Encryption & Bitlocker

What protects data hosted on a file system when the OS mediates access to the device?

the operating system's security model

What describes the permissions that principals have on a file or folder?

an access control list (ACL)

When are file or folder permissions enforced?

when the OS mediates access to the device

Why could file permissions be overridden?

the disk is exposed to a different OS

What is data on persistent storage such as HDDs, SSDs, and thumb drives called?

data-at-rest

How can data-at-rest be protected against these risks?

encrypt the information stored on a disk

What does data-at-rest contrast with?

data-in-transit and data-in-use

What Windows feature of NTFS supports file and folder encryption?

Encrypting File System (EFS)

What edition of Windows does not include EFS?

Home edition

How do you apply EFS encryption to a file or folder?

open the file's or folder's property sheet, select Advanced, check Encrypt contents, then confirm the dialogs

How can encrypted folders and files be shown in Explorer?

with green color coding

What error will other users receive when trying to browse, copy, or print an encrypted file?

Access Denied

Without strong authentication, encrypted data is only as secure as what?

the user account password

What grants access to the key that performs file encryption and decryption?

the user's password

What can cause data loss with EFS?

the key being lost or damaged

What are examples of situations that can cause the key to be lost or damaged?

the user's profile is damaged, the user's password is reset by an administrator, or Windows is reinstalled

How can recovery be set up for EFS-encrypted data on a Windows domain?

back up the key to set up recovery agents with the ability to decrypt data

What is an alternative to file encryption?

full disk encryption (FDE)

What Windows disk encryption product provides full disk encryption?

BitLocker

Which Windows edition does not include BitLocker?

Home edition

What is the main advantage of full disk encryption?

it does not depend on the user to remember to encrypt data

What additional data does disk encryption also encrypt?

the swap file, print queues, temporary files, and so on

What types of drives can BitLocker be used with?

any volumes on fixed (internal) drives

What BitLocker form is used with removable drives?

BitLocker To Go

What must the user have access to in order to access encrypted data?

the encryption key

What chip can BitLocker use to tie the use of a fixed disk to a particular motherboard?

a trusted platform module (TPM) chip

What is the TPM used for with BitLocker?

storing the encryption key securely and ensuring the integrity of the OS used to boot the machine

What are alternatives to storing the BitLocker key in the TPM?

a removable smart card or a USB stick

What must the computer's firmware support for a USB startup key to work?

booting from USB

What must the TPM be configured with?

an owner password

How can TPM settings be managed from Windows?

the TPM Management snap-in

What is generated during BitLocker setup for drive recovery?

a recovery key

How should the BitLocker recovery key be stored?

on removable media or written down, stored securely and separately from the computer

What can the BitLocker recovery key be used for?

recovering the encrypted drive if the startup key is lost

What PowerShell cmdlet is used to turn on BitLocker for a volume?

Enable-BitLocker

What does -MountPoint "DriveLetter:" specify?

the drive you want to encrypt

What does -EncryptionMethod MethodName define?

the encryption algorithm and strength to use

What does -UsedSpaceOnly:$true do?

encrypt only the space currently in use

What does -UsedSpaceOnly:$false do?

encrypt the entire drive, including free space

What does -RecoveryKeyPath "Path" specify?

a folder path where the recovery key file should be stored

What does -RecoveryKeyProtector add?

a recovery key protector so the drive can be unlocked using a recovery key file if needed

What does -TpmProtector use as a protector?

the Trusted Platform Module (TPM) on the system

What does -SkipHardwareTest:$true do?

skips the hardware test and starts encryption immediately

What does -SkipHardwareTest:$false do?

requires a restart to validate the BitLocker configuration before encryption begins