0

I read How secure are most FDE implementations?

What are the disadvantage of only encrypting the HDD compared to FDE with secure boot.

If I encrypt a disk in a running server, and someone gain access to the machine (because login to the machine was not hardened enough), can that person steal my data?

Is asking for authentication (to access the HDD) after every login a solution to this problem (given I have a SSD to run linux and a separate HDD to store data)?

2
  • What do you mean by encrypting the HDD? Partition encryption?
    – saurabh
    Jul 3, 2021 at 11:12
  • yes, I meant partition encryption. Jul 3, 2021 at 12:02

2 Answers 2

1

What are the disadvantage of only encrypting the HDD compared to FDE with secure boot.

Some one can change your / (i.e) system or UEFI or kernel - so that it logs the all your keyboard inputs and sends it elsewhere (or come back later) to know your password etc. Example: replace all the "system" installed programs (like firefox) with a 'evil-one' that passes on all info outside.

Is asking for authentication (to access the HDD) after every login a solution to this problem (given I have a SSD to run linux and a separate HDD to store data)?

Will keep thing secure but to certain extent. Are sure no one will physically access your device and tamper with SSD?

I read How secure are most FDE implementations?

Like everything in IT - varied. For example, in chrome os, any change to any partition will delete the data partition. By properly configuring UEFI/TPM you can do this for any device but lot of work. There are a lot of talks from Matthew Garrett on this topic (relating to Linux). Example: https://www.youtube.com/watch?v=FobfM9S9xSI

1

Secure boot (With TPM) will save you from attacks like evil maid, Modifying bootloader, Key leaking etc.

FDE on the other hand will provide you protection from data leakage in better way comparatively from Partition based encryption. For e.g. in partition based encryption some file can end up in temporary storage and can be recovered if HD is stolen.

Now the second question where you mention that what if you encrypt the partition and someone has access to running server? In this case, if the partition is already decrypted, anyone with sufficient privileges can access all the content of the partition.

If you put a password based protection on partition, it will protect data until you do not decrypt the partition with password. So, this can provide you some protection. You just have to make sure to use partition on need basis and as soon as your work is complete unmount the drive.

However, even in this case if someone access running server then they can install the keylogger and get the password.

With FDE and secure boot, once the system is up, the logged-in user will have access to the data (depending on the privileges) since the whole drive is decrypted . So, if you want some level of restriction there as well, you can configure FDE+Secure Boot + encrypted folder. Wherein for accessing the folder after secure boot requires password. This use case is useful if you share a machine with multiple user.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .