1

The problem with encryption is that it becomes slower:

https://askubuntu.com/questions/23489/what-is-the-performance-overhead-of-encrypted-home

It especially is important when you develop symfony applications, because symfony is slowest framework for development I have seen so far.

If you do not encrypt and your computer is stolen, then as I understand even if you have password when logging in to linux, somebody can load their own operating system and see unencrypted files, right?

If we know that computer is protected - like you do not move the computer from office and office has security system, then maybe it is not a problem. But if you move your laptop everywhere, then the risk increases.

  • 3
    Have you actually tried measuring performance? I'm very skeptical this would actually affect you in a meaningful way. – AndrolGenhald Feb 9 '18 at 18:54
  • Not yet, but was considering. – Darius.V Feb 10 '18 at 7:52
1

The "cost" of encrypting the drive should be minimal on any laptop useful for business/development in the last 5-10 years. The link you provide is 7 years old - are you really using 7 year old development devices?

Consider that many industries absolutely require all storage to be encrypted. I currently work in the health sector and we certainly require all devices - even those permanently in offices - to be fully encrypted along with all removable media. There are very few offices that you could really consider secure. I've seen offices emptied of kit even though they were alarmed and secured.

The other consideration is whether your devices have hardware encryption capabilities. All modern enterprise devices will have a TPM chip that will help offset the overheads.

Finally, even if you don't think that your code and IP is worth the overheads of encryption, consider personal data - contacts, calendar (where you and others are), finances and so on. Certainly if you operate in the EU, you HAVE to keep personal data secured - this is going to get even more personal and expensive to mess with as GDPR is introduced.

Not worth the risks - just encrypt and be done with it.

  • Actually I am using my laptop ACER 5749Z for development since became working as freelancer, it is 5 years old, but at the time it was cheap already :) but on the other hand - does encryption not start using stronger algorithms as computers become more powerful? Otherwise with powerful computers if it used 7 years old encyption then maybe it is easy to crack? – Darius.V Feb 10 '18 at 7:55
  • 1
    @Darius.V The encryption of 7 years ago is the same encryption used today. The only real difference is that we switched many years ago from DES to AES. One thing to note though is that AES is not only more secure than DES, but it is actually faster! – forest Feb 10 '18 at 10:32
  • I hope you don't take this the wrong way but if I hired a contract developer (which I do) and they turned up with a cheap 5 yo computer to work on, I would be very suspicious of their capabilities. Rather like hiring someone to fix your roof and they turn up in a beat-up 20 yo rusty van. You are asking your customers to trust you with important data but you are not demonstrating trustworthiness. Also, if you worked for me, in common with all regulated industries, you would be required to have an encrypted drive, up-to-date AV, etc. – Julian Knight Feb 10 '18 at 20:40
  • @forest - maybe its same AES, but are bits the same? I heard that there are like 128, 256 and so on encryptions. So the more bits, the more processing power needs for encryption and cracking. – Darius.V Feb 11 '18 at 10:55
  • @Julian Knight - I was really considering to buy new computer. I just hate that it will take long time to reinstall everything. But I still need to think about it, ask about other pages how long it takes to load in their computers and compare to my, if that is significant difference, then buy new, especially after first payment. – Darius.V Feb 11 '18 at 10:56
1

somebody can load their own operating system and see unencrypted files, right?

Yes. If you are not using encryption and an attacker gets access to your hardware, they get access to all your data.

Should we store web application files when we are constantly developing in encrypted directory?

That really depends.

If this is a larger company, there should be a policy in place about this. Ask the relevant people about it.

If this is a small company and you are the one responsible for the decision, you need to weight the factors.

  • What is the cost of stolen source code? ie: How important is your source code? Is it open-source anyways? Is it something someone else could actually use? Or is it highly specialized software that is unlikely to be useful for anyone? Do you depend on the source being secret for security reasons (security through obscurity)? If the source is stolen, can you use other measures to punish the thief (legal avenues, etc)?
  • On the other hand, what is the cost of encryption? Have you measured the performance (my guess is that with decent laptops, it shouldn't be a problem)? How many hours would your developers loose if you used encryption?

After you weighted these factors, you should have an answer.

You could also try to find a middle ground. Eg have two laptops/computers. One encrypted which developers can take where ever they want, and one unecrypted that can only be in the office (ideally a desktop computer, so they are not accidentally removing it). This assumes that the source isn't so important that someone would break into the office (but if we assume that someone would to that, we could also assume that someone might tamper with an encrypted laptop to log the password).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.