Whole disk encryption

I hear a lot about the pros (and sometimes the cons) of disk encryption.  You hear about government laptops being lost or stolen and the question arises, why wasn't the hard disk encrypted.  You hear about accused criminals encrypting hard disks so that the prosecution can't get any evidence.  Users will encrypt their entire disk or a portion of it when storing tax or other personal information.  There seems to be some misunderstanding on how the technology works, and what it can and cannot do.

First, we need a little background on encryption.  There are two different types of encryption: 1-way and 2-way encryption.  In 1-way, data only flows in one direction.  You can only encrypt the information.  You can't decrypt it.  This is commonly called hashing.  This type of encryption might seem worthless (and it doesn't have much use in disk encryption), but it has a whole lot of useful purposes that are unrelated to disk encryption.  2-way encryption is the type that allows you to encrypt and decrypt your data.  2-way encryption is protected by a key.  In disk encryption, that key is usually a password, but not always.  In disk encryption, you use the key to encrypt the data and you use the key to decrypt the data.  The main thing to learn is that in order to read (decrypt) the encrypted data, you must enter a password/key. This becomes important when talking about whole disk encryption.

Disk encryption comes in to flavors: whole disk encryption and folder/file encryption.  In whole disk encryption, your entire disk is encrypted.  In folder/file encryption, only a section of your disk is encrypted.  Most media outlets tend to talk about whole disk encryption as the technology everyone should use.  They never mention any of the downsides.  They never say why it might be a good idea to use folder encryption.

Lets start with starting your computer.  If you have whole disk encryption, boot your computer.  If the technology is used correctly, it should prompt you for a password immediately, before Windows even boots.  If it did not, then the technology is flawed!  The problem here is the battle between security and user friendliness.  It is not very user friendly to force a user to enter in a password to turn on your computer, then enter a different password to log into your computer.  Some vendors try to get the best of both worlds by using the computer fingerprint as your key (this is why I made the distinction above about password vs key). Your computer has a unique set of hardware in it.  The disk encryption software can look at the hardware and generate a key that can be used for encrypting the hard disk.  This means the disk is encrypted and you don't have to enter in a password.  Seems nice, but two things should pop up in your head: 1) what if I change the hardware, but most importantly 2) what if someone steals the ENTIRE computer.  This encryption scheme doesn't help the government agencies who lost entire laptops of social security numbers.

Another problem that is often overlooked is performance.  Encrypting and decrypting data uses your CPU.  The more it uses your CPU, the less CPU is available for every other program that is running on your computer.  There are CPUs out there that are far more powerful than consumers need, but there is a growing trend to use power-effecient CPUs instead of power-hungry CPUs.  On top of that, encrypted data is larger.  Depending on the technology that is used, it could be 50% larger.  Although that eats up more disk space, the bigger problem is that you must transfer more data to memory to decrypt it before you can use it.  That means disk reads/writes are a lot slower, and the disk encryption software is consuming a chunk of your RAM.  Depending on what tasks you are performing, these penalties can be pretty significant.  The more of a power user you are, the more you will feel this pain.

Encryption is supposed to increase security, but there is one area that it doesn't even try to help: spyware/malware.  If your computer gets attacked by malware, and you use whole disk encryption, you have already encrypted the disk.  The malware has access to every file that it would have had access to if you didn't encrypt your hard disk.  There is no protection there.

Lets talk about folder encryption.  Most operating systems support this right out of the box.  In folder encryption, your computer boots just like it normally did before encryption.  You only get prompted for a password when you try to access an encrypted folder.  You can also have multiple encrypted folders, each with a different password.  Although this can get confusing, it can help segregate your important information. If someone steals your entire computer, your important folders are still encrypted.  The thief still gets your bookmarks or any data that you didn't encrypt, but the responsibility is on you to determine what is important enough to encrypt.

Since you are only encrypting your sensitive information, you do not suffer the performance penalty when going about your day-to-day activities.  You only suffer the problem when accessing your personal information.  For some of us, that is once a year when you do your taxes.  If your computer gets attacked, your folders are still encrypted.  It is a lot harder for the malware to steal the sensitive information (although still possible, it just makes it a lot harder).

I tend to hear security professionals compare computer security with bank security.  You can't have an absolutely secure system.  You have layers of security.  Whole disk encryption is an attempt to have absolute security.  Folder encryption is a layer.  You protect the information that is the most important to you.  You shouldn't be trying to encrypt all the day-to-day activities that you do (unless you are a business or a criminal).  For personal computers, protect the information that should be protected.