Tactical Advice

Keep Those Notebooks Safe with Encryption

These tools can help businesses better manage risk.
 Keep Those Notebooks Safe with Encryption

Every year, thousands of notebook computers go missing around the country. The security administrators responsible for the safety of those systems can be divided into two camps. The first contains those who rest easy because they make use of notebook encryption technology and are confident that their loss is limited to the cost of the notebook. The second group, a much more stressful place to find oneself, contains those who haven’t deployed encryption technology and who must spend hours or days trying to reconstruct the sensitive data that may have been stored on the missing device.

Encryption technology obscures the data stored on notebook computers, rendering it completely inaccessible to users who don’t know the encryption key, which is usually linked to a password, fingerprint or other authentication technology. There are four main options for encrypting notebooks: leveraging the operating system’s built-in security features; purchasing a stand-alone encryption product; licensing a suite of security tools that includes endpoint encryption; or going the open-source route.

Leveraging Operating System Tools

The first place many administrators look for encryption capabilities is between the covers of something they’ve already purchased — the operating system itself. Until recently, this evaluation did not take long: The limited encryption capabilities provided in Microsoft Windows Vista and Mac OS X 10.6 simply didn’t rise to the challenge for businesses that need to manage encryption across multiple systems. With the release of Windows 7 and Mac OS X 10.7 (Lion), however, the market slowly began to shift.

On the Windows front, Microsoft added one of the most sought-after features to the Windows 7 version of BitLocker: the ability to encrypt removable devices. That said, BitLocker adoption is going to be quite slow, mainly because Windows 7 adoption is lagging in many organizations. As long as enterprises have mixed environments, including non-BitLocker versions of Windows, Microsoft’s encryption offering will not be a viable contender.

Apple is further behind on the device-encryption front, but they too have made major strides in their most recent operating system release. Earlier versions of Mac OS X included FileVault (an encryption product that allowed users to encrypt their home directories) but did not offer full-disk encryption. This presented challenges to those seeking to backup their files and protect data stored outside of the home directory, leading many to adopt third-party alternatives. However, Lion has taken a major step forward by offering full-disk encryption for the first time.

The bottom line here for most organizations is that the encryption capabilities provided by operating systems, while tempting, aren’t quite ready for prime time. If you’re a Microsoft shop and you’ve fully adopted Windows 7, you might consider piloting BitLocker. But if you’re in any type of mixed environment, you should probably look elsewhere for endpoint encryption.

Opting for Stand-Alone Encryption

While operating system vendors work to catch up with endpoint encryption functionality, software vendors who produce stand-alone encryption products are seeing changes of their own. Security giant Symantec recently acquired PGP, Sophos bought out encryption vendor Utimaco, and Intel purchased McAfee. The market for these third-party products will likely remain until native operating system capabilities become widely available.

The major appeal of stand-alone encryption products is that most will work across operating system platforms and versions, providing a unified point of management and adding encryption functionality to OS versions that don’t natively provide it. A stand-alone encryption product might be the best choice for an organization that already has other security solutions in place and wants to add endpoint encryption to its toolkit.

Integrating Encryption with Other Protection Tools

While native operating system tools are very popular because of their cost, information security professionals who seek more advanced products are shifting away from stand-alone solutions toward those that integrate with endpoint protection suites, such as the tools available from Intel/McAfee, Sophos and Symantec, among others.

The main driver behind the adoption of these products is the reduced administrative burden they provide for the technical staff. When malware protection, host intrusion prevention, data loss prevention and other security technologies are combined with endpoint encryption functionality in a single product, administrators benefit from a centralized console that provides a one-stop shop for monitoring, policy configuration, agent deployment and reporting. This increases the security staff’s productivity and also the probability that the tools will be used correctly and maintained in an appropriate fashion.

For those who are looking for a comprehensive endpoint security solution, these suites are probably the best way to go, in that they minimize both expenses and administrator time commitment. In fact, the recent consolidation in the stand-alone encryption marketplace points toward continued adoption of the endpoint protection suite approach, as traditional players in the field acquire those who specialize in endpoint encryption.

Evaluating Open-Source Offerings

It would be remiss to discuss notebook encryption without mentioning the final player in the field: the open-source community. The dominant player in this space is TrueCrypt, an open-source product that supports many versions of Microsoft Windows (from Windows 2000 through Windows 7), all versions of Mac OS X later than 10.4 (Tiger), and flavors of Linux using the 2.4 or 2.6 kernel. TrueCrypt’s feature set rivals that of commercial products, including transparent encryption, the use of hardware acceleration and support for removable devices — and to top that off, it’s completely free.

While this might sound like an appealing option, it comes with a catch: There is no commercial support available for TrueCrypt. If you experience an issue, you’re on your own to sort it out. Most organizations simply aren’t willing to accept this lack of support for such a critical security technology.

That said, implementing any type of endpoint encryption across your organization will ensure your place among those system administrators who don’t lose any sleep when a notebook is lost or stolen. Of the many products available, the best bet in today’s market is to purchase a stand-alone encryption product or license the functionality as part of a full security suite.

Sign up for our e-newsletter

About the Author

Mike Chapple

Mike Chapple is an IT professional and assistant professor of computer applications at the University of Notre Dame. He is a frequent contributor to BizTech magazine, SearchSecurity and About.com as well as the author of over a dozen books including the CISSP Study Guide, Information Security Illuminated and SQL Server 2008 for Dummies.

Security

Why Cloud Security Is More E... |
Cloud protection services enable companies to keep up with security threats while...
Securing the Internet of Thi... |
As excitement around the connected-device future grows, technology vendors seek ways to...
Tools to Maintain Mobile Sec... |
Far-flung devices pose serious challenges, but a variety of technologies can help protect...

Storage

The New Backup Utility Proce... |
Just getting used to the Windows 8 workflow? Prepare for a change.
How to Perform Traditional W... |
With previous versions going unused, Microsoft radically reimagined the backup utility in...
5 Easy Ways to Build a Bette... |
While large enterprises have the resources of an entire IT department behind them, these...

Infrastructure Optimization

Why Cloud Security Is More E... |
Cloud protection services enable companies to keep up with security threats while...
Ensure Uptime Is in Your Dat... |
Power and cooling solutions support disaster recovery and create cost savings and...
The Value of Converged Infra... |
Improvements in security, management and efficiency are just a few of the benefits CI can...

Networking

Securing the Internet of Thi... |
As excitement around the connected-device future grows, technology vendors seek ways to...
How to Maximize WAN Bandwidt... |
Understand six common problems that plague wide area networks — and how to address them.
Linksys Makes a Comeback in... |
The networking vendor introduced several new Smart Switch products at Interop this week.

Mobile & Wireless

Now that Office for iPad Is... |
After waiting awhile for Microsoft’s productivity suite to arrive, professionals who use...
Visualization Can Help Busin... |
Companies need to put their data in formats that make it consumable anytime, anywhere.
Linksys Makes a Comeback in... |
The networking vendor introduced several new Smart Switch products at Interop this week.

Hardware & Software

Visualization Can Help Busin... |
Companies need to put their data in formats that make it consumable anytime, anywhere.
The Tools That Power Busines... |
Ever-evolving analytic software can greatly improve financial institutions’ decision-...
XP-iration Date: Today Is th... |
It’s officially lights out for Windows XP as an operating system. Here’s how the world is...