Protection on the move

How secure is the information in your laptop and what can you do to protect company secrets once they are taken out of the...

How secure is the information in your laptop and what can you do to protect company secrets once they are taken out of the workplace?

Teleworking and alternative working practices are revolutionising the way we do business today. No longer are workers forced to take paper copies because they can literally take their work home with them on laptop computers and transmit files back and forth between offices by email.

When we lose or suffer the theft of a PC or laptop, the information stored on it is open to the eyes of the possessor. It is only a matter of time before thieves realise the value of the information stored, which can far outweigh the physical value of the hardware. This is not just a problem for governments either. If any kind of personnel information, results or forecasts are stored on a machine, that information is valuable. Needless to say, anyone who works in research and development needs to pay particular heed.

One solution is to encrypt the data stored on the laptop and the PC so that if it falls into the wrong hands, the possessor will be unable to profit from any stored data. The biggest problem with this is that encryption, as a subject, is generally misunderstood and involves complicated concepts that can fox most workers. The answer then is to create a system that is easy to use and yet effective.

Instant or "on the fly" encryption and decryption is a very effective way of securing you data. In essence, the user saves data to a certain area (e.g. a hard disk or a virtual hard disk) and the data is automatically encrypted without being apparent to the user. Data is then decrypted (for legitimate users) instantly and doesn't slow down work practices.

Encryption methods need to be simple in three respects: in installation and deployment across the organisation; in use; and in maintenance. If you choose to totally encrypt the hard disk, you need to consider the compatibility of the BIOS. Most will require the ability to read the complete boot track in "clear text". If you encrypt the entire hard disk, this will not be possible and the user will be restricted to certain makes of laptop. This may lead to higher hardware costs.

The usual way to secure a hard disk is to require a smart card or password to access the system. However, once the user has correctly passed this stage, all information is unencrypted. For this reason, it's necessary to look at what is happening behind the scenes. Are the temporary directories and swap files, including password information, encrypted? How would you know if someone has got into your system? If your password is included in "clear text" on the boot track, all someone has to do is get into your system while you are logged on, find the password and then wait for the opportunity to log on again while your computer is unattended.

It's also important to consider what happens if you boot from a floppy disk. There may be built in "back-doors" which endanger the security of your system and reveal significant weaknesses. Another problem is the interaction of your hard disk with the operating system, e.g. are they compatible? Some operating systems require the ability to boot from a floppy in certain situations. This is a problem because someone could try and boot from a virus ridden floppy which could corrupt your whole system.

If this happens, you are likely to require an administrator to try to recover the information for you. This is often untenable as your administrator may not have security clearance to view the information they are trying to recover. For example, you might not want your administrator looking at payroll information or personnel records.

Another problem with using single machine encryption (i.e. just on one hard disk) is that it renders the computer unusable for anyone but the main user. This leads to problems if, for example, that user is ill or leaves the company. If switching users takes a long time or involves the administrator, this again leads to potential compromises of security because the administrator has to decrypt the information in order to pass it to the new user or move it onto another computer for the original user. This is inadvisable because if the computer is physically removed or damaged, it means the user cannot work until a new machine can be set up (provided there is a back up of the encrypted data to allow any work on a new machine).

Another disadvantage of encrypting a hard drive is that it creates issues of compact storage because very few total hard disk encryption methods will allow you to use compression drives such as Zip or Jaz.

Encrypting the entire hard disk may cause the system to be slower at the boot up stage, as the computer must decrypt all the information in the hard drive. Encryption, of course, leads to the question of what happens when the user forgets their password or the user changes. If the administrator is allowed a list of passwords, this then needs to be encrypted and some organisations may not wish the administrator to have this information.

The other issue is what happens if the operating system or the hardware fails? If you have a system crash, is the data all encrypted or is it unencrypted, sitting in a temp file waiting for a full reboot in order to reactivate the encryption software? For many systems, the user has to be present for this to happen (to sign on to the computer). This causes issues for backups, because, most of the time, these will require the user to be present and logged on. It is also, of course, vital to make sure that the backup is encrypted, otherwise the whole system of protecting the data from unauthorised access will be compromised.

If a company does encrypt the hard disk of every computer, they need to consider the implications of system upgrades. If they upgrade either their hard or software, they need to make sure they both are compatible with the encryption system. But moreover, they need to consider whether upgrading the memory means a total reinstallation of the encryption suite. This throws up the problem of what to do with the encrypted data while you carry out the upgrades. Do you put it, decrypted, onto another drive, or on a networked drive in case the hardware fails? This, in itself, defeats the object of encryption.

With virtual hard disk encryption, the issue of compatibility should not arise and this solves many of the problems associated with multiple users. Once installed, the virtual disk encryption system creates the facility for the user to create virtual drives. These are protected by the users' password or smart card. The user is prompted for these passwords when entering the operating system. Once the password is entered, the data is decrypted and appears as normal.

When data is saved to an encrypted drive it is automatically (and transparently) encrypted. This also means that if data is saved elsewhere it will not be encrypted.

Virtual hard disk encryption can support very large drives. Most can also support multiple drives, which is necessary for multiple users. It is important when considering virtual hard disk encryption to check whether the decryption key is stored in clear text anywhere on the PC. If it is stored in readable form on any part of the drive it could be accessed and thus encryption would be irrelevant.

Virtual hard disk encryption offers advantages for system administrators and support staff in that, because the encrypted information is in a "container", it is easy for them to copy the container in the event of a hardware failure. The contents of the container are, of course, encrypted, so should provide minimal security risk in their copying. This also provides opportunities for secure back-ups as the data does not need to be decrypted to be backed up. It also means the encrypted data can be encrypted along with all the other data when it is time to create a backup and does not require the presence of the user.

Most virtual hard disk encryption systems offer a hot key locking facility, so that if a user has to leave their computer unattended, they can hit a key and all data is saved into the encrypted drive. The "containers" should automatically lock if the user logs off, shuts down, powers off, or puts the computer into standby mode.

Virtual hard disk encryption systems must be easy to use. They should redirect documents automatically to the encrypted drive. This means, in effect, that "My Documents" becomes encrypted as it is (usually) the default location for saving documents.

Most virtual disk encryption systems allow file compression (Zip files and Jaz files) by creating a "container" within that device which then allows the secure transfer of compressed data. This does, however, require the installation of the decryption software if the compressed files are to be unpacked on another computer.

In conclusion, neither encrypting the entire hard disk or creating a virtual (encrypted) hard disk will help if your operating system or hardware crashing leaves the data unencrypted and open to scrutiny or copying. The most basic hacker will just use Win Nuke or something similar to crash your operating system and then reboot and look for the unencrypted files.

Rachel Hodgkins

Read more on Antivirus, firewall and IDS products