One of the most powerful tools you have in your toolbox when it comes to data security is description
disk encryption as the name implies literally encrypts the data that is stored on your mass storage.
We usually think about this in terms of hard drives but it works for just about any type of mass storage.
The important thing that we have to be comfortable with disk encryption is well.
Number one it could slow systems down.
So if you have a big file server for example that was really doing a lot of data moving I probably wouldn't
consider disk encryption where we do like to use description is number one any devices that are out
in the wild.
So mobile devices laptops smartphones whatever we might have out there.
Also if you have desktop systems that may not move but may not have really good physical security because
that's really where the power of description comes into play.
And that is somebody can get to it and they're just not going to be able to access that data.
There are no really well-known common ways to crack almost any type of the many many types of description
out there.
Now when we're talking about disk encryption you can pretty much break all the encryption tools into
two camps.
There's the camp that has TPM or a Trusted Platform Module support and there's the camp that doesn't
TPM or Trusted Platform Module simply means that you have a chip burned into the device if it's a laptop
it's on the motherboard somewhere.
If it's a smartphone it's in the electronics.
And inside this chip is a full blown public private key and there is no way to get the private key out
of this physical chip.
So with that little tool set you can do some amazing things like for example you've got a motherboard
and you've got a whole system in the system you have a hard drive and that hard drives encrypted.
If a bad guy grabs the hard drive and tries to go do something with it in a far away place.
The fact that it's not connected to the TPM chip will prevent anybody from being able to do anything.
So it is a wildly powerful tool now that doesn't mean that every disk encryption out there that does
not use TPM is bad in fact you'd be surprised who doesn't use TPM.
Now what I want to do is I'm going ahead rebooted my computer and I want to show you because if you
have TPM on almost any system you've got to go ahead turn it on at some level.
And in this case on this particular system I had to turn it on at the highest level so if you take a
look right here.
All right so you see that PTT as they call it there.
That is an example of turning it on at the system level.
I don't know why this motherboard calls it PTT I had to look it up.
That is TPM for that particular system.
So there are lots and lots of wonderful description tools out there.
Probably one of the oldest is something called PGE are pretty good privacy disk.
Been around arguably since the late 90s.
Another popular one was one called True crypt.
I'm using the word past tense because surprisingly in the middle of 2014 the true kit true crypt people
simply said we're out of business and they just kind of almost disappeared.
However true crypt is still available.
In fact there have been forks to true crypt with names like Sipher shed or there's a crypt that really
just pick up where true crypt left off and they are very very powerful tools so if anybody were to ask
you is true crypt bad.
There have been audit's and all types of stuff done to it that says we don't know why these guys quit
doing it but they did.
By the way true crypt completely free within the Windows environment.
You're probably going to be using something like bit locker a bit like comes with all the later versions
of Windows for the office environment and does a great job I'm going to show you that one in just a
minute.
For Mac folks you use something like Firebolt Fauvel is actually very interesting because Macs choose
not to use TPM.
There's some arguments about TPM being used for digital rights management.
So people are keeping you from be able to watch movies and stuff like that.
And that's my opinion as to why Apple probably stayed out of that which is kind of interesting.
If you're in the Linux world you've got to literally probably over 100 different types of encryption
methodologies are going to let you sort it out and choose the one you want.
OK so what I want to do now is just take a minute.
I've got the Trusted Platform Module running on my system here so I've rebooted.
And what I want to do is show you get Lochore in action so to startup bit locker and I'm using Windows
10 pro here so I'm going to go to a bit Lochore drive encryption and I'm just going to go ahead and
turn it on so the first thing it's doing right now is it's checking what's to make sure that I have
it.
TPM chip and that the TPM chip is turned on so once it does that it's going to be like OK.
So what we need to do is keep a recovery key handy in case something were to happen so this recovery
key is incredibly important.
So I'm going to print it I will print or overyear
so I'm going ahead and I'm just printing the key on my local printer here and now what it's asking me
is it Ed says you want to encrypt the user space only.
Or do you want me to encrypt the entire drive.
I'm going to go ahead and click next.
And in fact we'll just go ahead and let that go because Bit locker is going to take a good long time
before it actually completes us encryption.
Do not ever run any form of disk encryption software without making very very sure that you have a key
either printed or stored in a file or something because there is literally no way to get this back.
There is no way I can't stress this enough in the United States all the major law enforcement people
there's zillions of court situations where they just simply couldn't get to the data on bad guys encrypted
drives.
And it is a powerful tool.
But failure to have a little backup and nobody is going to get to that data.