I’m going to start a little series of posts to demonstrate that “we” aren’t serious about computer and network security. By “we” I mean everyone from individual users of mobile phones and computers through to the government, telecommunications carriers, and equipment providers that together are responsible for the backbone of the Internet.

In the last 15 months two members of my family have had their notebook computers stolen. I was one of them. As it turned out my computer was owned by my employer and they mandated use of Microsoft’s BitLocker feature to encrypt the hard drive. Whenever the computer was booted you had to enter a PIN which would unlock the key needed to access the encrypted drive. Without the PIN that key remained locked away in a special chip called the Trusted Platform Module (TPM) and the hard drive could not be read. So when my notebook was stolen I didn’t worry about it. The notebook was a brick from which no one short of the NSA was going to get any of my (or my employer’s) data. Some months later a relative’s work notebook was also stolen, Unfortunately her employer didn’t mandate hard drive encryption and so both their proprietary data and her personal data had to be considered compromised. This is a common occurrence and one that has impacted me personally on a number of occasions. For example, when a notebook containing data about HP Pension Plan participants was stolen.

Now why aren’t all hard drives encrypted by default? I could blame this on Microsoft, Apple, and PC makers but that wouldn’t be completely fair. There is a combination of lack of sufficient push from the industry and lack of sufficient pull from users. The problem is that unless security is “free”, not just in financial terms but also in usability, then end-users aren’t too interested. I already described one usability issue, that you have to enter a PIN to boot your computer, and that is just the tip of the iceberg.

All encryption systems have what is known as “the key management problem”. I won’t go into all the permutations but let me give a simple example. Encryption takes place according to a key that either the user supplies or the system automatically generates. User supplied keys, like passwords, tend not to be very good because they are too short and often guessable. What you really want is a long (dozens of characters or more) randomly generated key. But of course a human being can never remember such a key, nor would they be willing to enter it every time they started up their computer. So one solution is to securely store a long randomly generated key somewhere and then have a short code to unlock the key. The TPM provides that local secure storage. But what happens if you forget the code that unlocks the key in the TPM, the TPM is damaged, or some other system failure occurs? How do you recover the data on the hard drive? Well, you need to have a recovery key stored elsewhere. In a corporate environment using Microsoft Bitlocker the keys are automatically backed up to the organization’s Domain Controller. But what does a consumer do? They have to keep a manual backup of the key, and if they lose it and then need it later the data on the hard drive is lost. I have sitting in a safe printouts of keys from a number of older computers that I used BitLocker on. First of all I don’t know which printout goes with what (no longer in my possession) computer. Second, they are locked in a safe. If my hard drive suddenly became unusable while I’m 3000 miles away I wouldn’t have been able to get the code to fix it.

But it gets worse. Because consumers don’t use features that depend on the TPM computer makers don’t include TPMs in consumer grade notebooks! So where do you store the key in the first place? Well, for BitLocker the answer is that if you don’t have a TPM you have to use a USB flash drive to store the key. Then if the USB drive isn’t attached you can’t boot the computer. I don’t know about you, but I really don’t want to have to plug a USB flash drive in every time I start my computer. Worse, I can assure you such a drive will get left in a Starbucks or on an airplane at some point in time rendering my computer unbootable.

There is another problem as well. Acquiring the PIN and the decryption key from the TPM (or other location) occurs at boot time. Once running a system is vulnerable until a reboot is required. This would seem like a small window of vulnerability except for one thing SLEEP mode. Most of us really like the near instant on capability that SLEEP provides and so our notebooks are set to SLEEP if the lid is closed or power management turns off the system. Just open the lid and you are back in business just about instantaneously! Of course, this doesn’t go through the boot sequence and thus when your sleeping notebook is stolen it is vulnerable. The solution is to change your power management settings so that instead of going to SLEEP your notebook HIBERNATEs. When a hibernating PC wakes up it does go through the boot sequence and you have to enter your pin. Unfortunately coming out of HIBERNATE will take tens of seconds to a minute or more compared to the instant on of SLEEP, and this may be unacceptable to many users.

Given the lack of TPMs in consumer grade machines, and the lack of a decent backup scheme in non-Domain environments, Microsoft leaves BitLocker out of most Windows SKUs. You have to have Windows Enterprise or Windows Ultimate to get BitLocker. Now the chicken and egg problem is complete. Most people don’t use hard drive encryption because the support doesn’t come built-in to their machine, and neither the hardware manufacturers nor OS supplier will provide it by default because users aren’t clamoring for it. The net result is that in many (if not most) cases if a notebook is stolen then the information on it is compromised. Be that the social security numbers of your employees or your own credit card numbers, it is a bad thing.

By the way, I’m not really picking on Microsoft here (other than as part of the overall group of hardware/OS suppliers). Apple doesn’t appear to offer full hard drive encryption for the Mac at all. Nor have the OEMs stood up and put alternate encryption solutions in place. Both Microsoft and Apple offer the ability to encrypt individual folder hierarchies on a hard drive, but this is far less secure than full hard drive encryption. For example although the original files might be encrypted temporary copies may be stored in areas of the hard drive outside the folder hierarchy and thus are not encrypted.

There are any number of third-party solutions available, including hard drives with built-in encryption. I recommend (and also use) TrueCrypt for machines where BitLocker isn’t feasible. It is free, so financial considerations shouldn’t keep one from using it. Key storage isn’t quite as secure as a TPM, and results in the startup PIN being a long (20-30 character) password unlike the 6-8 digits you would use with a TPM and Bitlocker. Recovery key management is similar to Bitlocker in non-Domain environments except that TrueCrypt forces you to create a recovery CD/DVD before it will encrypt the drive. The same problem thus exists, the recovery CD is sitting in a safe and likely rather inaccessible should I ever need it. But given all my critical data is stored in the cloud, I’ll take the (slight) chance of ending up with a dead machine over the pain of having my identity stolen should the notebook get stolen.

So what would happen if “we” were serious about security? All notebooks (and perhaps even desktops) would come with full hard drive encryption on by default. Supplying a PIN would be part of the initial setup. A TPM or equivalent would be included in all computers. Key backup services for consumers would be provided by Microsoft (via Skydrive for instance), other encryption provider, or the OEMs. SLEEP would invalidate the hard drive keys and waking from the sleep state would go through a process to re-acquire them, thus giving a secure (and almost as) instant-on capability.

By the way, Apple almost gets it right with the iPad. All data on an iPad is encrypted. Unfortunately, unless your organization forces it as part of your access to Exchange email, most users don’t use a passcode lock on their iPad. Or if they do, they use simple 4-digit PINs instead of complex passwords. And in either case they don’t turn on the feature to wipe the device after a number of false passwords are entered. And if they do turn it on then IOS allows too many attempts (10) before wiping the device, particularly with a 4 digit PIN. The encryption does no good without a decent passcode.