In working with a number of non-profit organizations, devices such as laptops used by staff are encrypted using Bitlocker. Unfortunately since the devices (often donated) do not feature TPM, Bitlocker has been enabled using local group policies.
The staff frequent different locations as part of their job. As the devices store sensitive information such as personally identifiable information, financial data, etc, protection of data is paramount. Additionally users often remain logged in to multiple online services such as email e.g. GMail. The loss of the device is secondary from a financial or property perspective.
- If a device is stolen does the use of Bitlocker without TPM offer a degraded level of security comparatively?
- If yes, what options are there to protect the data (assume that internet connectivity isn't always possible so access to data from services such as DropBox isn't always feasible. Staff often work on local copies of data)
- If users remain logged into online services, are these at risk of being compromised should a device be stolen and if users do not log off?
- In assessing a number of these devices, i have observed that Bitlocker is often suspended and has to be re-enabled manually. Does this increase the risk of data being compromised if a threat actor were to boot the device using a LiveCD for example?
- Can the device be secured further? If so how? For example, should BIOS passwords be enabled?
A question on how secure a device is when using a pin did not specifically touch on the the questions above.