Should you encrypt sensitive files even with FDE?

Question

I'm in the process of trying to make my current laptop setup more secure, especially I'm planning to finally use FDE and enable Secure Boot. However, I'm still unsure on how to handle sensitive, personal files, in particular: Does it make sense from a security perspective to store them encrypted (e.g. by manually encrypting them with something like age) on the already encrypted hard drive?

As far as I understood, FDE encryption is mainly useful, if your laptop gets stolen or getting into repair, so as a protection if the attacker has physical access. But let's say some malware ends on my laptop, then, since the unencrypted data from the disk is accessible when the system is running, the FDE does not offer any protection against my data being stolen by it. (Please correct me if I'm misunderstanding something there.) Would it increase security in this case to encrypt my personal files, so that they stay encrypted, even when the system is running? Or is this futile anyway, because the malware could theoretically log the password when I'm decrypting a personal file? (And if it is, is there any other way to prevent my data in case my laptop is compromised?)

Answer 1

It makes perfect sense to encrypt individual files even if you already use full-disk encryption.

As you correctly point out, FDE only protects data at rest as long as the system is locked. Afterwards, the data is automatically decrypted on-demand.

If you want to protect data while the system is unlocked, you can use encryption on top of FDE. However, this really only makes sense if you keep this data encrypted most of the time and only decrypt it when necessary.

To avoid a compromise of your encryption key (or underlying password), keep the key on separate hardware, e.g., on a smartcard or a specialized USB token which supports non-exportable keys.

Answer 2

As far as I understood, FDE encryption is mainly useful, if your laptop gets stolen or getting into repair, so as a protection if the attacker has physical access. But let's say some malware ends on my laptop, then, since the unencrypted data from the disk is accessible when the system is running, the FDE does not offer any protection against my data being stolen by it.

That's correct. So if you wanted extra protection the you could encrypt sensitive files outside of FDE. There are lots of threats that fall short of being able to access your decryption password, so this would still provide effective protection.