Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

My question is basically this: What are people's experiences with hardware-based full disk encryption, esp from a security-auditing standpoint?

More info: I'm specifically looking at the Seagate Momentus FDE drive with Wave's Embassy Suite (If you have experiences with other self-encrypting drives (SEDs) and/or s/w suites, pls opine as well.)

Facts: Self-encrypting drives (that have been configured) will auto-lock when they are powered off (computer shutdown or hibernation, or just pulling the plug). A password, token, or whatever is required to access any of the data on the drive, which itself is encrypted (typically AES-128). However, a reboot does not cause the user to have to re-authenticate with the drive.

The response I got from Wave is that they force hibernation mode (on Dell systems w/ Windows), even if standby mode is selected by the user. But I'm concerned about the following attack scenario:

  1. the machine is on* (like if the user locks his screen & walks away for a moment), and then
  2. someone steals the laptop (leaving it on), and then
  3. restarts the machine using a boot disc or bootable USB stick.

Begging the question: Are there ways of mitigating that avenue of attack beyond just changing the boot sequence in the BIOS & password-protecting the BIOS setup?

* I understand many other vulnerabilities exist on running operating systems, such as buffer overflow attacks on system services via the network, but I find that avenue of attack less likely than simply using a boot disc (as described above), esp as self-encrypting drives become more widespread.

share|improve this question
    
I am interested in this question as well. –  Troggy Jul 9 '09 at 20:36

2 Answers 2

We went with bitlocker for our laptops because we couldn't get a good answer to this very question from Wave, and we thought the same scenarios was likely to be non-vendor specific.

share|improve this answer

You could password protect the BIOS setup and remove the CD drive and USB Key from the boot sequence.

That way they would have to turn off the computer to clear the bios password (jumping pins on the motherboard), so they would be locked out of the HD.

share|improve this answer
    
Yeah, I mention that in the "Begging the question" section of the original question. I just hate having to rely on the BIOS for HDD security. BIOS vendors are renowed for their propensity toward static, "administrative" (backdoor) passwords to the BIOS setup. Further, if a technique came about to clear the BIOS (to factory default) without shutting down the machine, then the HDD security is trivially bypassed. –  Garrett Jul 9 '09 at 21:07
    
Ah sorry I missed that in your post. If you can't verify the security with the BIOS manufacturer then that is still a strong attack vector. There are devices that take an action when a user walks away from the machine (proximaty fob), so maybe you could use those to force the machine to hibernate. –  Adam Brand Jul 9 '09 at 21:25

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.