Microsoft's implementation of BitLocker for hard drive encryption/protection and integrity supports multiple ways to boot into the system. I will list 3:
- TPM chip (those that support it) without Pre-Boot PIN,
- TPM chip with the PIN, and lastly
- Network unlock (basically no PIN but the second authentication is grabbing a key over the network).
In my understanding, there are trade offs with each of these.
- No PIN = less security but it’s not a hassle to the user to type it in every time.
- PIN = more security but more hassle.
- Network unlock = more security and usability but requires management and infrastructure.
We are deciding which one to go with at my company. Management wants to remove the PIN because users are complaining that they have to type a PIN and then be presented to the login screen. I have informed management that requiring a pre-boot PIN stops the OS from loading the BitLocker encryption keys into memory before a valid PIN is entered (halts the boot process). If the PIN is removed, they will be vulnerable to side channel attacks. MS recommends the PIN for this reason. Network unlock turned them off because it requires infrastructure.
I said that if the hosts are not storing sensitive or confidential data and are backed up, removing the PIN is rather low risk because it requires a more advanced attacker (usually) and it's probably not worth it (yes, generalities are bad).
I have two questions.
- Is risk a good way to approach this situation?
- Does my reasoning make sense? I.e. No sensitive data, backed up, other controls, etc then OK to remove the PIN
Lastly I don't have much to stand on, our company is worried about compliance and encrypting hard drives meets that, even if you remove the PIN.