Currently the laptops in use are encrypted using Pre-Boot-Authentication, so the entire disk is encrypted. A user has to enter a password before booting the operating system.

A new concept suggests using the laptops TPM to store the key. While the disk itself is still fully encrypted, the boot process continues until the Windows Login Screen without the user entering a password.

On these laptops, USB-drives are not blocked before login and BIOS (tries to) prevent(s) booting from another drive (which can probably be bypassed). In my opinion, this makes the Full-Disk-Encryption as secure as the Windows login screen, which is a considerable downgrade.

The question is:

Is allowing the boot process to continue until the Windows Login Screen without requiring the user to enter a password considered secure?

Which attack vectors can be used and are they just academic problems or reasonably possible?

Assume the laptops are corporate devices, containing potentially sensitive/internal data. I argued that any flaw in the Windows Login Screen effectively kills the Full-Disk-Encryption. Any software like KonBoot may be used to nullify the encryption. A colleague mentioned, that employees leave their devices in sleep mode 80-90% of off-work hours, so it doesn't really matter, even when using the pre-boot-authentication which is currently in place.

  • 2
    Not the topic, but: A colleague mentioned, that employees leave their devices in sleep mode 80-90% of off-work hours, This is the very first thing you need to fix. Eg. by telling them (and following through with it) that certain security procedures needs to be done or they are fired. – deviantfan Aug 10 at 7:37
  • +1 Agreed. I also see this as a crucial problem. Many employees do this out of convenience, as booting the machines takes times (this pre-boot-authentication combined with the absurd Windows startup time is far from optimal). – GxTruth Aug 10 at 7:43
  • 1
    @deviantfan : enforce entering password after "unsleep" is pretty straightforward. – mootmoot Aug 10 at 10:02
  • There is no utility or os you could boot from USB that would be able to read the encrypted drive without providing the password. – user1751825 Aug 10 at 12:00
  • 1
    Windows by default requires a password after sleep. Sleep mode is not a security risk. – user1751825 Aug 10 at 13:04
up vote 2 down vote accepted

In my opinion, this makes the Full-Disk-Encryption as secure as the Windows login screen, which is a considerable downgrade.

Yes. And in a sanely configured, domain joined, patched, laptop, this is fairly secure.

As the disk is encrypted, you can not bypass the login my editing configuration files easily. You can not decrypt the disk if the TPM refuses to unseal, which it should refuse if boot options has changed.

It will reduce security over having to enter a pass code on boot. It will also increase convenience and probably reduce number of support calls. It will for sure thwart opportunistic thieves, that find or steal a laptop without any aim, from discovering the content.

You will have to balance this against who and what you protect. An answer applicable to the budget spreadsheet of Moms & Pop Cornerstore LTD may not be applicable to the engineering drawings of Boeing - to take two extreme examples.

Your Answer

 
discard

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.