, you also restore the password that was valid when the TrueCrypt Rescue Disk was created." from truecrypt.org/docs/?s=program-menu –  Janis Veinbergs May 29 '12 at 8:54

Our organization is in the process of implementing laptop encryption as well. I know that the testing showed TrueCrypt to be viable for our needs, though discovered the same password problems that you mention.

gdurham has the best solution for dealing with the password issue and it should keep you out of trouble.

The price associated with TrueCrypt will be the time they pay you to admin it. This is not insignificant so try and do an assessment based on the knowns between the "free" solution and a paid.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.