2

AFAIK, the general advice is to encrypt the whole HDD or at least the whole /home partition (and its Windows equivalent), because nowadays computers tend to store lots of personal, sensitive information and it would be a tragedy if someone manages to steal a laptop. The possibilities of frauds, blackmails, identity thefts, etc., in such a case are endless.

It is hard to argue against this. However, there still remains one problem: ANY HDD failure, even a flip of one measly bit, means the loss of all data. Even if someone is rigorous and makes a backup copy every month, the loss of a whole month of work is still unacceptable.

Personally, until now, I've never been victim of computer thievery. However, I've experienced HDD and even SSD failures many times. In all such cases I've been still able to recover the vast majority of data of these HDDs and SSDs that were not encrypted.

Admittedly, these experiences make it hard for me to explain to myself why sticking to this general advice is a good idea.

3

That's not how full disk encryption works. Corruption of one bit of ciphertext will only corrupt a single disk block (usually 512 bytes). See https://en.wikipedia.org/wiki/Disk_encryption_theory. Most modern FDE schemes use XTS mode.

2

You must balance between the risk of data loss and of data leak. And define what threat you want to mitigate: if it includes the risk of physical theft of the computer, data will be lost anyway so you must have backups.

But as usual in security, it really depends on the threat. For example in the organization I'm working in, only laptop HDDs are encrypted and not desktop ones, because the risk analyze concludes that for desktop the risk for data corruption is higher than the risk of theft, while it is the opposite for laptops. And laptop owners are provided with procedures for on server frequent backups (normally once a day).

0

Yes as part of your overall management philosophy. That also involves having protected storage so no corporate data gets lost in the event of HD failure.

Use of this also involves risk assessment. What's more likely to be stolen? I'd be more adamant about encrypting laptop drives than workstation drives. As part of this is the expectation and training to store everything on corporate storage.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.