![Page 1: How to Avoid a $1.5 Million Dollar Fine by Using Microsoft BitLockerfiles.meetup.com/4323362/BitLocker Drive Encryption v5.pdf · 2013. 8. 7. · BitLocker To Go. 8/7/2013 How to](https://reader036.vdocument.in/reader036/viewer/2022063022/5fe9e187a1e8b16cf6236000/html5/thumbnails/1.jpg)
How to Avoid a $1.5 Million Dollar Fine by Using Microsoft BitLocker
Created by Chris O’Connell
8/7/2013 How to Avoid a $1.5 Million Dollar Fine by Using Microsoft BitLocker – By Chris P. OConnell V5
1
![Page 2: How to Avoid a $1.5 Million Dollar Fine by Using Microsoft BitLockerfiles.meetup.com/4323362/BitLocker Drive Encryption v5.pdf · 2013. 8. 7. · BitLocker To Go. 8/7/2013 How to](https://reader036.vdocument.in/reader036/viewer/2022063022/5fe9e187a1e8b16cf6236000/html5/thumbnails/2.jpg)
BAWSUG NewsPlease fill out our polls on Meetup.org/WindowsBoston
8/7/2013How to Avoid a $1.5 Million Dollar Fine
Using Microsoft BitLocker – By Chris O’Connell V2
2
![Page 3: How to Avoid a $1.5 Million Dollar Fine by Using Microsoft BitLockerfiles.meetup.com/4323362/BitLocker Drive Encryption v5.pdf · 2013. 8. 7. · BitLocker To Go. 8/7/2013 How to](https://reader036.vdocument.in/reader036/viewer/2022063022/5fe9e187a1e8b16cf6236000/html5/thumbnails/3.jpg)
What’s up with that title?
The Mass Eye and Ear Infirmary and Mass Eye and Ear Associates were fined $1.5 Million dollars for having an unencrypted laptop stolen.
8/7/2013How to Avoid a $1.5 Million Dollar Fine
Using Microsoft BitLocker – By Chris O’Connell V2
3
![Page 4: How to Avoid a $1.5 Million Dollar Fine by Using Microsoft BitLockerfiles.meetup.com/4323362/BitLocker Drive Encryption v5.pdf · 2013. 8. 7. · BitLocker To Go. 8/7/2013 How to](https://reader036.vdocument.in/reader036/viewer/2022063022/5fe9e187a1e8b16cf6236000/html5/thumbnails/4.jpg)
Why Encrypt Your Disk?
Question: How much does a login password really protect your data?
Answer: Just enough to prevent a basic user from accessing your data.
8/7/2013How to Avoid a $1.5 Million Dollar Fine
Using Microsoft BitLocker – By Chris O’Connell V2
4
![Page 5: How to Avoid a $1.5 Million Dollar Fine by Using Microsoft BitLockerfiles.meetup.com/4323362/BitLocker Drive Encryption v5.pdf · 2013. 8. 7. · BitLocker To Go. 8/7/2013 How to](https://reader036.vdocument.in/reader036/viewer/2022063022/5fe9e187a1e8b16cf6236000/html5/thumbnails/5.jpg)
Group Policy Complexity Requirements
3 out of 4 of the following:
• Capital Letter
• Lower Case Letter
• Number
• Special Character (!, $, &, etc)
8/7/2013How to Avoid a $1.5 Million Dollar Fine
Using Microsoft BitLocker – By Chris O’Connell V2
5
![Page 6: How to Avoid a $1.5 Million Dollar Fine by Using Microsoft BitLockerfiles.meetup.com/4323362/BitLocker Drive Encryption v5.pdf · 2013. 8. 7. · BitLocker To Go. 8/7/2013 How to](https://reader036.vdocument.in/reader036/viewer/2022063022/5fe9e187a1e8b16cf6236000/html5/thumbnails/6.jpg)
Does this password meet complexity requirements?
Password1
8/7/2013How to Avoid a $1.5 Million Dollar Fine
Using Microsoft BitLocker – By Chris O’Connell V2
6
![Page 7: How to Avoid a $1.5 Million Dollar Fine by Using Microsoft BitLockerfiles.meetup.com/4323362/BitLocker Drive Encryption v5.pdf · 2013. 8. 7. · BitLocker To Go. 8/7/2013 How to](https://reader036.vdocument.in/reader036/viewer/2022063022/5fe9e187a1e8b16cf6236000/html5/thumbnails/7.jpg)
8/7/2013How to Avoid a $1.5 Million Dollar Fine
Using Microsoft BitLocker – By Chris O’Connell V2
7
![Page 8: How to Avoid a $1.5 Million Dollar Fine by Using Microsoft BitLockerfiles.meetup.com/4323362/BitLocker Drive Encryption v5.pdf · 2013. 8. 7. · BitLocker To Go. 8/7/2013 How to](https://reader036.vdocument.in/reader036/viewer/2022063022/5fe9e187a1e8b16cf6236000/html5/thumbnails/8.jpg)
8/7/2013How to Avoid a $1.5 Million Dollar Fine
Using Microsoft BitLocker – By Chris O’Connell V2
8
![Page 9: How to Avoid a $1.5 Million Dollar Fine by Using Microsoft BitLockerfiles.meetup.com/4323362/BitLocker Drive Encryption v5.pdf · 2013. 8. 7. · BitLocker To Go. 8/7/2013 How to](https://reader036.vdocument.in/reader036/viewer/2022063022/5fe9e187a1e8b16cf6236000/html5/thumbnails/9.jpg)
What If…
You can’t crack my password?
8/7/2013How to Avoid a $1.5 Million Dollar Fine
Using Microsoft BitLocker – By Chris O’Connell V2
9
![Page 10: How to Avoid a $1.5 Million Dollar Fine by Using Microsoft BitLockerfiles.meetup.com/4323362/BitLocker Drive Encryption v5.pdf · 2013. 8. 7. · BitLocker To Go. 8/7/2013 How to](https://reader036.vdocument.in/reader036/viewer/2022063022/5fe9e187a1e8b16cf6236000/html5/thumbnails/10.jpg)
8/7/2013How to Avoid a $1.5 Million Dollar Fine
Using Microsoft BitLocker – By Chris O’Connell V2
10
![Page 11: How to Avoid a $1.5 Million Dollar Fine by Using Microsoft BitLockerfiles.meetup.com/4323362/BitLocker Drive Encryption v5.pdf · 2013. 8. 7. · BitLocker To Go. 8/7/2013 How to](https://reader036.vdocument.in/reader036/viewer/2022063022/5fe9e187a1e8b16cf6236000/html5/thumbnails/11.jpg)
What if…
I password protected my BIOS and disabled boot from removable media?
8/7/2013How to Avoid a $1.5 Million Dollar Fine
Using Microsoft BitLocker – By Chris O’Connell V2
11
![Page 12: How to Avoid a $1.5 Million Dollar Fine by Using Microsoft BitLockerfiles.meetup.com/4323362/BitLocker Drive Encryption v5.pdf · 2013. 8. 7. · BitLocker To Go. 8/7/2013 How to](https://reader036.vdocument.in/reader036/viewer/2022063022/5fe9e187a1e8b16cf6236000/html5/thumbnails/12.jpg)
I use a Mac, I’m safe right?
Wrong!
Less than
5 minutes
with a
mac boot disk:
8/7/2013How to Avoid a $1.5 Million Dollar Fine
Using Microsoft BitLocker – By Chris O’Connell V2
12
![Page 13: How to Avoid a $1.5 Million Dollar Fine by Using Microsoft BitLockerfiles.meetup.com/4323362/BitLocker Drive Encryption v5.pdf · 2013. 8. 7. · BitLocker To Go. 8/7/2013 How to](https://reader036.vdocument.in/reader036/viewer/2022063022/5fe9e187a1e8b16cf6236000/html5/thumbnails/13.jpg)
I use Linux, I’m safe right?
Wrong!
• Boot with any live CD and perform a chroot or browse the file system.
• Less than 5 minutes.
8/7/2013How to Avoid a $1.5 Million Dollar Fine
Using Microsoft BitLocker – By Chris O’Connell V2
13
![Page 14: How to Avoid a $1.5 Million Dollar Fine by Using Microsoft BitLockerfiles.meetup.com/4323362/BitLocker Drive Encryption v5.pdf · 2013. 8. 7. · BitLocker To Go. 8/7/2013 How to](https://reader036.vdocument.in/reader036/viewer/2022063022/5fe9e187a1e8b16cf6236000/html5/thumbnails/14.jpg)
Why Encrypt Your Disk?
Login passwords don’t protect your data if:
• Someone boots up with a bootable CD or thumb drive
• Someone removes your disk and attaches it to a disk to USB adapter.
Both of these methods bypass login passwords.
8/7/2013How to Avoid a $1.5 Million Dollar Fine
Using Microsoft BitLocker – By Chris O’Connell V2
14
![Page 15: How to Avoid a $1.5 Million Dollar Fine by Using Microsoft BitLockerfiles.meetup.com/4323362/BitLocker Drive Encryption v5.pdf · 2013. 8. 7. · BitLocker To Go. 8/7/2013 How to](https://reader036.vdocument.in/reader036/viewer/2022063022/5fe9e187a1e8b16cf6236000/html5/thumbnails/15.jpg)
BitLocker Protects You
Drive encryption helps secure your data when:
• A computer is lost or stolen.
• Prevent unauthorized access to someone who has physical possesion
• A computer is decommissioned but the drive is not wiped (then given or thrown away / recycled)
8/7/2013How to Avoid a $1.5 Million Dollar Fine
Using Microsoft BitLocker – By Chris O’Connell V2
15
![Page 16: How to Avoid a $1.5 Million Dollar Fine by Using Microsoft BitLockerfiles.meetup.com/4323362/BitLocker Drive Encryption v5.pdf · 2013. 8. 7. · BitLocker To Go. 8/7/2013 How to](https://reader036.vdocument.in/reader036/viewer/2022063022/5fe9e187a1e8b16cf6236000/html5/thumbnails/16.jpg)
BitLocker Won’t Protect
It’s important to note that:
• doesn’t protect a running machine
• Screens should be locked, otherwise encryption is less effective.
• Doesn’t protect against network attack
8/7/2013How to Avoid a $1.5 Million Dollar Fine
Using Microsoft BitLocker – By Chris O’Connell V2
16
![Page 17: How to Avoid a $1.5 Million Dollar Fine by Using Microsoft BitLockerfiles.meetup.com/4323362/BitLocker Drive Encryption v5.pdf · 2013. 8. 7. · BitLocker To Go. 8/7/2013 How to](https://reader036.vdocument.in/reader036/viewer/2022063022/5fe9e187a1e8b16cf6236000/html5/thumbnails/17.jpg)
BitLocker Won’t Protect
8/7/2013How to Avoid a $1.5 Million Dollar Fine
Using Microsoft BitLocker – By Chris O’Connell V2
17
![Page 18: How to Avoid a $1.5 Million Dollar Fine by Using Microsoft BitLockerfiles.meetup.com/4323362/BitLocker Drive Encryption v5.pdf · 2013. 8. 7. · BitLocker To Go. 8/7/2013 How to](https://reader036.vdocument.in/reader036/viewer/2022063022/5fe9e187a1e8b16cf6236000/html5/thumbnails/18.jpg)
BitLocker Won’t Protect
8/7/2013How to Avoid a $1.5 Million Dollar Fine
Using Microsoft BitLocker – By Chris O’Connell V2
18
![Page 19: How to Avoid a $1.5 Million Dollar Fine by Using Microsoft BitLockerfiles.meetup.com/4323362/BitLocker Drive Encryption v5.pdf · 2013. 8. 7. · BitLocker To Go. 8/7/2013 How to](https://reader036.vdocument.in/reader036/viewer/2022063022/5fe9e187a1e8b16cf6236000/html5/thumbnails/19.jpg)
Whole Disk Encryption
• Whole Disk Encryption (WDE)
– Encrypts the entire disk as opposed to individual files.
– Software based
8/7/2013How to Avoid a $1.5 Million Dollar Fine
Using Microsoft BitLocker – By Chris O’Connell V2
19
![Page 20: How to Avoid a $1.5 Million Dollar Fine by Using Microsoft BitLockerfiles.meetup.com/4323362/BitLocker Drive Encryption v5.pdf · 2013. 8. 7. · BitLocker To Go. 8/7/2013 How to](https://reader036.vdocument.in/reader036/viewer/2022063022/5fe9e187a1e8b16cf6236000/html5/thumbnails/20.jpg)
New to BitLocker
• Full Disk Encryption (FDE), a feature of Encrypted Hard Drives (EHD)
– Encrypts the entire disk, Windows refers to this as Full Volume Encryption (FVE)
– Leverages hardware built into new hard drives
8/7/2013How to Avoid a $1.5 Million Dollar Fine
Using Microsoft BitLocker – By Chris O’Connell V2
20
![Page 21: How to Avoid a $1.5 Million Dollar Fine by Using Microsoft BitLockerfiles.meetup.com/4323362/BitLocker Drive Encryption v5.pdf · 2013. 8. 7. · BitLocker To Go. 8/7/2013 How to](https://reader036.vdocument.in/reader036/viewer/2022063022/5fe9e187a1e8b16cf6236000/html5/thumbnails/21.jpg)
And finally… who cares? Why should I bother encrypting computers?
“My users are trained to only store files on network shares.”
• No matter how much you tell users to save stuff to their network drives…
• DropBox/SkyDrive
Sometimes users don’t mean to break the rules.
Why Encrypt Your Disk?
8/7/2013How to Avoid a $1.5 Million Dollar Fine
Using Microsoft BitLocker – By Chris O’Connell V2
21
![Page 22: How to Avoid a $1.5 Million Dollar Fine by Using Microsoft BitLockerfiles.meetup.com/4323362/BitLocker Drive Encryption v5.pdf · 2013. 8. 7. · BitLocker To Go. 8/7/2013 How to](https://reader036.vdocument.in/reader036/viewer/2022063022/5fe9e187a1e8b16cf6236000/html5/thumbnails/22.jpg)
What is BitLocker
• Whole Disk Encryption (WDE)
• By default it uses the AES encryption algorithm in CBC mode with a 128 bit key, combined with the Elephant diffuser for additional disk encryption-specific security not provided by AES. Also, if configured, bitlockeris able to encrypt using a 256 bit key.
8/7/2013How to Avoid a $1.5 Million Dollar Fine
Using Microsoft BitLocker – By Chris O’Connell V2
22
![Page 23: How to Avoid a $1.5 Million Dollar Fine by Using Microsoft BitLockerfiles.meetup.com/4323362/BitLocker Drive Encryption v5.pdf · 2013. 8. 7. · BitLocker To Go. 8/7/2013 How to](https://reader036.vdocument.in/reader036/viewer/2022063022/5fe9e187a1e8b16cf6236000/html5/thumbnails/23.jpg)
What is BitLocker
8/7/2013How to Avoid a $1.5 Million Dollar Fine
Using Microsoft BitLocker – By Chris O’Connell V2
23
Possibly the most important feature:• Integrated with Windows login credentials
![Page 24: How to Avoid a $1.5 Million Dollar Fine by Using Microsoft BitLockerfiles.meetup.com/4323362/BitLocker Drive Encryption v5.pdf · 2013. 8. 7. · BitLocker To Go. 8/7/2013 How to](https://reader036.vdocument.in/reader036/viewer/2022063022/5fe9e187a1e8b16cf6236000/html5/thumbnails/24.jpg)
Microsoft BitLocker Requirements
BitLocker is available in the following versions of Windows:
• Windows Vista & Windows 7
– Enterprise & Ultimate
• Windows 8
– Professional & Enterprise
• Windows Server 2008 R2 & Server 2012
8/7/2013How to Avoid a $1.5 Million Dollar Fine
Using Microsoft BitLocker – By Chris O’Connell V2
24
![Page 25: How to Avoid a $1.5 Million Dollar Fine by Using Microsoft BitLockerfiles.meetup.com/4323362/BitLocker Drive Encryption v5.pdf · 2013. 8. 7. · BitLocker To Go. 8/7/2013 How to](https://reader036.vdocument.in/reader036/viewer/2022063022/5fe9e187a1e8b16cf6236000/html5/thumbnails/25.jpg)
BitLocker Boot Requirements
Trusted Platform Module Chip (TPM) is recommended for a seamless user experience.• TPM is available on most business grade
machines
If your PC doesn’t have TPM a flash drive can be used.• Thumb drive must be plugged in when PC is
booted• Alternately, can use pre-boot pin
8/7/2013How to Avoid a $1.5 Million Dollar Fine
Using Microsoft BitLocker – By Chris O’Connell V2
25
![Page 26: How to Avoid a $1.5 Million Dollar Fine by Using Microsoft BitLockerfiles.meetup.com/4323362/BitLocker Drive Encryption v5.pdf · 2013. 8. 7. · BitLocker To Go. 8/7/2013 How to](https://reader036.vdocument.in/reader036/viewer/2022063022/5fe9e187a1e8b16cf6236000/html5/thumbnails/26.jpg)
BitLocker Boot Requirements
2 partitions are required for BitLocker to be installed.
• First partition must be >100MB & be set as active
• Second is not decrypted until proper Windows Login credentials are presented.
8/7/2013How to Avoid a $1.5 Million Dollar Fine
Using Microsoft BitLocker – By Chris O’Connell V2
26
![Page 27: How to Avoid a $1.5 Million Dollar Fine by Using Microsoft BitLockerfiles.meetup.com/4323362/BitLocker Drive Encryption v5.pdf · 2013. 8. 7. · BitLocker To Go. 8/7/2013 How to](https://reader036.vdocument.in/reader036/viewer/2022063022/5fe9e187a1e8b16cf6236000/html5/thumbnails/27.jpg)
8/7/2013How to Avoid a $1.5 Million Dollar Fine
Using Microsoft BitLocker – By Chris O’Connell V2
27
![Page 28: How to Avoid a $1.5 Million Dollar Fine by Using Microsoft BitLockerfiles.meetup.com/4323362/BitLocker Drive Encryption v5.pdf · 2013. 8. 7. · BitLocker To Go. 8/7/2013 How to](https://reader036.vdocument.in/reader036/viewer/2022063022/5fe9e187a1e8b16cf6236000/html5/thumbnails/28.jpg)
TPM must be turned on
8/7/2013How to Avoid a $1.5 Million Dollar Fine
Using Microsoft BitLocker – By Chris O’Connell V2
28
![Page 29: How to Avoid a $1.5 Million Dollar Fine by Using Microsoft BitLockerfiles.meetup.com/4323362/BitLocker Drive Encryption v5.pdf · 2013. 8. 7. · BitLocker To Go. 8/7/2013 How to](https://reader036.vdocument.in/reader036/viewer/2022063022/5fe9e187a1e8b16cf6236000/html5/thumbnails/29.jpg)
TPM must be turned on
8/7/2013How to Avoid a $1.5 Million Dollar Fine
Using Microsoft BitLocker – By Chris O’Connell V2
29
![Page 30: How to Avoid a $1.5 Million Dollar Fine by Using Microsoft BitLockerfiles.meetup.com/4323362/BitLocker Drive Encryption v5.pdf · 2013. 8. 7. · BitLocker To Go. 8/7/2013 How to](https://reader036.vdocument.in/reader036/viewer/2022063022/5fe9e187a1e8b16cf6236000/html5/thumbnails/30.jpg)
Observations
BitLocker is fast, performance overhead is hardly noticeable to me (especially when SSD drives are used)
Data is recoverable from an encrypted drive, even if the drive is failing (so long as you have the key).
8/7/2013How to Avoid a $1.5 Million Dollar Fine
Using Microsoft BitLocker – By Chris O’Connell V2
30
![Page 31: How to Avoid a $1.5 Million Dollar Fine by Using Microsoft BitLockerfiles.meetup.com/4323362/BitLocker Drive Encryption v5.pdf · 2013. 8. 7. · BitLocker To Go. 8/7/2013 How to](https://reader036.vdocument.in/reader036/viewer/2022063022/5fe9e187a1e8b16cf6236000/html5/thumbnails/31.jpg)
Observations
• BitLocker is seamless to the end user.
What happens when users have too many passwords to remember?
• That’s right, and where do they put those passwords that they write down?
• Right again! In the laptop bag… so if the password is in the laptop bag how secure is the computer?
8/7/2013How to Avoid a $1.5 Million Dollar Fine
Using Microsoft BitLocker – By Chris O’Connell V2
31
![Page 32: How to Avoid a $1.5 Million Dollar Fine by Using Microsoft BitLockerfiles.meetup.com/4323362/BitLocker Drive Encryption v5.pdf · 2013. 8. 7. · BitLocker To Go. 8/7/2013 How to](https://reader036.vdocument.in/reader036/viewer/2022063022/5fe9e187a1e8b16cf6236000/html5/thumbnails/32.jpg)
Observations – Administrative Overhead
Administrative overhead is minimal. However:
• Keys need to be stored and organized.
• If BitLocker is deployed with Group Policy the keys can be stored in Active Directory.
• Remember to suspend BitLocker before a firmware/BIOS update.
8/7/2013How to Avoid a $1.5 Million Dollar Fine
Using Microsoft BitLocker – By Chris O’Connell V2
32
![Page 33: How to Avoid a $1.5 Million Dollar Fine by Using Microsoft BitLockerfiles.meetup.com/4323362/BitLocker Drive Encryption v5.pdf · 2013. 8. 7. · BitLocker To Go. 8/7/2013 How to](https://reader036.vdocument.in/reader036/viewer/2022063022/5fe9e187a1e8b16cf6236000/html5/thumbnails/33.jpg)
Observations – Administrative overhead
Safemode requires the BitLocker key.
This raises an interesting question about who should be granted access to the keys.
8/7/2013How to Avoid a $1.5 Million Dollar Fine
Using Microsoft BitLocker – By Chris O’Connell V2
33
![Page 34: How to Avoid a $1.5 Million Dollar Fine by Using Microsoft BitLockerfiles.meetup.com/4323362/BitLocker Drive Encryption v5.pdf · 2013. 8. 7. · BitLocker To Go. 8/7/2013 How to](https://reader036.vdocument.in/reader036/viewer/2022063022/5fe9e187a1e8b16cf6236000/html5/thumbnails/34.jpg)
Nuances
If you use Windows Backup to backup a BitLocker volume the backup is NOT encrypted.
• This means backups must be stored in a secure location.
Users who have admin rights to their machines can disable BitLocker or change the key
8/7/2013How to Avoid a $1.5 Million Dollar Fine
Using Microsoft BitLocker – By Chris O’Connell V2
34
![Page 35: How to Avoid a $1.5 Million Dollar Fine by Using Microsoft BitLockerfiles.meetup.com/4323362/BitLocker Drive Encryption v5.pdf · 2013. 8. 7. · BitLocker To Go. 8/7/2013 How to](https://reader036.vdocument.in/reader036/viewer/2022063022/5fe9e187a1e8b16cf6236000/html5/thumbnails/35.jpg)
Let’s get started!
8/7/2013How to Avoid a $1.5 Million Dollar Fine
Using Microsoft BitLocker – By Chris O’Connell V2
35
![Page 36: How to Avoid a $1.5 Million Dollar Fine by Using Microsoft BitLockerfiles.meetup.com/4323362/BitLocker Drive Encryption v5.pdf · 2013. 8. 7. · BitLocker To Go. 8/7/2013 How to](https://reader036.vdocument.in/reader036/viewer/2022063022/5fe9e187a1e8b16cf6236000/html5/thumbnails/36.jpg)
Let’s get started!
8/7/2013How to Avoid a $1.5 Million Dollar Fine
Using Microsoft BitLocker – By Chris O’Connell V2
36
![Page 37: How to Avoid a $1.5 Million Dollar Fine by Using Microsoft BitLockerfiles.meetup.com/4323362/BitLocker Drive Encryption v5.pdf · 2013. 8. 7. · BitLocker To Go. 8/7/2013 How to](https://reader036.vdocument.in/reader036/viewer/2022063022/5fe9e187a1e8b16cf6236000/html5/thumbnails/37.jpg)
8/7/2013How to Avoid a $1.5 Million Dollar Fine
Using Microsoft BitLocker – By Chris O’Connell V2
37
![Page 38: How to Avoid a $1.5 Million Dollar Fine by Using Microsoft BitLockerfiles.meetup.com/4323362/BitLocker Drive Encryption v5.pdf · 2013. 8. 7. · BitLocker To Go. 8/7/2013 How to](https://reader036.vdocument.in/reader036/viewer/2022063022/5fe9e187a1e8b16cf6236000/html5/thumbnails/38.jpg)
BitLocker Drive Encryption recovery key
To verify that this is the correct recovery key, compare the start of the following identifier with the identifier value displayed on your PC.
Identifier:
161DE714-2890-4DEA-B9F7-CAE7F6D57FE9
If the above identifier matches the one displayed by your PC, then use the following key to unlock your drive.
Recovery Key:
197505-013761-602173-268642-684321-690745-278113-024585
If the above identifier doesn't match the one displayed by your PC, then this isn't the right key to unlock your drive.Try another recovery key, or contact your administrator or IT Help Desk for assistance.
Generated Encryption Recovery Key File
8/7/2013How to Avoid a $1.5 Million Dollar Fine
Using Microsoft BitLocker – By Chris O’Connell V2
38
![Page 39: How to Avoid a $1.5 Million Dollar Fine by Using Microsoft BitLockerfiles.meetup.com/4323362/BitLocker Drive Encryption v5.pdf · 2013. 8. 7. · BitLocker To Go. 8/7/2013 How to](https://reader036.vdocument.in/reader036/viewer/2022063022/5fe9e187a1e8b16cf6236000/html5/thumbnails/39.jpg)
8/7/2013How to Avoid a $1.5 Million Dollar Fine
Using Microsoft BitLocker – By Chris O’Connell V2
39
![Page 40: How to Avoid a $1.5 Million Dollar Fine by Using Microsoft BitLockerfiles.meetup.com/4323362/BitLocker Drive Encryption v5.pdf · 2013. 8. 7. · BitLocker To Go. 8/7/2013 How to](https://reader036.vdocument.in/reader036/viewer/2022063022/5fe9e187a1e8b16cf6236000/html5/thumbnails/40.jpg)
8/7/2013How to Avoid a $1.5 Million Dollar Fine
Using Microsoft BitLocker – By Chris O’Connell V2
40
![Page 41: How to Avoid a $1.5 Million Dollar Fine by Using Microsoft BitLockerfiles.meetup.com/4323362/BitLocker Drive Encryption v5.pdf · 2013. 8. 7. · BitLocker To Go. 8/7/2013 How to](https://reader036.vdocument.in/reader036/viewer/2022063022/5fe9e187a1e8b16cf6236000/html5/thumbnails/41.jpg)
8/7/2013How to Avoid a $1.5 Million Dollar Fine
Using Microsoft BitLocker – By Chris O’Connell V2
41
![Page 42: How to Avoid a $1.5 Million Dollar Fine by Using Microsoft BitLockerfiles.meetup.com/4323362/BitLocker Drive Encryption v5.pdf · 2013. 8. 7. · BitLocker To Go. 8/7/2013 How to](https://reader036.vdocument.in/reader036/viewer/2022063022/5fe9e187a1e8b16cf6236000/html5/thumbnails/42.jpg)
So what happens if?!?
You try to boot off this drive in another machine?
8/7/2013How to Avoid a $1.5 Million Dollar Fine
Using Microsoft BitLocker – By Chris O’Connell V2
42
![Page 43: How to Avoid a $1.5 Million Dollar Fine by Using Microsoft BitLockerfiles.meetup.com/4323362/BitLocker Drive Encryption v5.pdf · 2013. 8. 7. · BitLocker To Go. 8/7/2013 How to](https://reader036.vdocument.in/reader036/viewer/2022063022/5fe9e187a1e8b16cf6236000/html5/thumbnails/43.jpg)
So what happens if?!?
Plug this drive into a machine running Windows via USB converter to rescue data?
8/7/2013How to Avoid a $1.5 Million Dollar Fine
Using Microsoft BitLocker – By Chris O’Connell V2
43
![Page 44: How to Avoid a $1.5 Million Dollar Fine by Using Microsoft BitLockerfiles.meetup.com/4323362/BitLocker Drive Encryption v5.pdf · 2013. 8. 7. · BitLocker To Go. 8/7/2013 How to](https://reader036.vdocument.in/reader036/viewer/2022063022/5fe9e187a1e8b16cf6236000/html5/thumbnails/44.jpg)
Q&A
Questions and answers before we move on to BitLocker To Go.
8/7/2013How to Avoid a $1.5 Million Dollar Fine
Using Microsoft BitLocker – By Chris O’Connell V2
44
![Page 45: How to Avoid a $1.5 Million Dollar Fine by Using Microsoft BitLockerfiles.meetup.com/4323362/BitLocker Drive Encryption v5.pdf · 2013. 8. 7. · BitLocker To Go. 8/7/2013 How to](https://reader036.vdocument.in/reader036/viewer/2022063022/5fe9e187a1e8b16cf6236000/html5/thumbnails/45.jpg)
BitLocker To Go
• Encryption of removable media
• Does not use domain credentials, you pick a password
• Seamless with Windows 7 and Windows 8, full read/write
• Windows XP & Vista require BitLocker To Go Reader, read only access
• You can say “Never prompt for password on this PC”
8/7/2013How to Avoid a $1.5 Million Dollar Fine
Using Microsoft BitLocker – By Chris O’Connell V2
45
![Page 46: How to Avoid a $1.5 Million Dollar Fine by Using Microsoft BitLockerfiles.meetup.com/4323362/BitLocker Drive Encryption v5.pdf · 2013. 8. 7. · BitLocker To Go. 8/7/2013 How to](https://reader036.vdocument.in/reader036/viewer/2022063022/5fe9e187a1e8b16cf6236000/html5/thumbnails/46.jpg)
BitLocker To Go
• Perhaps best of all, you can FORCE all removable media to be encrypted when it’s plugged in!
8/7/2013How to Avoid a $1.5 Million Dollar Fine
Using Microsoft BitLocker – By Chris O’Connell V2
46
![Page 47: How to Avoid a $1.5 Million Dollar Fine by Using Microsoft BitLockerfiles.meetup.com/4323362/BitLocker Drive Encryption v5.pdf · 2013. 8. 7. · BitLocker To Go. 8/7/2013 How to](https://reader036.vdocument.in/reader036/viewer/2022063022/5fe9e187a1e8b16cf6236000/html5/thumbnails/47.jpg)
BitLocker To Go
8/7/2013How to Avoid a $1.5 Million Dollar Fine
Using Microsoft BitLocker – By Chris O’Connell V2
47
![Page 48: How to Avoid a $1.5 Million Dollar Fine by Using Microsoft BitLockerfiles.meetup.com/4323362/BitLocker Drive Encryption v5.pdf · 2013. 8. 7. · BitLocker To Go. 8/7/2013 How to](https://reader036.vdocument.in/reader036/viewer/2022063022/5fe9e187a1e8b16cf6236000/html5/thumbnails/48.jpg)
BitLocker To Go
8/7/2013How to Avoid a $1.5 Million Dollar Fine
Using Microsoft BitLocker – By Chris O’Connell V2
48
![Page 49: How to Avoid a $1.5 Million Dollar Fine by Using Microsoft BitLockerfiles.meetup.com/4323362/BitLocker Drive Encryption v5.pdf · 2013. 8. 7. · BitLocker To Go. 8/7/2013 How to](https://reader036.vdocument.in/reader036/viewer/2022063022/5fe9e187a1e8b16cf6236000/html5/thumbnails/49.jpg)
BitLocker To Go
8/7/2013How to Avoid a $1.5 Million Dollar Fine
Using Microsoft BitLocker – By Chris O’Connell V2
49
![Page 50: How to Avoid a $1.5 Million Dollar Fine by Using Microsoft BitLockerfiles.meetup.com/4323362/BitLocker Drive Encryption v5.pdf · 2013. 8. 7. · BitLocker To Go. 8/7/2013 How to](https://reader036.vdocument.in/reader036/viewer/2022063022/5fe9e187a1e8b16cf6236000/html5/thumbnails/50.jpg)
Now you’re all Encrypted!
8/7/2013How to Avoid a $1.5 Million Dollar Fine
Using Microsoft BitLocker – By Chris O’Connell V2
50
![Page 51: How to Avoid a $1.5 Million Dollar Fine by Using Microsoft BitLockerfiles.meetup.com/4323362/BitLocker Drive Encryption v5.pdf · 2013. 8. 7. · BitLocker To Go. 8/7/2013 How to](https://reader036.vdocument.in/reader036/viewer/2022063022/5fe9e187a1e8b16cf6236000/html5/thumbnails/51.jpg)
Let’s take a 15 minute break
When we return:
1. A quick BitLocker video
2. BitLocker Active Directory integration and tools
3. Q&A
8/7/2013How to Avoid a $1.5 Million Dollar Fine
Using Microsoft BitLocker – By Chris O’Connell V2
51
![Page 52: How to Avoid a $1.5 Million Dollar Fine by Using Microsoft BitLockerfiles.meetup.com/4323362/BitLocker Drive Encryption v5.pdf · 2013. 8. 7. · BitLocker To Go. 8/7/2013 How to](https://reader036.vdocument.in/reader036/viewer/2022063022/5fe9e187a1e8b16cf6236000/html5/thumbnails/52.jpg)
Welcome Back - Let’s watch a movie!
Here’s a short, 5 minute video on BitLocker and BitLocker To Go:
http://technet.microsoft.com/en-us/windows/bitlocker-and-bitlocker-to-go.aspx
8/7/2013How to Avoid a $1.5 Million Dollar Fine
Using Microsoft BitLocker – By Chris O’Connell V2
52
![Page 53: How to Avoid a $1.5 Million Dollar Fine by Using Microsoft BitLockerfiles.meetup.com/4323362/BitLocker Drive Encryption v5.pdf · 2013. 8. 7. · BitLocker To Go. 8/7/2013 How to](https://reader036.vdocument.in/reader036/viewer/2022063022/5fe9e187a1e8b16cf6236000/html5/thumbnails/53.jpg)
Requirements AD BitLocker Backup
Windows Server 2003 SP1 or higher
Windows Server 2003 R2
Windows Server 2008
Windows Server 2008 R2
I assume Server 2012.
8/7/2013How to Avoid a $1.5 Million Dollar Fine
Using Microsoft BitLocker – By Chris O’Connell V2
53
![Page 54: How to Avoid a $1.5 Million Dollar Fine by Using Microsoft BitLockerfiles.meetup.com/4323362/BitLocker Drive Encryption v5.pdf · 2013. 8. 7. · BitLocker To Go. 8/7/2013 How to](https://reader036.vdocument.in/reader036/viewer/2022063022/5fe9e187a1e8b16cf6236000/html5/thumbnails/54.jpg)
Active Directory Integration
The following BitLocker info can be backed up in AD:• Recovery Passwords (can be numerous per
object)• TPM Owner information (only one per computer
object)
Why do we care about this?Because otherwise we have to manually organize and backup keys.
8/7/2013How to Avoid a $1.5 Million Dollar Fine
Using Microsoft BitLocker – By Chris O’Connell V2
54
![Page 55: How to Avoid a $1.5 Million Dollar Fine by Using Microsoft BitLockerfiles.meetup.com/4323362/BitLocker Drive Encryption v5.pdf · 2013. 8. 7. · BitLocker To Go. 8/7/2013 How to](https://reader036.vdocument.in/reader036/viewer/2022063022/5fe9e187a1e8b16cf6236000/html5/thumbnails/55.jpg)
Active Directory Integration
• BitLocker AD Information is stored under Computer object.
• Each object can have multiple BitLocker recovery objects.
8/7/2013How to Avoid a $1.5 Million Dollar Fine
Using Microsoft BitLocker – By Chris O’Connell V2
55
![Page 56: How to Avoid a $1.5 Million Dollar Fine by Using Microsoft BitLockerfiles.meetup.com/4323362/BitLocker Drive Encryption v5.pdf · 2013. 8. 7. · BitLocker To Go. 8/7/2013 How to](https://reader036.vdocument.in/reader036/viewer/2022063022/5fe9e187a1e8b16cf6236000/html5/thumbnails/56.jpg)
Active Directory Integration
• Previously encrypted machines/devices will not automatically back up keys and TPM owner information to AD.
• Configure AD first, before encrypting!
8/7/2013How to Avoid a $1.5 Million Dollar Fine
Using Microsoft BitLocker – By Chris O’Connell V2
56
![Page 57: How to Avoid a $1.5 Million Dollar Fine by Using Microsoft BitLockerfiles.meetup.com/4323362/BitLocker Drive Encryption v5.pdf · 2013. 8. 7. · BitLocker To Go. 8/7/2013 How to](https://reader036.vdocument.in/reader036/viewer/2022063022/5fe9e187a1e8b16cf6236000/html5/thumbnails/57.jpg)
Some things to do with GPO
• Prevent BitLocker from encrypting unless the key is backed up in AD.
• Configure keys to save to network share.
• Configure a larger key size. Note: larger keysize = higher performance impact.
• You can set BitLocker To Go to be used in numerous organizations.
8/7/2013How to Avoid a $1.5 Million Dollar Fine
Using Microsoft BitLocker – By Chris O’Connell V2
57
![Page 58: How to Avoid a $1.5 Million Dollar Fine by Using Microsoft BitLockerfiles.meetup.com/4323362/BitLocker Drive Encryption v5.pdf · 2013. 8. 7. · BitLocker To Go. 8/7/2013 How to](https://reader036.vdocument.in/reader036/viewer/2022063022/5fe9e187a1e8b16cf6236000/html5/thumbnails/58.jpg)
Some things to do with GPO
• Configure a Data Recovery Agent
8/7/2013How to Avoid a $1.5 Million Dollar Fine
Using Microsoft BitLocker – By Chris O’Connell V2
58
![Page 59: How to Avoid a $1.5 Million Dollar Fine by Using Microsoft BitLockerfiles.meetup.com/4323362/BitLocker Drive Encryption v5.pdf · 2013. 8. 7. · BitLocker To Go. 8/7/2013 How to](https://reader036.vdocument.in/reader036/viewer/2022063022/5fe9e187a1e8b16cf6236000/html5/thumbnails/59.jpg)
Minimum GPO Settings
Computer Configuration\Policies\Administrative Templates\Windows Components\BitLocker Drive Encryption:• Save BitLocker Recovery Information in Active Directory Domain Services =
enabled– Require BitLocker to backup to AD DS = checked
Computer Configuration\Policies\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives:• Chose how BitLocker-protected Operating System Drives Can Be
Recovered = enabled– Do note enable BitLocker until recovery information is stored in AD DS for
operating system drives = checked (way at the bottom)
Computer Configuration\Policies\Administrative Templates\System\Trusted Platform Module Services• Turn on TPM backup to Active Directory Domain Services
8/7/2013How to Avoid a $1.5 Million Dollar Fine
Using Microsoft BitLocker – By Chris O’Connell V2
59
![Page 60: How to Avoid a $1.5 Million Dollar Fine by Using Microsoft BitLockerfiles.meetup.com/4323362/BitLocker Drive Encryption v5.pdf · 2013. 8. 7. · BitLocker To Go. 8/7/2013 How to](https://reader036.vdocument.in/reader036/viewer/2022063022/5fe9e187a1e8b16cf6236000/html5/thumbnails/60.jpg)
8/7/2013How to Avoid a $1.5 Million Dollar Fine
Using Microsoft BitLocker – By Chris O’Connell V2
60
![Page 61: How to Avoid a $1.5 Million Dollar Fine by Using Microsoft BitLockerfiles.meetup.com/4323362/BitLocker Drive Encryption v5.pdf · 2013. 8. 7. · BitLocker To Go. 8/7/2013 How to](https://reader036.vdocument.in/reader036/viewer/2022063022/5fe9e187a1e8b16cf6236000/html5/thumbnails/61.jpg)
8/7/2013How to Avoid a $1.5 Million Dollar Fine
Using Microsoft BitLocker – By Chris O’Connell V2
61
![Page 62: How to Avoid a $1.5 Million Dollar Fine by Using Microsoft BitLockerfiles.meetup.com/4323362/BitLocker Drive Encryption v5.pdf · 2013. 8. 7. · BitLocker To Go. 8/7/2013 How to](https://reader036.vdocument.in/reader036/viewer/2022063022/5fe9e187a1e8b16cf6236000/html5/thumbnails/62.jpg)
BitLocker Password Recovery Viewer
To view on Windows Workstation:
8/7/2013How to Avoid a $1.5 Million Dollar Fine
Using Microsoft BitLocker – By Chris O’Connell V2
62
![Page 63: How to Avoid a $1.5 Million Dollar Fine by Using Microsoft BitLockerfiles.meetup.com/4323362/BitLocker Drive Encryption v5.pdf · 2013. 8. 7. · BitLocker To Go. 8/7/2013 How to](https://reader036.vdocument.in/reader036/viewer/2022063022/5fe9e187a1e8b16cf6236000/html5/thumbnails/63.jpg)
BitLocker Password Recovery Viewer
To view on Windows Server 2012:
8/7/2013How to Avoid a $1.5 Million Dollar Fine
Using Microsoft BitLocker – By Chris O’Connell V2
63
![Page 64: How to Avoid a $1.5 Million Dollar Fine by Using Microsoft BitLockerfiles.meetup.com/4323362/BitLocker Drive Encryption v5.pdf · 2013. 8. 7. · BitLocker To Go. 8/7/2013 How to](https://reader036.vdocument.in/reader036/viewer/2022063022/5fe9e187a1e8b16cf6236000/html5/thumbnails/64.jpg)
This is what it looks like
8/7/2013How to Avoid a $1.5 Million Dollar Fine
Using Microsoft BitLocker – By Chris O’Connell V2
64
![Page 65: How to Avoid a $1.5 Million Dollar Fine by Using Microsoft BitLockerfiles.meetup.com/4323362/BitLocker Drive Encryption v5.pdf · 2013. 8. 7. · BitLocker To Go. 8/7/2013 How to](https://reader036.vdocument.in/reader036/viewer/2022063022/5fe9e187a1e8b16cf6236000/html5/thumbnails/65.jpg)
Scripting
Tools are available:
Manage-bde command line tool
BitLocker WMI
8/7/2013How to Avoid a $1.5 Million Dollar Fine
Using Microsoft BitLocker – By Chris O’Connell V2
65
![Page 66: How to Avoid a $1.5 Million Dollar Fine by Using Microsoft BitLockerfiles.meetup.com/4323362/BitLocker Drive Encryption v5.pdf · 2013. 8. 7. · BitLocker To Go. 8/7/2013 How to](https://reader036.vdocument.in/reader036/viewer/2022063022/5fe9e187a1e8b16cf6236000/html5/thumbnails/66.jpg)
Resources
The $1.5 Million Dollar Fine
https://www.cdt.org/blogs/alice-leiter/2409stolen-laptop-unencrypted-medical-data-15-million-fine
BitLocker To Go:
http://www.microsoft.com/en-us/download/details.aspx?id=24303
8/7/2013How to Avoid a $1.5 Million Dollar Fine
Using Microsoft BitLocker – By Chris O’Connell V2
66
![Page 67: How to Avoid a $1.5 Million Dollar Fine by Using Microsoft BitLockerfiles.meetup.com/4323362/BitLocker Drive Encryption v5.pdf · 2013. 8. 7. · BitLocker To Go. 8/7/2013 How to](https://reader036.vdocument.in/reader036/viewer/2022063022/5fe9e187a1e8b16cf6236000/html5/thumbnails/67.jpg)
Resources
Detailed Microsoft documentation on BitLocker:
http://technet.microsoft.com/en-us/library/dd875529(v=ws.10).aspx
BitLocker Recovery Password Viewer for Active Directory:
http://technet.microsoft.com/en-us/library/dd875531(v=ws.10).aspx
8/7/2013How to Avoid a $1.5 Million Dollar Fine
Using Microsoft BitLocker – By Chris O’Connell V2
67
![Page 68: How to Avoid a $1.5 Million Dollar Fine by Using Microsoft BitLockerfiles.meetup.com/4323362/BitLocker Drive Encryption v5.pdf · 2013. 8. 7. · BitLocker To Go. 8/7/2013 How to](https://reader036.vdocument.in/reader036/viewer/2022063022/5fe9e187a1e8b16cf6236000/html5/thumbnails/68.jpg)
Resources
File needed to update AD Schema:
http://www.microsoft.com/en-us/download/confirmation.aspx?id=13432
Instructions on verifying AD Schema:
http://technet.microsoft.com/en-us/library/dd875533(v=ws.10).aspx
8/7/2013How to Avoid a $1.5 Million Dollar Fine
Using Microsoft BitLocker – By Chris O’Connell V2
68
![Page 69: How to Avoid a $1.5 Million Dollar Fine by Using Microsoft BitLockerfiles.meetup.com/4323362/BitLocker Drive Encryption v5.pdf · 2013. 8. 7. · BitLocker To Go. 8/7/2013 How to](https://reader036.vdocument.in/reader036/viewer/2022063022/5fe9e187a1e8b16cf6236000/html5/thumbnails/69.jpg)
Resources
BitLocker Data Recovery Agent Video:
https://www.youtube.com/watch?v=TNx9HANvCP8&feature=youtube_gdata_player
Scripting BitLocker install:
http://technet.microsoft.com/en-us/library/dd894351(v=ws.10).aspx
8/7/2013How to Avoid a $1.5 Million Dollar Fine
Using Microsoft BitLocker – By Chris O’Connell V2
69