3 ms·
The advice on FDE is misleading if not flat out wrong. It's NOT just to protect against media theft. It's also about "shit, the drive crashed. How do I destroy
by knorker 10y ago
The advice on FDE is misleading if not flat out wrong. It's NOT just to protect against media theft. It's also about "shit, the drive crashed. How do I destroy the data on it before throwing it in the trash?"
Same with replacing a smaller drive with a bigger drive. Yes, DBAN it, but that won't take care of remapped sectors.
It's easier to destroy an encryption key than it is to destroy the data.
- rzzzt 10y agoTo the point that more recent hard drives already come with hardware encryption enabled, and the secure erase/sanitize command can finish in mere seconds, because it only needs to throw away the existing key: https://en.wikipedia.org/wiki/Hardware-based_full_disk_encryption#Disk_sanitization https://en.wikipedia.org/wiki/Hardware-based_full_disk_encry...
- fulafel 10y agoThat requires you to trust the disk to implement many finicky crypto details correctly in its proprietary black box, you can't get any assurance about that with reasonable cost. And SSDs have a horrible track record in the area, manyimplementing SECURE ERASE so it leaves your data on the flash chips. And if you choose a disk model, make your investigations and find it passes your sniff test, disks are no longer a commodity part for you.
- tptacek 10y agoThe point is that FDE protects you principally from loss of physical custody, and the reason the slide is there is because lots of developers think that FDE somehow helps in the (vastly more likely) scenario where your machine gets owned up over the Internet.
- knorker 10y agoYeah, but I'd rather not fight misunderstandings with misinformation. It's more true to say, like you do, that it's about loss of physical custody. But the presentation said theft. You are more correct in your phrasing, but even that doesn't cover my example of swapping hard drives around. If someone hacks the low security server and finds that it still has customer data in the unwritten blocks of the FS, or in remapped sectors, then that's not loss of physical custody, but it would have been prevented by FDE. And honestly, who would not scan for deleted data after hacking a machine? It's not a tiny detail.
- tptacek 10y agoIf you have PII on a disk, and then you hand that disk to another organization not prepared to protect PII, you have surrendered physical custody of the PII. The distinction you're making is basically the same as the distinction between a thief cinderblocking your car window to steal your laptop, and you leaving your laptop in the back seat of a cab. Yes: FDE helps both if your drive is physically stolen, and if you physically lose it.
- knorker 10y agoIf you don't have FDE then you cannot erase PII, is my point. That hard drive is then forever tainted by PII. With FDE, that is not the case.