To manage security risks effectively, a non-profit organization has the following high level requirements;
- Limit access to authorized staff.
- Sensitive data is only accessible to authorized staff.
- Data integrity must be maintained.
- Access to data must be auditable.
As a number of staff work off-site, it's important that data is stored securely both on the device in use as well as media such as DVDs and USB sticks/drives.
Historically the devices have used TrueCrypt full disk encryption. As the devices are being retired and refreshed (donations), there is an opportunity to inform the choice and solution to protect the devices.
The staff will be transitioned to Microsoft Windows 10 and OpenSUSE. Deployment of Windows 10 devices is limited due to budgetary considerations. Not all devices support TPM. There are approximately 50 devices of which the majority are non-Windows. Additionally, the editions of Microsoft Windows will be either Home or Professional.
In addition to Veracrypt, there is the option to use Microsoft Bitlocker and LUKS. In researching online, (Full disk options for example), there doesn't appear to be a clear view of the use cases in which the options are best suited for.
For example;
- Should Veracrypt be limited to encrypting removable media?
- When should LUKS be considered?