Need encryption solution compatible with Remote Access
Been using SecureDoc full disk encryption happily for a few years. Now want to do more remote access (GoToMyPC) but the preboot authentication process prevents access if the system reboots due to power failure, windows update forced reboot, etc. Support says I can enable permanent authentication/logon that will authenticate automatically, allow the OS to load, and take me right to the Windows login screen. External boot devices couldn't get past the preboot so everything is safe as long as the Windows logon is not cracked, but I fear this is pretty easy to do. Would partition encryption or a virtual encrypted disk/container be a better solution? Pros? Cons? Software recommendations? thanks in advance?
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
http://www.truecrypt.org/docs/?s=unencrypted-data-in-ram
I just want to confirm from you TC knowledgeable experts that I am reading this page from TC website correctly: Dismounting a non-system volume in TC erases all the keys from RAM so there would be no trace of them if the computer were subjected to a coldboot attack after dismount?
Would this not be the ideal solution for my situation: remote access to the unprotected OS, authenticating/mounting the volume to work, then dismounting the volume after to clear the memory? What am I missing? How is the FDE with preboot AND the TC volume a better solution? With FDE and preboot, the key is still in RAM until clean shutdown, and therefore always accessible if the machine is left running, no?
I just want to confirm from you TC knowledgeable experts that I am reading this page from TC website correctly: Dismounting a non-system volume in TC erases all the keys from RAM so there would be no trace of them if the computer were subjected to a coldboot attack after dismount?
Would this not be the ideal solution for my situation: remote access to the unprotected OS, authenticating/mounting the volume to work, then dismounting the volume after to clear the memory? What am I missing? How is the FDE with preboot AND the TC volume a better solution? With FDE and preboot, the key is still in RAM until clean shutdown, and therefore always accessible if the machine is left running, no?
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Kelvin,
Thanks for your detailed answers; I hear what you're saying about layers but I still don't see the value of the FDE if I bypass the preboot and boot right to windows logon. The data on the drive may still be encrypted but since authentication has taken place already, anyone with access to the machine can see everything except the TC volume. I believe when you permanently enable the auto authentication at boot, you must disable the GINA which gives you the option of locking the computer when the screensaver activates. I guess you could password protect on resume from the (windows) screensaver for a little more protection. I'll have to think about that one for awhile.
A couple of clarifications:
1. SecureDoc does have a "gold" version that actually allows the creation and mounting of containers; this is different than there Compartment version which I just learned about yesterday, and different than their mainstream "silver" version which I run.
2. My question regarding TrueImage was not about storing the backups but about actually creating the images. As you are no doubt aware, imaging and encryption don't play nicely together but I do have a process where I can image an encrypted SecureDoc drive. The image ends up unencrypted but it's a simple matter to re-encrypt it if disaster strikes and I need it. I was curious as to whether TrueCrypt works with TrueImage and will allow me to do a successful compressed image (not raw sector) like I can with SecureDoc?
3. You said TrueCrypt mounts volumes when the OS is loaded which is what I DON'T want. Is there not a way to load the OS WITHOUT mounting TC volumes until I want to access them? The preferences tab in the documentation for Ver 6.1 seems to indicate that you can optionally start TC after windows logon, and then optionally load volumes based on how you check the boxes. Perhaps that's new?
Thanks for your detailed answers; I hear what you're saying about layers but I still don't see the value of the FDE if I bypass the preboot and boot right to windows logon. The data on the drive may still be encrypted but since authentication has taken place already, anyone with access to the machine can see everything except the TC volume. I believe when you permanently enable the auto authentication at boot, you must disable the GINA which gives you the option of locking the computer when the screensaver activates. I guess you could password protect on resume from the (windows) screensaver for a little more protection. I'll have to think about that one for awhile.
A couple of clarifications:
1. SecureDoc does have a "gold" version that actually allows the creation and mounting of containers; this is different than there Compartment version which I just learned about yesterday, and different than their mainstream "silver" version which I run.
2. My question regarding TrueImage was not about storing the backups but about actually creating the images. As you are no doubt aware, imaging and encryption don't play nicely together but I do have a process where I can image an encrypted SecureDoc drive. The image ends up unencrypted but it's a simple matter to re-encrypt it if disaster strikes and I need it. I was curious as to whether TrueCrypt works with TrueImage and will allow me to do a successful compressed image (not raw sector) like I can with SecureDoc?
3. You said TrueCrypt mounts volumes when the OS is loaded which is what I DON'T want. Is there not a way to load the OS WITHOUT mounting TC volumes until I want to access them? The preferences tab in the documentation for Ver 6.1 seems to indicate that you can optionally start TC after windows logon, and then optionally load volumes based on how you check the boxes. Perhaps that's new?
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Thanks for your help!
ASKER
Thanks for your responses. A little research can be a scary thing!!!
http://www.physorg.com/news122820185.html
If I understand what I've been reading, even using a preboot authentication on a FDE system can not protect against these cold boot/ram decay attacks since the key remains in RAM after powerdown until it decays. The only solution is to overwrite RAM on shutdown, which isn't done. Since ANY system can be hacked given enough time, money and motivation, I just need to take reasonable precautions. Given, why couldn't I just use the TrueCrypt volume strategy (SecureDoc I believe has a version that uses containers also) and avoid all the hassles of FDE and preboot? I don't even think a hardware encrypted drive is a solution - no keys stored in RAM but to be accessible it would have to remain on and presumably already decrypted - am I right on this?
Another issue I failed to initially mention is that I use Acronis TrueImage for backups - it works fine with SecureDoc FDE but what about TrueCrypt - I couldn't find anything on that. I did read a post on Wilders that the workstation edition (Echo) supports imaging encrypted drives, but from what I can find, it is only sector by sector resulting in HUGE images. Anyone know anything different?