I'm buying some new machines and am concerned about security of the data should the machine be physically stolen. It's easy to take out the drive, image it, and read what you want.
I could use file level encryption, but that's insufficient: people will end up not encrypting each file, and, besides, there's too much stored in the swap, page file, logs, registry, caches, etc.
I could use BitLocker, or other OS full disk encryption, but have several issues with this, which I won't go through now. In short, I want something at the hardware level, not software.
Now, Self Encrypting Drives (SED) seem like exactly what I want, but, they're expensive, especially for very large size (which I need) - I can't even find a 1 TB SED SSD. I see that many machines have a BIOS/UEFI "hard drive password", but I can't find very much about it. Is this just a BIOS password with a different name? Is there encryption behind it? Is it a check at the controller level? The disk interface? Will taking the drive out and imaging it bypass it?
If breaking the lock requires replacing drive electronics (ie it's a lock in the drive hardware, but not encrypted), that's sufficient. If it's just a BIOS password which can be defeated with a screwdriver and a SATA bridge, that's a different story.
How secure are BIOS/UEFI hard drive passwords? How do they work? What type of attacks are known against them?