4

I'm using Windows 10 Pro edition and took the following actions:

  • I've set up Bitlocker on both disks using the TPM (2.0) to boot the computer.
  • I've also set a Windows password and I have no guest account on my computer.
  • I lock my session with Windows + L as soon as I leave my computer unattended.

I've read this as I was wondering about the point of TPM-based BitLocker if the disk gets decrypted automatically at boot time.

My main concern is about random computer loss or theft leading to data unauthorized access, not NSA-proof protection. Do I need to set up or config anything else?

Improve this question

2 Answers 2

Reset to default
2

The benefit of having Bitlocker with a TPM in that scenario is that the hard drive is encrypted at rest. If the computer is stolen, for the thief to get any benefit, it would have to be stolen while the computer was turned on, with the password or key entered at boot time. But if the computer was turned off at the time it was stolen, there would be no use sticking in a USB with its own OS on it and trying to read the hard drive, because the hard drive is encrypted. The only other avenues of attack might be for the thief to guess the password, or steal the bootup key (plausible if the rightful owner stored the bootup key on a USB stick in the laptop case), or possibly a direct attack on the TPM hardware.

Improve this answer
2
  • thanks! So I just need a long robust enough Windows password and I'm good to go!
    – syl.fabre
    Apr 9, 2018 at 7:46
  • 1
    OP said the disk gets decrypted automatically, which presumably means no password or pin.
    – AndrolGenhald
    Apr 9, 2018 at 13:10
1

If you'd like to make the disk useless to thieves (as in hardware value), you should consider a disk drive password (part of the ATA specification). It's a bit more simple than Bitlocker, doesn't have the performance penalty, however it doesn't encrypt your disk content, and a really determined/serious attacker would be able to read your files.

So why not combine it with Bitlocker (and obviously TPM), that way you shouldn't be worried about someone being able to reuse the disk drive after they have stolen it (you can't just reformat it), and with Bitlocker they won't be able to forensically read your files as well.

The downside is that you'll need two passwords... but hey, security doesn't always come cheap :-)

Improve this answer
4
  • hardware value is not my main concern. And the simpler the better so my colleagues will comply with the security policy :)
    – syl.fabre
    Apr 9, 2018 at 7:48
  • In that case I'd suggest activating the guest account, and deploying an additional software (such as Prey preyproject.com) so you can track it if stolen and in use. A guest account will allow the thief to login to "look around" (they're invariably curios and most are careless), while you are able to track it and potentially connect to it to do a few things (such as record their faces using the built in camera, if it's a laptop). Suggest watching Zoz' Defon 18 talk (DEFCON 18: Pwned By The Owner: What Happens When You Steal a Hacker's Computer) for the LoLz and a few tips/ideas.
    – Milen
    Apr 9, 2018 at 19:31
  • yes but if they can access this guest account then they can read the data as the disk is decrypted at boot with a TPM-based BitLocker or I'm wrong?
    – syl.fabre
    Apr 9, 2018 at 21:04
  • They won't be able to access your data, your profile and associated information can be encrypted using your account's keys (which requires you to login before it's decrypted), so if it's done properly, you don't have to worry about it.
    – Milen
    Apr 9, 2018 at 21:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .