Q: For servers running Windows 2008 and up, what would be the most reliable whole disk encryption? We want to protect our data from unauthorized access.

Right now, we used BitLocker. However, the key is still resident in the system and/or MS can decrypt it because they have what it's called: Key Escrow. I've used TruCrypt, but the likelihood of it getting cracked is getting relatively easy. Containers get resided in RAM and can be pulled off. I'm not trying to sound paranoid or worrying about extortion or any other crimes. The key point here is, "protecting data" using Best Practice guidelines.


  • 1
    how do you define 'reliable'? Doesn't crash much, is recoverable after a crash, uses strong crypto, has a company that will be around for a while, is widely used, etc... – atk Feb 19 '14 at 15:23
  • It is currently impractical to have full disk encryption on a server without the key being available at least in RAM. FDE only protects a disk whilst it is unmounted, which is unusual on a server. Technically it is possible due to recent advancements in the fields of Fully Homomorphic Encryption (FHE) and cryptographically secure obfuscation which can protect and operate on data simultaneously, but both are incredibly primitive and not usable for real world purposes. I'm not sure what purpose worrying about keys held in RAM serves or whether or not it is best practice. – jhoyla Feb 19 '14 at 16:23

In terms of "best practices", Full Disk Encryption is designed to mitigate threats to data at rest. For example, FDE can mitigate the risk of a disk being removed from a server and then an attacker attempting to read data from it.

Against an attacker who has access to a powered on server (from which they can extract the key in RAM) most FDE systems are not an effective control (nor are they intended to be).

If you're looking to mitigate the threat of attackers getting access to your running servers then there are other controls you should be looking at.

For the threat of physical access then you need to look at the physical security of the server (e.g. locks on cabinets, access control to server rooms)

For the threat of logical access to the running server, then things like logical access control, patching, firewalls etc are the appropriate mitigations.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.