Re: How to Test HDD Encryption

[jfvanmeter () comcast net]

The problem I have with pre-boot is patch management, if you push a patch to a workstation that need to reboot, you 
have to wait for someone to log into the pre-boot for the installation to finish. I know some of the FDE you can 
define, a number of times that you don't need to have a pre-boot so you can push a patch, the workstation can reboot 
and the patch gets applied.

I'm in the process of deploying FDE to 40k workstations/laptops, in addation to support the file base encryption . I 
believe the two plus restrict ACLs on the files will add extract layers of security to protection the NPPI/PII data for 
my client.  

Most of the testing that I've worked on is from a penetration/vulnerability assessment. I don't believe I've cound any 
real one tool to test FDE that I know of. If anyone knows of a good tool, or selection of tools that would be create to 
hear.

Take Care and Have Fun --John
 -------------- Original message ----------------------
From: "Samir Pawaskar" <infosecofficer () gmail com>
> I am using FDE with Pre Boot Logon and a password access to BIOS.
>
>
> Samir
>
>
> On 11/13/07, jfvanmeter () comcast net <jfvanmeter () comcast net> wrote:
> > Hello Samir, you should sign up to the Full Disk Encryption  mail list @
> > http://www.xml-dev.com/mailman/listinfo/fde
> >
> > Here is my two shiny centavos on Full Disk Encryption,
> >
> > I believe it protects the data when its at rest, but once the OS is
> > mounted then all bets are off because the OS is now handling access to any
> > file. So you would need some type of file encryption software like PGP or
> > EFS.
> >
> > If you don't use a pre-boot log on, if I have access to the laptop  I
> > could boot to an alternative OS, reset the administrators password, reboot,
> > log in as the administrator and have full access to the files.
> >
> > Again this is just my two shiny centavos --John
> >
> > -------------- Original message ----------------------
> > From: infosecofficer () gmail com
> > > Hi
> > >
> > >
> > >
> > > How can we ascertain that the encryption software we have selected is
> > doing its
> > > jobs.
> > >
> > > A small test like removing the hdd of an encrypted laptop and attaching
> > it as an
> > > external drive on another laptop shows the drive as unformatted. So far
> > So
> > > Good..
> > >
> > >
> > >
> > > But is there any tool available to demonstrate to the management that
> > even the
> > > professionals cannot break in even if they lay their hands on the drive
> > > physically.
> > >
> > >
> > >
> > > I am basically trying to make a case to push for drive encryption in our
> > > organization.
> > >
> > >
> > >
> > > Please group suggest something.....
> > >
> > >
> > >
> > >
> > >
> > > Best Regards
> > >
> > >
> > >
> > > Samir


> --- Begin Message ---
>
>
> From: "Samir Pawaskar" <infosecofficer () gmail com>
>
> Date: Thu, 15 Nov 2007 05:34:51 +0000
>
>  
> --- End Message ---