1

In working with a number of non-profit organizations, devices such as laptops used by staff are encrypted using Bitlocker. Unfortunately since the devices (often donated) do not feature TPM, Bitlocker has been enabled using local group policies.

The staff frequent different locations as part of their job. As the devices store sensitive information such as personally identifiable information, financial data, etc, protection of data is paramount. Additionally users often remain logged in to multiple online services such as email e.g. GMail. The loss of the device is secondary from a financial or property perspective.

  1. If a device is stolen does the use of Bitlocker without TPM offer a degraded level of security comparatively?
  2. If yes, what options are there to protect the data (assume that internet connectivity isn't always possible so access to data from services such as DropBox isn't always feasible. Staff often work on local copies of data)
  3. If users remain logged into online services, are these at risk of being compromised should a device be stolen and if users do not log off?
  4. In assessing a number of these devices, i have observed that Bitlocker is often suspended and has to be re-enabled manually. Does this increase the risk of data being compromised if a threat actor were to boot the device using a LiveCD for example?
  5. Can the device be secured further? If so how? For example, should BIOS passwords be enabled?

A question on how secure a device is when using a pin did not specifically touch on the the questions above.

1
  1. If a device is stolen does the use of Bitlocker without TPM offer a degraded level of security comparatively?

Yes, TPM are used to further protect the master key. Without it, bitlocker security is certainly degraded. Because of the secretive nature of Microsoft, it is impossible to say how much, but it would be recommendable not to trust it.

  1. If yes, what options are there to protect the data (assume that internet connectivity isn't always possible so access to data from services such as DropBox isn't always feasible. Staff often work on local copies of data)

Dropbox would not solve your issue anyway. You may want to look for other full disk encryption solutions. I personally use VeraCrypt, but other solutions are available as well. VeraCrypt uses a slow KDF instead of TPM, so as long as you use strong passwords, it will protect the data fine. (Note that if the computer is turned on, there are theoretical attacks such as cold-boot attacks, but these are very hard to pull off. If the computer is logged-in as well, then obviously no amount of encryption will help)

  1. If users remain logged into online services, are these at risk of being compromised should a device be stolen and if users do not log off?

Most online services allow you to log out from all computers. This should be done if a device is stolen. Also changing the passwords is advisable, as they may be saved in the browser or elsewhere in the computer. Though if the computer drive is encrypted, there is little risk.

  1. In assessing a number of these devices, i have observed that Bitlocker is often suspended and has to be re-enabled manually. Does this increase the risk of data being compromised if a threat actor were to boot the device using a LiveCD for example?

I am unsure about this. It seems to me this should not even really apply for a computer without a TPM.

  1. Can the device be secured further? If so how? For example, should BIOS passwords be enabled?

BIOS passwords provide little additional security. I would suggest a good FDE and strong password on boot + mediocre password for windows account. Then use [Windows Key + L] to lock the device whenever going away. The highest risk is often the laptop being snatched when unlocked, as it is by far easiest for the attackers.

  • Thanks. Given that Veracrypt isn't fully featured yet to support UEFI and GPT and without this question becoming a topic of software recommendations, what other options are there? – Motivated Oct 14 '18 at 15:36
  • If the disk is encrypted via BitLocker using a password, what is the severity of the risk if users remain logged in to the device? There may not always be the opportunity to change the passwords immediately. – Motivated Oct 14 '18 at 15:38
  • What do you mean by "It seems to me this should not even really apply for a computer without a TPM."? – Motivated Oct 14 '18 at 15:38
  • @Motivated I honestly am not an expert on the different products on the market. Have not really studied any other solution in depth enough to make a recommendation other than VeraCrypt. – Peter Harmann Oct 14 '18 at 17:11
  • @Motivated If you mean the device being unlocked (without needing a password), then obviously bitlocker is almost entirely negated. The attacker can just grab any information he wants before the computer locks itself. If you mean the logged in but locked, then the risks are not as large. The most prominent being a cold boot attack, which is very complicated to pull of. If you mean logged to online services, this should not matter as long as the attacker can not decrypt the device. – Peter Harmann Oct 14 '18 at 17:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.