Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is there a way to protect exe if server is on colocation hence the physical access is possible for the colo people? I have W2008R2 and was thinking of using BitLocker but it seems encrypting the whole disk not just file/files as I need.

Also the exe is running on the server all the time and I read that Bitlocker has been hacked on condition of physical access to the box which is true in my case.

What options do I have?

share|improve this question
add comment

1 Answer

up vote 4 down vote accepted

The truth is that physical access trumps almost any encryption scheme. I would assume that your contract with the colocation company makes them liable for any theft of data resulting from someone getting physical access to the server. That is about the best you can do.

Bitlocker does indeed encrypt the entire disk, however, there are other encryption software available (such as PGP and its many associated descendants). You will have to consider the performance impacts of decrypting and encrypting a file on the fly (and of course, the reality that the .exe will be unencrypted while it is actually executing in resident memory).

Ultimately, if the contents of the file is so sensitive that you are worried about physical access, you should probably consider pulling that particular server back onsite where you control physical access and only the employees of your company have ready access.

share|improve this answer
    
you gave me great idea :) I might consider storing the exe on different server and run it from main server from connected drive. how about that? performance impact is negligible as the app is tiny and has to be started once really.... they still of course can get dump of the memory but this has to be quite sophisticated i gather... –  Boppity Bop Oct 9 '11 at 13:05
1  
Dumping the memory is not sophisticated at all. Once you have physical access to a system, you are de-facto the system's administrator. Once you are the administrator, you have the necessary privileges for debugging. And once you have that... - well, I think you've figured it out. The very design of computers as we use them today does allow for arbitrary access once you can lay your hands on the physical system. –  syneticon-dj Oct 9 '11 at 13:09
    
could you please explain - how physical access to the box translates into admin access to the OS? –  Boppity Bop Oct 9 '11 at 13:22
1  
@Bobb they can clone the disks and put then in their own box. They can use a plethora of password reset tools to change the root/administrator password. They can sniff all of the traffic in and out. They can basically have full access to the machine, or a clone of it in very short time if they really wanted to. –  MDMarra Oct 9 '11 at 13:26
1  
Daniel is absolutely right. If the data or software on your box is too sensitive to risk non-employees getting hold of it then don't put it in a place where non-employees can fiddle with it unsupervised by you. –  RobM Oct 9 '11 at 13:50
show 3 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.