Solved supporting an office of computers with full drive encryption
-
@scottalanmiller said in supporting an office of computers with full drive encryption:
Sure, that can happen, depending on how it is set up. But you can encrypt all user space without encrypting the OS.
How would I go about encrypting the user space without the OS?
-
@Mike-Davis said in supporting an office of computers with full drive encryption:
@scottalanmiller said in supporting an office of computers with full drive encryption:
Sure, that can happen, depending on how it is set up. But you can encrypt all user space without encrypting the OS.
How would I go about encrypting the user space without the OS?
Standard method is to have all user accessible space on a different volume. Like a D drive (partition.) That way the system can fire up, get patched and be used like a normal system but the data you need to protect can only be accessed with a password (or something) to allow it to decrypt.
-
@scottalanmiller said in supporting an office of computers with full drive encryption:
@Mike-Davis said in supporting an office of computers with full drive encryption:
@scottalanmiller said in supporting an office of computers with full drive encryption:
Sure, that can happen, depending on how it is set up. But you can encrypt all user space without encrypting the OS.
How would I go about encrypting the user space without the OS?
Standard method is to have all user accessible space on a different volume. Like a D drive (partition.) That way the system can fire up, get patched and be used like a normal system but the data you need to protect can only be accessed with a password (or something) to allow it to decrypt.
The issue with that that needs to still be considered can be local data being pulled down to the
drive you are unaware of. Outlook, temp files, whatever.I know in the past when we're argued ... er, discussed ... this, you say you don't use anything that create local temp files, but it's a consideration for many.
-
@BRRABill said in supporting an office of computers with full drive encryption:
@scottalanmiller said in supporting an office of computers with full drive encryption:
@Mike-Davis said in supporting an office of computers with full drive encryption:
@scottalanmiller said in supporting an office of computers with full drive encryption:
Sure, that can happen, depending on how it is set up. But you can encrypt all user space without encrypting the OS.
How would I go about encrypting the user space without the OS?
Standard method is to have all user accessible space on a different volume. Like a D drive (partition.) That way the system can fire up, get patched and be used like a normal system but the data you need to protect can only be accessed with a password (or something) to allow it to decrypt.
The issue with that that needs to still be considered can be local data being pulled down to the
drive you are unaware of. Outlook, temp files, whatever.I know in the past when we're argued ... er, discussed ... this, you say you don't use anything that create local temp files, but it's a consideration for many.
You can include the program files on the D drive. It's not too hard to look at the apps that you will be using and see where they store data.
-
@scottalanmiller said in supporting an office of computers with full drive encryption:
@BRRABill said in supporting an office of computers with full drive encryption:
@scottalanmiller said in supporting an office of computers with full drive encryption:
@Mike-Davis said in supporting an office of computers with full drive encryption:
@scottalanmiller said in supporting an office of computers with full drive encryption:
Sure, that can happen, depending on how it is set up. But you can encrypt all user space without encrypting the OS.
How would I go about encrypting the user space without the OS?
Standard method is to have all user accessible space on a different volume. Like a D drive (partition.) That way the system can fire up, get patched and be used like a normal system but the data you need to protect can only be accessed with a password (or something) to allow it to decrypt.
The issue with that that needs to still be considered can be local data being pulled down to the
drive you are unaware of. Outlook, temp files, whatever.I know in the past when we're argued ... er, discussed ... this, you say you don't use anything that create local temp files, but it's a consideration for many.
You can include the program files on the D drive. It's not too hard to look at the apps that you will be using and see where they store data.
I wonder if there would be issues trying to force Internet Explorer to install to an alternate path. (another drive) If you can't and the user launches it, and logs in to a confidential site, and their alternate temporary internet file location is unavailable, does it just store the temp files where it has access, or crash? I did a quick google search and couldn't find much on getting internet explorer to install to an alternate path, so I think that idea might not get to far.
-
Are you asking if IE just starts putting private data anywhere? That seems very unlikely. What makes you think that?
-
@scottalanmiller said in supporting an office of computers with full drive encryption:
Are you asking if IE just starts putting private data anywhere? That seems very unlikely. What makes you think that?
If you log in to windows and your profile isn't available, Windows creates a temporary profile for you and runs under that. This isn't the exact case since you would have to have to unlock your secure volume after you log in and your profile loads, but I'm thinking the behavior would be the same.
-
@Mike-Davis said in supporting an office of computers with full drive encryption:
@scottalanmiller said in supporting an office of computers with full drive encryption:
Are you asking if IE just starts putting private data anywhere? That seems very unlikely. What makes you think that?
If you log in to windows and your profile isn't available, Windows creates a temporary profile for you and runs under that. This isn't the exact case since you would have to have to unlock your secure volume after you log in and your profile loads, but I'm thinking the behavior would be the same.
That's just user profile data. Are you talking about redirecting the user profile?
-
@black3dynamite said in supporting an office of computers with full drive encryption:
That's just user profile data. Are you talking about redirecting the user profile?
No , the question is two fold. First, can you install internet explorer to a secure volume so it can't launch unless they unlock their secured drive? Second If IE can't be installed on an alternate path, if the path to their temporary files is unavailable, will Windows just dump them somewhere else?
-
@Mike-Davis said in supporting an office of computers with full drive encryption:
@black3dynamite said in supporting an office of computers with full drive encryption:
That's just user profile data. Are you talking about redirecting the user profile?
No , the question is two fold. First, can you install internet explorer to a secure volume so it can't launch unless they unlock their secured drive?
Why would you care?
-
@Mike-Davis said in supporting an office of computers with full drive encryption:
@black3dynamite said in supporting an office of computers with full drive encryption:
That's just user profile data. Are you talking about redirecting the user profile?
No , the question is two fold. First, can you install internet explorer to a secure volume so it can't launch unless they unlock their secured drive? Second If IE can't be installed on an alternate path, if the path to their temporary files is unavailable, will Windows just dump them somewhere else?
Internet explorer is not like the other browsers. It's part of the operating system. How about not using Internet explorer and stick with Firefox. I believe Opera and Vivaldi allows USB like installation.
-
@black3dynamite said in supporting an office of computers with full drive encryption:
@Mike-Davis said in supporting an office of computers with full drive encryption:
@black3dynamite said in supporting an office of computers with full drive encryption:
That's just user profile data. Are you talking about redirecting the user profile?
No , the question is two fold. First, can you install internet explorer to a secure volume so it can't launch unless they unlock their secured drive? Second If IE can't be installed on an alternate path, if the path to their temporary files is unavailable, will Windows just dump them somewhere else?
Internet explorer is not like the other browsers. It's part of the operating system. How about not using Internet explorer and stick with Firefox. I believe Opera and Vivaldi allows USB like installation.
I expect that they do. And even IE is effectively phased out. But even assuming that it is absolutely required, I'm unclear why its installation location matters. Maybe I'm missing something obvious, but no matter where it is running from, does that affect anything to do with security?
-
Coming into the conversation late here.
I have a full enterprise where most, if not all, of my laptops are bitlockered before they are deployed. Security keys are stored in the TPM for boot decryption. I also hold the kyes to the encryption on an IT controlled drive.
There is also a boot up password that must be entered by the user when the boot the computer up from cold. If they are rebooted, the startup password is bypassed automatically by the bios/uefi.
-
The requirement is that temporary files from using the web based software are not left unencrypted. In the suggestion that the
drive is not encrypted so that OS patches can happen I don't think that will work. If the user can launch IE without decrypting the secure drive, it fails the requirement. -
You're asking for full drive encryption while the computer is running?
-
@Mike-Davis said in supporting an office of computers with full drive encryption:
The requirement is that temporary files from using the web based software are not left unencrypted. In the suggestion that the
drive is not encrypted so that OS patches can happen I don't think that will work. If the user can launch IE without decrypting the secure drive, it fails the requirementWhy? Does IE store local files in a shared space? That sounds very unlikely. You've tested that?
-
If the computer is stolen, they don't want confidential files left unencrypted on the drive.
-
@Mike-Davis said in supporting an office of computers with full drive encryption:
If the computer is stolen, they don't want confidential files left unencrypted on the drive.
No one has questioned that. We are questioning why you think files would be written to that part of the drive.
-
@scottalanmiller said in supporting an office of computers with full drive encryption:
You can include the program files on the D drive. It's not too hard to look at the apps that you will be using and see where they store data.
We're going back to this. My thought is that Internet Explorer is not movable and you can't force it to store temp files on an encrypted drive unless you encrypt the entire drive.
-
There is an assumption that IE, and ergo Windows, is inherently insecure and cannot be trusted. Yet you will deploy it where you don't trust it, then use encryption running on top of it in the hopes that that fixes the problem you are assigning to the system itself. This seems like a strange set of things based on an assumption that I don't believe has foundation.
