Is it feasible to remotely encrypt the hard drive of a virtual server (VPS, cloud server like EC2)? This would help to protect the contents of the hard drive from snooping by the host or as a result of a security hole, but has some issues:
- The password has to be entered on startup. Remotely, is this even possible?
- Could the host simply snoop on the password as it is entered?
- Do VPSes provide block-level access to the machine, or just file-level? Is encryption even possible?
- The host (or a judge/policeman/man-with-a-gun telling them what to do) is ultimately in control of the hardware; could they simply examine the memory as the machine runs (similar to a cold boot attack without powering off the machine)?
With these concerns in mind, is encrypting a server with sensitive data simply security theatre, or can it provide real security over an unencrypted drive?