BitLocker Drive Encryption

In Windows XP and previous NT-based versions of Windows, Microsoft offered a feature called Encrypting File System (EFS) that enabled users to encrypt important folders or files. This prevents thieves from accessing sensitive data should your computer be physically stolen: If the thief removes your hard drive and attaches it to a different computer, any encrypted files cannot be read. EFS has proven to be a popular feature with businesses that have many roaming executives with laptops, with IT administrators, and the security conscious. EFS is still present in Windows Vista and works as before, but it’s been augmented by a new technology called BitLocker. Like EFS, the new BitLocker feature in Windows Vista lets you encrypt data on your hard drive to protect it in the event of physical theft. But BitLocker offers a few unique twists. First, BitLocker is full-disk encryption, not per-file encryption. If you enable BitLocker, it will encrypt the entire hard disk on which Windows Vista resides, and all future files that are added to that drive are silently encrypted as well. Second, BitLocker protects vital Windows system files during bootup: If BitLocker discovers a security risk, such as a change to the BIOS or any startup files (which might indicate that the hard drive was stolen and placed in a different machine), it will lock the system until you enter your BitLocker recovery key or password (discussed shortly). Third, BitLocker works in conjunction with new Trusted Platform Module (TPM) security hardware in some modern PCs to provide a more secure solution than is possible with a software-only encryption routine. BitLocker may not be theoretically impregnable, but in the real world the chances are that no hacker will ever defeat a BitLocker-protected PC. BitLocker is available only to users of Windows Vista Enterprise and Ultimate editions. There isn’t a heck of a lot of configuration you can do for BitLocker. It’s either on or it’s not, and you either have TPM hardware or you don’t: If your system does have TPM hardware, BitLocker will use it. Otherwise, you must use a USB memory drive as a Startup Key. This key will be required to boot the system. If you don’t have the key, or you lose it, you will need to enter a recovery password to access the drive. Here’s where things get tricky: You can print out the recovery password and store it in a safe place, like a physical safe or safety deposit box. Or you can store it on a different computer in a text file, perhaps in an encrypted folder or encrypting ZIP file. However you store the recovery password, you can’t lose it. If you lose both the startup key (either in the TPM hardware or on a USB memory key) and the recovery password, the data on the BitLocker-protected hard drive is gone for good. There is literally no other recovery option available. Still undaunted?

You enable BitLocker by navigating to the BitLocker Drive Encryption tool in Control Panel. This is located in Control Panel -> Security -> BitLocker Drive Encryption. Shown in article 8-11, there’s not much to it. To enable BitLocker, simply click the Turn On BitLocker option. If you have the appropriate TPM hardware, BitLocker will save its encryption and decryption keys in that hardware. Otherwise, you’ll be prompted to insert a USB memory key, which you’ll need to insert in the machine every time it boots up. Optionally, you can also create a startup key or PIN to provide an additional layer of protection. The PIN is any number from four to 20 digits. The startup key and PIN can only be enabled the first time you enable BitLocker. When BitLocker is enabled - which takes quite a bit of time, incidentally, because it must encrypt the contents of the drive - you don’t have to do much configuration-wise. You’ll see a new Manage Keys link in the BitLocker Drive Encryption control panel, and you can create a recovery password from there. If you choose to print the password, be sure to save it in safe place. Seriously.

Low-Level Security Features Windows Vista includes a vast array of low-level security features. One of the most dramatic is service hardening. Because of the modular architecture of Windows Vista, the system has been created in such a way that the components that make up the system are as isolated from and independent of each other as is possible. Furthermore, Microsoft has gone over each of these components to ensure that they are running under the lowest possible security privileges. This protection extends to the system services that run silently in the background. While none of these features are particularly configurable, it’s fair to say that Windows Vista is the most secure Windows version ever made, thanks to the sum of these many security enhancements. To get the absolute best security with Windows Vista, run one of the x64 versions of the operating system. ( 1 for information about choosing between x64- and x86/32-bit versions of Windows Vista.) That’s because the x64 versions of Windows Vista include a few unique security features that are not available or as effective in the 32-bit versions of the operating system. These include:

   • A  new feature called Address Space Layout Randomization (ASLR) that randomly
    loads key system files  in memory, making them harder to attack remotely.
   • A  hardware-backed version of Data Execution Protection (DEP) that helps prevent
    buffer overflow-based  attacks.
   • x64  drivers must be digitally signed, which suggests (but doesn’t ensure) that
    x64 drivers will be  more stable and secure than 32-bit drivers, which are often
    the cause of  instability issues in Windows.

Of course, x64 versions of Windows Vista have their own compatibility issues, both with software and hardware. The tradeoff is yours to make: Better security and reliability or compatibility.

Summary Although much is made of Vista’s new user interface, its new security features are, beyond a doubt, the number one reason to consider upgrading to this new operating system. Here’s why: Although it’s possible to duplicate many of the end user features in Windows Vista, its many security improvements are only available to those who upgrade. Security isn’t something that’s easy to sell, per se, and certainly vulnerabilities will crop up over time. But make no mistake: Vista’s security improvements are as dramatic as they are important.