Full Disk Encryption (FDE)

Why Encrypt the Whole Disk

One of the things that can eliminate a lot of security concerns is full disk encryption.

When we're working with files and folders that we want to make sure remain secure, it's not too difficult to encrypt those. If anything were to ever happen to them, then we know they are still confidential and have not been released, because somebody would have to have the way to decrypt those files and folders.

But there is a problem. Number one, we do have to be intentional about encrypting these files and folders. Number two, it doesn't protect other items on the disk. For instance, we might have the operating system on this disk as well, and somebody could come along and manipulate that operating system, causing the files and folders that are on it to become corrupt or be released when you access them. So this could be problematic, and we'll want to secure the whole disk in most cases.

It's better to encrypt things at the disk or volume level rather than doing it at the folder or file level. By encrypting the whole disk, we can protect all the files and folders on the disk, including the operating system, to make sure no one compromises the operating system.

Software-Based and Hardware-Based Options

There are a couple of different options we have when it comes to full disk encryption. We could do software-based full disk encryption or hardware-based full disk encryption.

Some examples of the software-based would be using programs like TrueCrypt or BestCrypt, which we could install and use, or there are a lot of native tools depending on what operating system you have. As an example, BitLocker on Windows can do full disk encryption, and much of this is actually installed by default nowadays.

From a hardware-based perspective, there are different methods or mechanisms that can create hardware-based full disk encryption. For instance, there's the hard disk drive, HDD FDE, also known as a self-encrypting drive. You can go and buy a specific physical drive that's self-encrypting, and then the hardware on there is what's going to do the encrypting onto that drive.

Getting Access to an Encrypted Drive

When we have a drive that's fully encrypted, one of the problems we have is that we need to be able to still access it. To access it, we need some sort of keys or credentials to gain access into it, so somehow we need to gain that access. When we do full disk encryption and the operating system is on there, we need a mechanism that allows us to log onto that disk and start utilizing it so that it can even boot up the operating system. It's kind of a catch-22: how do we boot up a machine and then type in our credentials without it being able to access that drive until it knows what our credentials are?

There are a couple of mechanisms that will allow us to access the encrypted drive. One is just standard disk encryption, where we have to type in the password every time we start our computer. Before the computer actually has access into that drive, we would have to type in that password, and then it would gain access into that drive and launch.

The other way is some sort of automatic disk encryption. We can do that with something like the TPM. TPM is Trusted Platform Module, and what it does is it has some elements of security into it, because it can verify that this disk is accurate before it actually launches the disk. It also doesn't allow the disk to be decrypted unless it's part of this TPM. So it has kind of a dual purpose there: the disk needs to recognize the machine, essentially, and the machine needs to recognize the disk, before it is able to launch.