How to protect devices that are reliant on Bitlocker and a password without TPM?

Question

In working with a number of non-profit organizations, devices such as laptops used by staff are encrypted using Bitlocker. Unfortunately since the devices (often donated) do not feature TPM, Bitlocker has been enabled using local group policies.

The staff frequent different locations as part of their job. As the devices store sensitive information such as personally identifiable information, financial data, etc, protection of data is paramount. Additionally users often remain logged in to multiple online services such as email e.g. GMail. The loss of the device is secondary from a financial or property perspective.

1. If a device is stolen does the use of Bitlocker without TPM offer a degraded level of security comparatively?
2. If yes, what options are there to protect the data (assume that internet connectivity isn't always possible so access to data from services such as DropBox isn't always feasible. Staff often work on local copies of data)
3. If users remain logged into online services, are these at risk of being compromised should a device be stolen and if users do not log off?
4. In assessing a number of these devices, i have observed that Bitlocker is often suspended and has to be re-enabled manually. Does this increase the risk of data being compromised if a threat actor were to boot the device using a LiveCD for example?
5. Can the device be secured further? If so how? For example, should BIOS passwords be enabled?

A question on how secure a device is when using a pin did not specifically touch on the the questions above.

Answer 1

1. If a device is stolen does the use of Bitlocker without TPM offer a degraded level of security comparatively?

Yes, TPM are used to further protect the master key. Without it, bitlocker security is certainly degraded. Because of the secretive nature of Microsoft, it is impossible to say how much, but it would be recommendable not to trust it.

2. If yes, what options are there to protect the data (assume that internet connectivity isn't always possible so access to data from services such as DropBox isn't always feasible. Staff often work on local copies of data)

Dropbox would not solve your issue anyway. You may want to look for other full disk encryption solutions. I personally use VeraCrypt, but other solutions are available as well. VeraCrypt uses a slow KDF instead of TPM, so as long as you use strong passwords, it will protect the data fine. (Note that if the computer is turned on, there are theoretical attacks such as cold-boot attacks, but these are very hard to pull off. If the computer is logged-in as well, then obviously no amount of encryption will help)

3. If users remain logged into online services, are these at risk of being compromised should a device be stolen and if users do not log off?

Most online services allow you to log out from all computers. This should be done if a device is stolen. Also changing the passwords is advisable, as they may be saved in the browser or elsewhere in the computer. Though if the computer drive is encrypted, there is little risk.

4. In assessing a number of these devices, i have observed that Bitlocker is often suspended and has to be re-enabled manually. Does this increase the risk of data being compromised if a threat actor were to boot the device using a LiveCD for example?

I am unsure about this. It seems to me this should not even really apply for a computer without a TPM.

5. Can the device be secured further? If so how? For example, should BIOS passwords be enabled?

BIOS passwords provide little additional security. I would suggest a good FDE and strong password on boot + mediocre password for windows account. Then use [Windows Key + L] to lock the device whenever going away. The highest risk is often the laptop being snatched when unlocked, as it is by far easiest for the attackers.