Calculating the Cost of Full Disk Encryption 242
CowboyRobot writes "Is full disk encryption (FDE) worth it? A recent study conducted by the Ponemon Institute shows that the expected benefits of FDE exceed cost by a factor ranging from 4 to 20, based on a reduction in the probability that data will be compromised as the result of the loss or theft of a digital device. 'After doing all of the math, Ponemon found that the cost of FDE on laptop and desktop computers in the U.S. per year was $235, while the cost savings from reduced data breach exposure was $4,650.'"
Re:One click for $235 (Score:5, Insightful)
The TCO of is more than the cost of installing it.
User still a risk point (Score:5, Insightful)
Passwords written on desks, stuck to the screen etc are common in many places. Sending files off-network to places like dropbox or email to get around security 'hassles' is widespread. The owner of my current firm wants to use an iPad, because we won't let it on network he does most email from a web email account!
FDE with rubbish passwords is entirely pointless as anyone with motivation to get in can. If you start requiring complex passwords the risk of people writing it down and storing it with the PC increases. We need to stop thinking about security as a technical issue and work out how to produce 'secure enough' systems which users don't subvert or misuse.
If removing security breaches is worth nearly $5k a year then surely using some kind of RFID security card that must be near the PC/Laptop to unlock would be cost effective. I could keep it in my wallet or as a keyring. Even better would be combine it with a RSA style password device for two-factor authentication when providing a password (thus making less complex passwords less of an issue).
Re:Truecrypt TCO (Score:4, Insightful)
Truecrypt is fantastic software. I find it's a lot easier to use and understand than Microsoft's Bitlocker (What's that about a TPM module? Do I need a USB stick or not? So many questions!) and it just works.
I'm rich! (Score:4, Insightful)
...$235, while the cost savings from reduced data breach exposure was $4,650.
I've got an old laptop lying around that's not doing anything.
Last thing I did with it was a clean install of a win8 beta.
You say if I encrypt it's harddisk, it saves me over four thousand US$?
Re:One click for $235 (Score:5, Insightful)
No kidding (Score:5, Insightful)
In a corporate environment, you have to have some kind of key management system. You can't do FDE with a free utility that is just "Enter the password to get in to the computer." Well why not? Tow big reasons:
1) What if the person suddenly up and dies, and you need to get at the data? A backup won't help if said backup is also encrypted with the same password that only they knew. You need to have a system to get in.
2) More commonly, what do you do when a user forgets their password? This happens ALL the fucking time. People cannot remember passwords, just how it is. Just losing data is not an acceptable answer, so you have to have a system that can get in.
Now there are systems out there like that. They have central key stores, key recovery facilities and so on all while maintaining cryptographic security. However all the ones I've seen cost money. Then on top of that is the cost of administering such a system.
As an example at work a lady forgot her password, as she is known to do on days ending in "y". So she couldn't get in the encrypted laptop that has key codes for the doors (she deals with that). She also hadn't put the laptop on the 'net in like a year, so it was all desync'd with the Active Directory. This meant my boss couldn't log in to do any kind of override. So he had to hook it up, go through this key recovery thing where the console give you a bigass key to enter in to the system, then get it to sync passwords, then he could log in and get everything working. Took a fair bit of time to do.
You have to count all that kind of thing in cost calculations. You can't pretend like it isn't a cost. Yes you already pay his salary but he has about 5,000 other thing to be doing that weren't being done while he worked on that. Needless to say if this were being used for more than a couple systems (we only use it in special cases) it would quickly need one or more people who's job was to administer it and deal with all the problems caused by it (meaning by users).
Re:One click for $235 (Score:5, Insightful)
That's kind of a flawed way to look at things imo (no offence intented).
Having 99 locks on the frontdoor is indeed pointless, but that's because all those locks perform the same function. Using (for example) a virusscanner, a firewall and full disk encryption is more akin to having both a lock on the frontdoor but also a fire extinquisher in the hallway. It's a very sane and generally smart thing to have.
On a sidenote, having 2 (different) locks on a door may very well be a smart thing, because a Type A lock has different flaws than a type B lock. Having 2 different kinds means you potentially eliminate a variety of easy exploits that target a specific type of lock. I don't know where the "line" is but i find it hard to imagine more than 2 or 3 locks being a sane scenario for "regular" entrances.
Now it's obviously true that every security measure brings with it a "penalty" if you will, to legit users. For most locks this means the user has to carry a key on him, something most people in the west consider normal and not a high price to pay. Having to remember a PIN code to use your debit card is also a penalty on legit accountholders, but we accept it. Now wether or not full disk encryption is as pricey as the article seems to make out, i dunno, but lets look at the alternatives.
A) Unencrypted drives
B) Certain Encrypted drives/containers/shares/whatever
C) Full Disk encryption
In this day and age (dare i say it, the Information Age) there is a definite demand for encrypting sensitive and important data for almost everyone but the most untrained pc user. This makes option A a bad choice for almost everyone which means the decision is not just about "should we use FDE or not", it becomes "do we encrypt EVERYTHING or just cetain objects" and in order to make that determination you need to look at the price for both.
Let's not forget, simply enabling FDE is a minor act for the sysadmin whose installating the system, and since FDE is transparent to userspace applications, there is very little additional configuration or problems that arrise due to it. It will impact performance of the hardware, however one can take this into account during the purchase of new machine(s) and simply take a slightly faster system to make up for it (if that's even needed, usually it ain't). Only encrypting certain partitions, shares or folders means you have to deal with many additional administrative and training issues. How do you prevent ppl from moving sensitive files from the secure X:\ drive to the C:\ drive, how do you teach the (presumably non-IT) users where they can store which files. Which policies have to be enforced to ensure it all stays on the level. How often (if at all) do you audit the systems for "leaked" senstive files, etc.
I'm not a sysadmin myself, but i do work in IT and have a fair understanding on their job, and to me at a quick glance it appears FDE is a LOT cheaper and easier for everyone involved than encrypting only sensitive files.
it depends (Score:4, Insightful)
Re:Truecrypt FTW (Score:5, Insightful)
Re:Truecrypt FTW (Score:5, Insightful)
And in your fantasy, does the Lady Cop say "Oh, Mr Neckbeard, your fingering is so... virile," then bow-chicka-wow?
There's nothing so sad as preparing for an apocalyptic showdown with The Man, when The Man could not possibly care less about you or your data. Encrypt, don't encrypt, you've got more chance of being eaten by badgers than subjected to a search-and-seizure.
Re:One click for $235 (Score:4, Insightful)
OK. MD leaves his laptop at airport/side of road/in car that is stolen. He has competitive-advantage generating information on there, that would be worth millions of dollars in contracts to a competitor.
We've had staff have laptops stolen, with data like that on them in the past. Do we know that the data was let into the wrong hands? Nope. But it could have been.
Funny view you have there (Score:2, Insightful)
In our (European) company FDE was rolled-out because we are obliged to protect customer information.
No, not because company was scared of the penalties.
It's kind of funny how US businesses quantify it all.
Re:No kidding (Score:5, Insightful)
Now there are systems out there like that. They have central key stores, key recovery facilities and so on all while maintaining cryptographic security. However all the ones I've seen cost money. Then on top of that is the cost of administering such a system.
Security only costs extra if you had nothing to begin with, which basically never happens. Any corporation with data worth stealing is likely to have Active Directory, which has a convenient key escrow functionality built right in.
If you've already purchased Windows Server and have standardized on Windows 7, then full disk encryption with all the goodies is just a few button clicks away, and costs nothing but the 60 minutes it takes to read through the relevant technet articles and then setting a few settings in group policy.
She also hadn't put the laptop on the 'net in like a year, so it was all desync'd with the Active Directory.
That's not her fault, that's the IT department's fault. That laptop can't possibly have been properly patched, its data synchronized, or up-to-date security policies applied. That should have rung alarm bells in the system, or locked her out until she did synchronize successfully.
Which can be done wirelessly these days. From home. Using transparent VPNs that require zero user interaction. All of which can be monitored centrally.
So he had to hook it up, go through this key recovery thing where the console give you a bigass key to enter in to the system, then get it to sync passwords, then he could log in and get everything working.
Wait, wait, wait.. let me get this straight: she failed to authenticate properly with the system for something like a year, which then correctly locked her out after the timeout expired, protected the data on her laptop, allowed you to recover the data as designed, and all of this required just a few minutes of typing? And to top that off, the security system insisted that her hopelessly out-of-date credentials cache be updated to verify her account?
OH MY GOD THE HORROR! The hassle! Why doesn't the crypto system just fall dead and recognize how important this lady is and unlock all of her data, despite her ongoing blatant violation of IT security policy! The nerve of Microsoft for designing such a thing! Next thing you know, they'll insist that you use passwords to log on to computers! Can you imagine?! We just won't be able to get any work done around here any more!
Clearly this is all just a giant conspiracy to drain valuable IT resources.
You have to count all that kind of thing in cost calculations.
Additional electricity due to use of AD Policy Driven Bitlocker encryption: $57.35
One hour support call to fix non-compliant user's locked out system: $197.50
Incompetent IT team: $457,350.00
Potential lawsuit due to leaking user data: Priceless.
Yes, you do have to factor that kind of thing in, you're right.
Re:Real Costs (Score:4, Insightful)
According to the article, they're the average actual losses, not potential. If the potential losses were $4650 and the actual annual cost of FDE was $235, then you'd need to believe that every computer has a 5% chance of being stolen and exploited every year in order for FDE to be worth it; the article would have to conclude that FDE isn't worth it for the average machine in that case.
By ginning up a ludicrously overstated actual loss, though, they're able to make FDE look like a total bargain--at least until you start thinking about it enough to realize the numbers are cooked.
Re:Truecrypt FTW (Score:5, Insightful)
Warranty void if unencrypted (Score:3, Insightful)
As far as I'm concerned, storing any confidential data on a hard disk unencrypted effectively voids the warranty, because there's no way I'm going to send a drive containing sensitive data away for warranty replacement.
Re:One click for $235 (Score:5, Insightful)
I've gone paperless, so I have tax returns, medical info, SSNs, etc on my laptop. Full Disk Encryption means I don't have to worry about it.
With FDE, you have to decrypt it every time you use the computer, so you're not going to forget the password. If you're worried about that, put the password on a piece of paper in a safe deposit box or some other type of storage at home.
Re:One click for $235 (Score:4, Insightful)
If the information is that sensitive then what is it doing on a portable device in the first place...?
I don't have information that sensitive by a long shot. But I'm currently a contractor who provides my own laptop and I do have some of my employer's sensitive information - pricing plans, campaign strategies, etc. - on my personal computer because that's what I use to do the work for them. I have OS X's full drive encryption enabled and a two-day-old encrypted Time Machine backup at my house. If my laptop gets stolen on the BART, bummer. I have to go fill out a police report, file an insurance claim, and do other inconvenient stuff. And when I bring my new laptop home, I restore it from the backup and I'm up and running again a couple of hours later. The thief has my hardware but not a single byte of my personal or employer's information.
That's a nice situation to be in. If I did lose my laptop, I can tell my supervisor "sorry for the inconvenience while I get a replacement. Don't worry, though; your stuff is locked up and the thief can't get to it." That is infinitely preferable to the alternative of "umm, we might have a problem."