Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

When you install Bitlocker on a system without a TPM you need to put the startup key on a flash drive.

Since you can hardly expect the user to store his notebook and flash drive separately, would Bitlocker offer any advantage over an unencrypted system if both are lost/stolen?

share|improve this question

3 Answers 3

up vote 0 down vote accepted

If both of them were stolen by the same thief, which happens to have some knowledge of how Bitlocker works, you can pretty much assume your file system has been broken into.

You may want to consider using TPM if your data is extremely important, or even TPM + PIN. It's better to have to rely on stuff that's in your head rather than a USB key which anyone can get their hands on if they really want to.

share|improve this answer
    
TPM is almost always used still with a password –  LapTop006 Dec 29 '09 at 13:18

Bitlocker can be compromised even with a TPM. Sure it's unlikely but it all depends on how much your data is worth to you and who's interested in it.

For the average Joe it's not worth it.

For CEO level security I think I'd be looking at adding an extra layer of encryption at the very least.

See: http://www.schneier.com/blog/archives/2009/12/defeating%5Fmicro.html

share|improve this answer

The two existing attacks against bitlocker are quite a stretch. Gaining access to the victims computer TWO TIMES is a very unlikely event. What will happen in most cases? The Laptop/Workstation gets stolen alltogether or just the harddrive. BitLocker will keep your data "safe" (of course there is NEVER a 100% security).

Only CEO data is important? Really? I think I can do a whole lot of damage with some random employees files.

"Since you can hardly expect the user to store his notebook and flash drive separately [...]" If you are unable to teach the employees basic security bahaviour, most of your precautions will fail.

Don't get me wrong here, but security isn't done the simple way :)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.