6

I very recently had a job interview in which the interviewer asked me how full disk encryption helped improve network security? Initially I believe they are seperate and not linked, FDE is local to the device and network security handles more the network traffic but I wanted to give an answer. As such I stated that it would be helpful for employees who work remotely using company laptops. If the laptop was lost/stollen then if the had the VPN settings and password was saved on it (i.e. in a text file by the user) then the FDE would prevent the attacker from getting it and accessing the network.

Apart from that, how else is full disk encryption related to network security.

7

In case a laptop got stolen, FDE will make sure that:

  • Private keys cannot be stolen (e.g. from a web server, or indeed from a VPN)
  • Stored WiFi password cannot be stolen
  • Other passwords cannot be stolen (from router, switch, etc.)
  • When device registration is mandatory, an attacker could use the already registered device to access the network.
  • 1
    None of the above is true, you know: full disk encryption (if done correctly) will protect all data on a device against direct storage access but it doesn't protect the assets you named in any way from other types of attacks. – Stephane Jan 7 '16 at 10:04
  • @Stephane, what do you mean exactly? In case a laptop gets stolen, the attacker cannot access the private keys, passwords, etc. because of the disk encryption. I am not talking about other attacks, just brainstorming about how FDE could potentially help avoiding network breaches.. – Michael Jan 7 '16 at 10:16
  • I mean that FDE will protect the above asset in only a very narrow range of case: if the asset cannot be obtained in another way AND if the asset is present on the system AND if the asset isn't properly protected already AND if FDE is done properly. Basically, you're just naming a few random things that could be present on a (potentially) stolen device. I'm really not sure what the interviewer wanted as an answer, but the proper way of defining the scope of protection provided by FDE isn't what you've answered – Stephane Jan 7 '16 at 10:21
  • 7
    @Stephane, yes, that was my goal: brainstorming about potential things that could potentially impact network security in potentially bad situations. That does not mean it is incorrect though. So I'm not sure what your comment means for my answer. Anyway, I will update it so that it is clear that I am talking about a stolen laptop case. Still, your comment 'none of the above is true' is erroneous. – Michael Jan 7 '16 at 10:23
0

Aside from the already established laptop case explained by Michael, FDE on your backups would help if your physical backups were stolen.

Really, it only affects physical theft situations.

0

It's an open topic conversation, depending on how it's used. For example if you do an iSCSI mount then yeah, the content will be encryptedly streamed over the network, because you are asking physical sectors and do the decryption in the client. However if say you create a NFS or CIFS server and your client mounts that share, then you have to encrypt your network connection because your flow probably looks like disk->kernel decrypt -> server buffer -> network -> client. Meaning your data is decrypted server side, and shipped plain text over the wire.

Therefore, the answer is , it depends..

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.